CVE-2022-4338
Publication date 10 January 2023
Last updated 24 July 2024
Ubuntu priority
Cvss 3 Severity Score
An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch.
Status
Package | Ubuntu Release | Status |
---|---|---|
openvswitch | 24.04 LTS noble |
Not affected
|
22.04 LTS jammy |
Fixed 2.17.3-0ubuntu0.22.04.2
|
|
20.04 LTS focal |
Fixed 2.13.8-0ubuntu1.1
|
|
18.04 LTS bionic |
Fixed 2.9.8-0ubuntu0.18.04.4
|
|
16.04 LTS xenial |
Needs evaluation
|
|
14.04 LTS trusty | Ignored end of standard support |
Notes
mdeslaur
same commit as CVE-2022-4337 This issue is fixed in (3.0.3-0ubuntu0.22.10.1) in kinetic but is not in the -security pocket.
Severity score breakdown
Parameter | Value |
---|---|
Base score | 9.8 · Critical |
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | None |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | High |
Availability impact | High |
Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
References
Related Ubuntu Security Notices (USN)
- USN-5890-1
- Open vSwitch vulnerabilities
- 27 February 2023