Alpine: multiple openvswitch packages, py3-openvswitch: security update to 2.12.2-r0

critical Tenable Self-Hosted Container Security Plugin ID 406187

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- Buffer overflow in the lldp_decode function in daemon/protocols/lldp.c in lldpd before 0.8.0 allows remote
attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via vectors
involving large management addresses and TLV boundaries. (CVE-2015-8011)

- A flaw was found in multiple versions of OpenvSwitch. Specially crafted LLDP packets can cause memory to
be lost when allocating data to handle specific optional TLVs, potentially causing a denial of service.
The highest threat from this vulnerability is to system availability. (CVE-2020-27827)

Plugin Details

Severity: Critical

ID: 406187

Version: Revision 1.26

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/31/2023

Updated: 12/4/2025

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2015-8011

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/16/2015

Reference Information

CVE: CVE-2015-8011, CVE-2020-27827

BID: 77114

Detections

Analytics