CVE-2020-27827

Published: Mar 18, 2021Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

A flaw was found in multiple versions of OpenvSwitch. Specially crafted LLDP packets can cause memory to be lost when allocating data to handle specific optional TLVs, potentially causing a denial of service. The highest threat from this vulnerability is to system availability.

Affected (27)

Products: Lldpd Project: Lldpd · Openvswitch: Openvswitch · Redhat: Enterprise Linux, Openshift Container Platform, Openstack, Virtualization · +2 more

Show all products

1 product

1 product

4 products

Openshift Container Platform

1 product

10 products

Simatic Hmi Unified Comfort Panels Firmware

Simatic Net Cp 1243 1 Firmware

Simatic Net Cp 1243 8 Irc Firmware

Simatic Net Cp 1542sp 1 Firmware

Simatic Net Cp 1542sp 1 Irc Firmware

Simatic Net Cp 1543 1 Firmware

Simatic Net Cp 1543sp 1 Firmware

Simatic Net Cp 1545 1 Firmware

Tim 1531 Irc Firmware

Sinumerik One Firmware

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Lldpd Project Lldpd	version < 1.0.8
Openvswitch Openvswitch	2.10.0 ≤ version < 2.10.6
Openvswitch Openvswitch	2.11.0 ≤ version < 2.11.5
Openvswitch Openvswitch	2.12.0 ≤ version < 2.12.2
Openvswitch Openvswitch	2.13.0 ≤ version < 2.13.2
Openvswitch Openvswitch	2.14.0 ≤ version < 2.14.1
Openvswitch Openvswitch	2.6.0 ≤ version < 2.6.9
Openvswitch Openvswitch	2.7.0 ≤ version < 2.7.12
Openvswitch Openvswitch	2.8.0 ≤ version < 2.8.10
Openvswitch Openvswitch	2.9.0 ≤ version < 2.9.8

Configuration B

6 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 7.0
Redhat Enterprise Linux	Version 8.0
Redhat Openshift Container Platform	Version 4.0
Redhat Openstack	Version 10
Redhat Openstack	Version 13
Redhat Virtualization	Version 4.0

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 33

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic Hmi Unified Comfort Panels Firmware	version < 17

Running on/with	Platform Versions
Siemens Simatic Hmi Unified Comfort Panels	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic Net Cp 1243 1 Firmware	All versions

Running on/with	Platform Versions
Siemens Simatic Net Cp 1243 1	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic Net Cp 1243 8 Irc Firmware	All versions

Running on/with	Platform Versions
Siemens Simatic Net Cp 1243 8 Irc	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic Net Cp 1542sp 1 Firmware	All versions

Running on/with	Platform Versions
Siemens Simatic Net Cp 1542sp 1	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic Net Cp 1542sp 1 Irc Firmware	All versions

Running on/with	Platform Versions
Siemens Simatic Net Cp 1542sp 1 Irc	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic Net Cp 1543 1 Firmware	All versions

Running on/with	Platform Versions
Siemens Simatic Net Cp 1543 1	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic Net Cp 1543sp 1 Firmware	All versions

Running on/with	Platform Versions
Siemens Simatic Net Cp 1543sp 1	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic Net Cp 1545 1 Firmware	All versions

Running on/with	Platform Versions
Siemens Simatic Net Cp 1545 1	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Tim 1531 Irc Firmware	version < 2.2

Running on/with	Platform Versions
Siemens Tim 1531 Irc	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Sinumerik One Firmware	version < 2.0.1

Running on/with	Platform Versions
Siemens Sinumerik One	All versions

Related CWEs

CWE-400

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (16)

https://bugzilla.redhat.com/show_bug.cgi?id=1921438

Source: secalert@redhat.com

Issue TrackingMitigationPatchThird Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-941426.pdf

Source: secalert@redhat.com

PatchThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3T5XHPOGIPWCRRPJUE6P3HVC5PTSD5JS/

Source: secalert@redhat.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JYA4AMJXCNF6UPFG36L2TPPT32C242SP/

Source: secalert@redhat.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SKQWHG2SZJZSGC7PXVDAEJYBN7ESDR7D/

Source: secalert@redhat.com

https://mail.openvswitch.org/pipermail/ovs-dev/2021-January/379471.html

Source: secalert@redhat.com

Mailing ListMitigationVendor Advisory

https://security.gentoo.org/glsa/202311-16

Source: secalert@redhat.com

https://us-cert.cisa.gov/ics/advisories/icsa-21-194-07

Source: secalert@redhat.com

Third Party AdvisoryUS Government Resource

https://bugzilla.redhat.com/show_bug.cgi?id=1921438