==========================================================================
Ubuntu Security Notice USN-3873-1
January 30, 2019

openvswitch vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 18.04 LTS
– Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in Open vSwitch.

Software Description:
– openvswitch: Ethernet virtual switch

Details:

It was discovered that Open vSwitch incorrectly decoded certain packets. A
remote attacker could possibly use this issue to cause Open vSwitch to
crash, resulting in a denial of service. (CVE-2018-17204)

It was discovered that Open vSwitch incorrectly handled processing certain
flows. A remote attacker could possibly use this issue to cause Open
vSwitch to crash, resulting in a denial of service. This issue only
affected Ubuntu 18.04 LTS. (CVE-2018-17205)

It was discovered that Open vSwitch incorrectly handled BUNDLE action
decoding. A remote attacker could possibly use this issue to cause Open
vSwitch to crash, resulting in a denial of service. (CVE-2018-17206)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS:
openvswitch-common 2.9.2-0ubuntu0.18.04.3

Ubuntu 16.04 LTS:
openvswitch-common 2.5.5-0ubuntu0.16.04.2

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/usn/usn-3873-1
CVE-2018-17204, CVE-2018-17205, CVE-2018-17206

Package Information:
https://launchpad.net/ubuntu/+source/openvswitch/2.9.2-0ubuntu0.18.04.3
https://launchpad.net/ubuntu/+source/openvswitch/2.5.5-0ubuntu0.16.04.2

—–BEGIN PGP SIGNATURE—–

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAlxRrbIACgkQZWnYVadE
vpNXlA//cxJ+QnZvFPM7KKyfWcQVx4s8CMW0iNsgfBG0aLv3L1vHEaLAcx3JW/0f
pxJNyldqsjV7cKMwu21+ok2GOWqxpZGRdEOeYwBh6skhXKF5qYOWorNcN7Z1ZcBK
WnnfSlHaE7FH2P8HVAvZUtfL+BSIy7IhYPfROGp+QKnjPdtD6wBsBr4teN2ZbMsz
Xgmnyf/f0X78osDfg1NaR7oJoChQN9A/oz+EvVOz/PeOgol33UCWO0DgwrsuQvuo
du8hDDMQiR3lSHqxiFvkWWiF8G5P2aZMUNVYh2++jjQsCiQKjwUXDhbntQ1A+9aX
whhpT/HjfdgFy5SEu+7NEIkEMG38OqKmNwI769bGREzyr9wvIn5TlkFUYAFLOvKr
Mny1AY/Zpvi4GArjOkCL73QrFVCgPpGjOagC7xgzy1Rwg3mTy08aJPrnPiOvFShI
KrPypjmAcNc0rwrx3lEMww7i4f/Mym3iBFem1tGMeD0NRLq+7g1IPScQNg6K2/Q7
rlgBNHog8iKLONwSTjErm32JmJfbsAbhyXP+uqQFb1tcuLMdlggrUSXx72h5cySs
0q9JYy/HVS1/Gwwke9pSy3O8s+Su9zSWuuhwiQqO6bT2h+abCmXijGi/5C2Qga42
ZDNRZy93xq2umDBFKJyAxBaJ6tq1ZTmtnWKJ4UtoKniFhofg5fE=
=K/JG
—–END PGP SIGNATURE—–
—