CVE-2019-15753
9.1
CRITICAL · CVSS 3.0 · EPSS 2.6% (pctl 85)
In your normal cycle
Critical by CVSS (9.1), but no sign of active exploitation.
Description
In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC learning in linuxbridge, forcing obligatory Ethernet flooding of non-local destinations, which both impedes network performance and allows users to possibly view the content of packets for instances belonging to other tenants sharing the same network. Only deployments using the linuxbridge backend are affected. This occurs in PyRoute2.add() in internal/command/ip/linux/impl_pyroute2.py.
Scoring
| CVSS | 9.1 (CRITICAL, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
| EPSS | 2.61% — more likely to be exploited than 85% of all CVEs |
| Weakness | CWE-770 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2019-08-28 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| openstack | os-vif |
References
- http://www.openwall.com/lists/oss-security/2019/08/29/2
- https://launchpad.net/bugs/1837252
- https://review.opendev.org/672834
- https://review.opendev.org/678098
- https://security.openstack.org/ossa/OSSA-2019-004.html
- http://www.openwall.com/lists/oss-security/2019/08/29/2
- https://launchpad.net/bugs/1837252
- https://review.opendev.org/672834
- https://review.opendev.org/678098
- https://security.openstack.org/ossa/OSSA-2019-004.html
→ the Explorer · watch your stack · NVD