{"id":"CVE-2017-9264","aliases":["DEBIAN-CVE-2017-9264","EUVD-2017-18200","GHSA-r4pw-w7qg-248f","RHSA-2017:2418","RHSA-2017:2648","RHSA-2017:2727"],"status":"published","title":"In lib/conntrack.c in the firewall implementation in Open vSwitch (OvS) 2.6.1, there is a buffer...","description":"In lib/conntrack.c in the firewall implementation in Open vSwitch (OvS) 2.6.1, there is a buffer over-read while parsing malformed TCP, UDP, and IPv6 packets in the functions `extract_l3_ipv6`, `extract_l4_tcp`, and `extract_l4_udp` that can be triggered remotely.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02415,"percentile":0.84244,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2017-05-29T03:52:00Z","modified":"2026-10-24T10:30:27Z","fixes":[{"ecosystem":"Debian:12","package":"openvswitch","fixed_in":["2.8.1+dfsg1-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openvswitch","fixed_in":["2.8.1+dfsg1-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openvswitch","fixed_in":["2.8.1+dfsg1-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.1+dfsg1-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.1+dfsg1-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.1+dfsg1-2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.2-1.git20170719.el7fdp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"openvswitch-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.2-1.git20170719.el7fdp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"openvswitch-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.2-1.git20170719.el7fdp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"openvswitch-ovn-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.2-1.git20170719.el7fdp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"openvswitch-ovn-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.2-1.git20170719.el7fdp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"python-openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.2-1.git20170719.el7fdp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::fastdatapath","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.2-1.git20170719.el7fdp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::fastdatapath","package":"openvswitch-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.2-1.git20170719.el7fdp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::fastdatapath","package":"openvswitch-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.2-1.git20170719.el7fdp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::fastdatapath","package":"openvswitch-ovn-central","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.2-1.git20170719.el7fdp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::fastdatapath","package":"openvswitch-ovn-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.2-1.git20170719.el7fdp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::fastdatapath","package":"openvswitch-ovn-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.2-1.git20170719.el7fdp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::fastdatapath","package":"openvswitch-ovn-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.2-1.git20170719.el7fdp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::fastdatapath","package":"openvswitch-ovn-vtep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.2-1.git20170719.el7fdp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::fastdatapath","package":"openvswitch-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.2-1.git20170719.el7fdp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::fastdatapath","package":"python-openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.2-1.git20170719.el7fdp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openstack:10::el7","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.1-13.git20161206.el7ost"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openstack:10::el7","package":"openvswitch-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.1-13.git20161206.el7ost"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openstack:10::el7","package":"python-openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.1-13.git20161206.el7ost"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openstack:11::el7","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.1-13.git20161206.el7ost"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openstack:11::el7","package":"openvswitch-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.1-13.git20161206.el7ost"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openstack:11::el7","package":"openvswitch-ovn-central","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.1-13.git20161206.el7ost"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openstack:11::el7","package":"openvswitch-ovn-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.1-13.git20161206.el7ost"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openstack:11::el7","package":"openvswitch-ovn-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.1-13.git20161206.el7ost"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openstack:11::el7","package":"openvswitch-ovn-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.1-13.git20161206.el7ost"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openstack:11::el7","package":"openvswitch-ovn-vtep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.1-13.git20161206.el7ost"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openstack:11::el7","package":"python-openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.1-13.git20161206.el7ost"}]}],"bundled":4}],"products":[{"vendor":"openvswitch","product":"openvswitch"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2017:2727","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2418","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://mail.openvswitch.org/pipermail/ovs-dev/2017-March/329323.html","tags":["x_refsource_CONFIRM","x_transferred","Mailing List","Patch","Vendor Advisory","fix"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2648","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9264","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-r4pw-w7qg-248f"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-9264","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1456795","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1457327","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1457329","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1457335","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1472729","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1472854","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2418.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-9214","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9214","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9214","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-9263","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9263","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9263","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-9264","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9264","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-9265","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9265","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9265","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1431490","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1436610","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1463732","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468334","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468631","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468751","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1472334","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1472335","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1473735","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2648.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2727.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2017-9264","description":"In lib/conntrack.c in the firewall implementation in Open vSwitch (OvS) 2.6.1, there is a buffer over-read while parsing malformed TCP, UDP, and IPv6 packets in the functions `extract_l3_ipv6`, `extract_l4_tcp`, and `extract_l4_udp` that can be triggered remotely.","status":"published","published":"2017-05-29T03:52:00Z","modified":"2024-08-05T17:02:44.204Z","updated_at":"2026-11-02T14:33:13.606903Z"}],"euvd":[{"id":"EUVD-2017-18200","description":"In lib/conntrack.c in the firewall implementation in Open vSwitch (OvS) 2.6.1, there is a buffer over-read while parsing malformed TCP, UDP, and IPv6 packets in the functions `extract_l3_ipv6`, `extract_l4_tcp`, and `extract_l4_udp` that can be triggered remotely.","status":"published","published":"2017-05-29T03:52:00Z","modified":"2024-08-05T17:02:44Z","updated_at":"2026-11-03T02:23:28.642509Z"}],"ghsa":[{"id":"GHSA-r4pw-w7qg-248f","title":"In lib/conntrack.c in the firewall implementation in Open vSwitch (OvS) 2.6.1, there is a buffer...","description":"In lib/conntrack.c in the firewall implementation in Open vSwitch (OvS) 2.6.1, there is a buffer over-read while parsing malformed TCP, UDP, and IPv6 packets in the functions `extract_l3_ipv6`, `extract_l4_tcp`, and `extract_l4_udp` that can be triggered remotely.","status":"published","published":"2022-05-13T01:47:52Z","modified":"2023-02-02T05:01:32Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:51:12.391632Z"}],"nvd":[{"id":"CVE-2017-9264","description":"In lib/conntrack.c in the firewall implementation in Open vSwitch (OvS) 2.6.1, there is a buffer over-read while parsing malformed TCP, UDP, and IPv6 packets in the functions `extract_l3_ipv6`, `extract_l4_tcp`, and `extract_l4_udp` that can be triggered remotely.","status":"published","published":"2017-05-29T04:29:00.4Z","modified":"2026-06-17T01:27:47.027Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:03:49.449157Z"}],"osv":[{"id":"CVE-2017-9264","description":"In lib/conntrack.c in the firewall implementation in Open vSwitch (OvS) 2.6.1, there is a buffer over-read while parsing malformed TCP, UDP, and IPv6 packets in the functions `extract_l3_ipv6`, `extract_l4_tcp`, and `extract_l4_udp` that can be triggered remotely.","status":"published","published":"2017-05-29T04:29:00.4Z","modified":"2026-10-24T10:30:27.925064314Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:06.868403Z"},{"id":"DEBIAN-CVE-2017-9264","description":"In lib/conntrack.c in the firewall implementation in Open vSwitch (OvS) 2.6.1, there is a buffer over-read while parsing malformed TCP, UDP, and IPv6 packets in the functions `extract_l3_ipv6`, `extract_l4_tcp`, and `extract_l4_udp` that can be triggered remotely.","status":"published","published":"2017-05-29T04:29:00.4Z","modified":"2026-09-01T20:03:51.635126Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:29.698576Z"},{"id":"RHSA-2017:2418","title":"Red Hat Security Advisory: openvswitch security, bug fix, and enhancement update","status":"published","published":"2024-09-13T16:49:01Z","modified":"2026-06-29T10:17:12Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"RHSA-2017:2648","title":"Red Hat Security Advisory: openvswitch security and bug fix update","status":"published","published":"2024-09-13T16:49:16Z","modified":"2026-06-29T10:17:36Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"RHSA-2017:2727","title":"Red Hat Security Advisory: openvswitch security update","status":"published","published":"2024-09-13T16:49:06Z","modified":"2026-06-29T10:17:50Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.262457Z"}]}}