Detections
Analytics
Alpine: multiple openvswitch packages, py3-openvswitch: security update to 2.12.1-r0
medium Tenable Cloud Security Plugin ID 406186
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4
and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user socket, can
send specially crafted VRING_SET_NUM messages, resulting in a memory leak including file descriptors. This
flaw could lead to a denial of service condition. (CVE-2019-14818)
- A vulnerability was found in DPDK versions 18.05 and above. A missing check for an integer overflow in
vhost_user_set_log_base() could result in a smaller memory map than requested, possibly allowing memory
corruption. (CVE-2020-10722)
- A memory corruption issue was found in DPDK versions 17.05 and above. This flaw is caused by an integer
truncation on the index of a payload. Under certain circumstances, the index (a UInt) is copied and
truncated into a uint16, which can lead to out of bound indexing and possible memory corruption.
(CVE-2020-10723)
- A vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is missing
validations for user-supplied values, potentially allowing an information leak through an out-of-bounds
memory read. (CVE-2020-10724)
See Also
https://security.alpinelinux.org/vuln/CVE-2019-14818
https://security.alpinelinux.org/vuln/CVE-2020-10722
Plugin Details
Severity: Medium
ID: 406186
Version: Revision 1.30
Type: Local
Published: 10/31/2023
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.12
CVSS v2
Risk Factor: Medium
Base Score: 4.6
Temporal Score: 3.4
Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2020-10723
CVSS v3
Risk Factor: Medium
Base Score: 6.7
Temporal Score: 5.8
Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 11/13/2019
Reference Information
CVE: CVE-2019-14818, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724