Homepage
About Snyk

os-vif@1.15.1 vulnerabilities

A library for plugging and unplugging virtual interfaces in OpenStack.

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the os-vif package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • C
Allocation of Resources Without Limits or Throttling

os-vif is an A library for plugging and unplugging virtual interfaces in OpenStack.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to a hard-coded MAC aging time of 0, which disables MAC learning in Linuxbridge, forcing obligatory Ethernet flooding of non-local destinations. This not only impedes network performance but also allows users to potentially view the content of packets for instances belonging to other tenants sharing the same network. This issue occurs in PyRoute2.add() in internal/command/ip/linux/impl_pyroute2.py.

Note

Only deployments using the linuxbridge backend are affected.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade os-vif to version 1.15.2, 1.17.0 or higher.

[1.15.0,1.15.2) [1.16.0,1.17.0)
Go back to all versions of this package