openvswitch 2.17.8 was discovered to contain a memory leak via the function xmalloc__ in openvswitch-2.17.8/lib/util.c.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5640 advisory.

    -----BEGIN PGP SIGNED MESSAGE-----     Hash: SHA512

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5640-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     March 14, 2024                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : openvswitch     CVE ID         : CVE-2023-3966 CVE-2023-5366     Debian Bug     : 1063492

    Two vulnerabilities were discovered in Open vSwitch, a software-based     Ethernet virtual switch, which could result in a bypass of OpenFlow     rules or denial of service.

    For the oldstable distribution (bullseye), these problems have been fixed     in version 2.15.0+ds1-2+deb11u5. This update also adresses a memory leak     tracked as CVE-2024-22563.

    For the stable distribution (bookworm), these problems have been fixed in     version 3.1.0-2+deb12u1.

    We recommend that you upgrade your openvswitch packages.

    For the detailed security status of openvswitch please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/openvswitch

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org
    -----BEGIN PGP SIGNATURE-----

    iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmXy+NgACgkQEMKTtsN8     TjasEQ//V4q2/qeHlZk+Sr/73jLvDOA7u6O+FxGGi+LHBiYIoUlD+E2jEq/pAzaK     /hlpHCKO1g5bkf7/TcA9TaMyxo498LmT6/TX6SNB+lxOcJQlS8KyT/JtNQt31nk4     LND1IU/WFliMdNQoqwYgZVp6innCmb2hTYcxTKeGeQndnaTRIGo/FShxgCBZHwOJ     KB39eg0hQCDgx1DzfkA0e9u/I7Vq4MKEitV5u1H+Uf9embZaUsfwJCSaeshuxmp4     U20r2V9hxXVYrhAeFWYGiDEY+Di4O9fDOVLw2An19ncQjDquLfRYqdys8AMxzi3+     Vm0VasMAmZlEhdjcSjtotMI3tjgLcWGOz8BGdBUTAKK0FMtzPHLMhjfJ/cpC6jxZ     19ZJcD3OUDIA6nf4CZjW4BOCImukqm9EUJtcQFZAGONdkelNYiz6V5R6IpbAVtLP     Vkx5yyWWEPXau6eZKhKO0aMcBiAGUYs2LI0rmrmPBdTtQcZJmTx7U+jZiPO6Dx0Y     P5DMwY23Z8GWPZeDX/2C8HBPqAMKfsWzIOEcXJ0HlAnVyJnC7XGBb+q4W+RFDWhc     XYbi40SyyHrDqYBg/ne7WxEnmzfMk3F9cqRCn+owV2lbYxYRKIDZngyg2JK3sdjM     UfnFE+5D8QRvxQQMYM9H8q3iBzR1KVEi6cpUUoTZCz6qI5rcH6E=     =ZEHS
    -----END PGP SIGNATURE-----



Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2024:0462-1 advisory.

  - openvswitch 2.17.8 was discovered to contain a memory leak via the function xmalloc__ in     openvswitch-2.17.8/lib/util.c. (CVE-2024-22563)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0544-1 advisory.

  - openvswitch 2.17.8 was discovered to contain a memory leak via the function xmalloc__ in     openvswitch-2.17.8/lib/util.c. (CVE-2024-22563)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0553-1 advisory.

  - openvswitch 2.17.8 was discovered to contain a memory leak via the function xmalloc__ in     openvswitch-2.17.8/lib/util.c. (CVE-2024-22563)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0526-1 advisory.

  - openvswitch 2.17.8 was discovered to contain a memory leak via the function xmalloc__ in     openvswitch-2.17.8/lib/util.c. (CVE-2024-22563)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0524-1 advisory.

  - openvswitch 2.17.8 was discovered to contain a memory leak via the function xmalloc__ in     openvswitch-2.17.8/lib/util.c. (CVE-2024-22563)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
192117	Debian dsa-5640 : openvswitch-common - security update	Nessus	Debian Local Security Checks	medium
191051	SUSE SLES15 Security Update : openvswitch (SUSE-SU-2024:0462-1)	Nessus	SuSE Local Security Checks	high
190837	SUSE SLES12 Security Update : openvswitch (SUSE-SU-2024:0544-1)	Nessus	SuSE Local Security Checks	high
190833	SUSE SLES15 / openSUSE 15 Security Update : openvswitch (SUSE-SU-2024:0553-1)	Nessus	SuSE Local Security Checks	high
190753	SUSE SLES15 Security Update : openvswitch (SUSE-SU-2024:0526-1)	Nessus	SuSE Local Security Checks	high
190751	SUSE SLES15 Security Update : openvswitch (SUSE-SU-2024:0524-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2024-22563

high

Tenable Plugins

medium

high

high

high

high

high