CVE catalog

CVE-2022-4338

openvswitch: CVE-2022-4338

[CVE catalog]

Severity
Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.39% · Oct 25, 2026

An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianopenvswitchsid4.0.0-2fixed
Debianopenvswitchforky4.0.0-2fixed
Debianopenvswitchtrixie3.5.0-1fixed
Debianopenvswitchbookworm3.1.0-2+deb12u1fixed
Debianopenvswitchbookworm-security3.1.0-2+deb12u1fixed
Ubuntuopenvswitchpro2.4.0-0ubuntu4vulnerable
Ubuntuopenvswitchpro2.4.0-0ubuntu5vulnerable
Ubuntuopenvswitchpro2.5.0~git20160129.46a88d9-0ubuntu1vulnerable
Ubuntuopenvswitchpro2.5.0~git20160219.522aca6-0ubuntu1vulnerable
Ubuntuopenvswitchpro2.5.0~git20160219.522aca6-0ubuntu2vulnerable
Ubuntuopenvswitchpro2.5.0~git20160219.522aca6-0ubuntu3vulnerable
Ubuntuopenvswitchpro2.5.0-0ubuntu1vulnerable
Ubuntuopenvswitchpro2.5.2-0ubuntu0.16.04.1vulnerable
Ubuntuopenvswitchpro2.5.2-0ubuntu0.16.04.2vulnerable
Ubuntuopenvswitchpro2.5.2-0ubuntu0.16.04.3vulnerable
Ubuntuopenvswitchpro2.5.4-0ubuntu0.16.04.1vulnerable
Ubuntuopenvswitchpro2.5.5-0ubuntu0.16.04.1vulnerable
Ubuntuopenvswitchpro2.5.5-0ubuntu0.16.04.2vulnerable
Ubuntuopenvswitchpro2.5.9-0ubuntu0.16.04.2vulnerable
Ubuntuopenvswitchpro2.5.9-0ubuntu0.16.04.3vulnerable
Ubuntuopenvswitchpro2.5.9-0ubuntu0.16.04.3+esm1vulnerable
Ubuntuopenvswitch18.042.8.0-0ubuntu2vulnerable
Ubuntuopenvswitch18.042.8.1-0ubuntu2vulnerable
Ubuntuopenvswitch18.042.8.1-0ubuntu3vulnerable
Ubuntuopenvswitch18.042.9.0~git20180205.5a39582ca-0ubuntu1vulnerable
Ubuntuopenvswitch18.042.9.0-0ubuntu1vulnerable
Ubuntuopenvswitch18.042.9.2-0ubuntu0.18.04.2vulnerable
Ubuntuopenvswitch18.042.9.2-0ubuntu0.18.04.3vulnerable
Ubuntuopenvswitch18.042.9.5-0ubuntu0.18.04.1vulnerable
Ubuntuopenvswitch18.042.9.7-0ubuntu0.18.04.2vulnerable
Ubuntuopenvswitch18.042.9.8-0ubuntu0.18.04.2vulnerable
Ubuntuopenvswitch18.042.9.8-0ubuntu0.18.04.3vulnerable
Ubuntuopenvswitch18.042.9.8-0ubuntu0.18.04.4fixed
Ubuntuopenvswitch20.042.12.0-0ubuntu1vulnerable
Ubuntuopenvswitch20.042.12.0-0ubuntu2vulnerable
Ubuntuopenvswitch20.042.12.1~git20191107.7accd1302-0ubuntu1vulnerable
Ubuntuopenvswitch20.042.12.90~git20200107.af683565b-0ubuntu1vulnerable
Ubuntuopenvswitch20.042.12.90~git20200107.af683565b-0ubuntu2vulnerable
Ubuntuopenvswitch20.042.12.90~git20200107.af683565b-0ubuntu3vulnerable
Ubuntuopenvswitch20.042.13.0~git20200127.dbdf66c29-0ubuntu2vulnerable
Ubuntuopenvswitch20.042.13.0~git20200212.15ae9db33-0ubuntu1vulnerable
Ubuntuopenvswitch20.042.13.0~git20200212.15ae9db33-0ubuntu2vulnerable
Ubuntuopenvswitch20.042.13.0-0ubuntu1vulnerable
Ubuntuopenvswitch20.042.13.1-0ubuntu0.20.04.1vulnerable
Ubuntuopenvswitch20.042.13.1-0ubuntu0.20.04.3vulnerable
Ubuntuopenvswitch20.042.13.1-0ubuntu0.20.04.4vulnerable
Ubuntuopenvswitch20.042.13.3-0ubuntu0.20.04.1vulnerable
Ubuntuopenvswitch20.042.13.3-0ubuntu0.20.04.2vulnerable
Ubuntuopenvswitch20.042.13.5-0ubuntu1vulnerable
Ubuntuopenvswitch20.042.13.8-0ubuntu1vulnerable
Ubuntuopenvswitch20.042.13.8-0ubuntu1.1fixed
Ubuntuopenvswitch22.042.16.0-0ubuntu2vulnerable
Ubuntuopenvswitch22.042.16.0-0ubuntu3vulnerable
Ubuntuopenvswitch22.042.16.0-0ubuntu4vulnerable
Ubuntuopenvswitch22.042.17.0~git20220105.0d1ffb7-0ubuntu1vulnerable
Ubuntuopenvswitch22.042.17.0~git20220118.1b9fd88-0ubuntu1vulnerable
Ubuntuopenvswitch22.042.17.0~git20220121.109d024-0ubuntu1vulnerable
Ubuntuopenvswitch22.042.17.0-0ubuntu1vulnerable
Ubuntuopenvswitch22.042.17.2-0ubuntu0.22.04.1vulnerable
Ubuntuopenvswitch22.042.17.2-0ubuntu0.22.04.2vulnerable
Ubuntuopenvswitch22.042.17.3-0ubuntu0.22.04.1vulnerable
Ubuntuopenvswitch22.042.17.3-0ubuntu0.22.04.2fixed
Opensuseopenvswitchtumbleweed3.1.0-12.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianopenvswitchsourcesid3.1.0~git20221212.739bcf2-4not yet assignedNot reported[1027273]
Debianopenvswitchsourceforky3.1.0~git20221212.739bcf2-4not yet assignedNot reported[1027273]
Debianopenvswitchsourcetrixie3.1.0~git20221212.739bcf2-4not yet assignedNot reported[1027273]
Debianopenvswitchsourcebookworm3.1.0~git20221212.739bcf2-4not yet assignedNot reported[1027273]
Ubuntuopenvswitchdeb18.042.9.8-0ubuntu0.18.04.4Not reportedUBUNTU-CVE-2022-4338Not reported
Ubuntuopenvswitchdeb20.042.13.8-0ubuntu1.1Not reportedUBUNTU-CVE-2022-4338Not reported
Ubuntuopenvswitchdeb22.042.17.3-0ubuntu0.22.04.2Not reportedUBUNTU-CVE-2022-4338Not reported
Opensuseopenvswitchrpmtumbleweed3.1.0-12.1Not reportedOPENSUSE-SU-2024:12860-1Not reported

[Debian bug #1027273]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [libopenvswitch-3_7-0]Unknown

    Source package: [openvswitch]

    Details (1)

    • 3.7.1-36.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.1.0-12.1

      Version impact unknown

      dsa · openvswitch · opensuse · tumbleweed

  • [libovn-26_03-0]Unknown

    Source package: [openvswitch]

    Details (1)

    • 26.03.2-36.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.1.0-12.1

      Version impact unknown

      dsa · openvswitch · opensuse · tumbleweed

  • [openvswitch-devel]Unknown

    Source package: [openvswitch]

    Details (1)

    • 3.7.1-36.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.1.0-12.1

      Version impact unknown

      dsa · openvswitch · opensuse · tumbleweed

  • [openvswitch-doc]Unknown

    Source package: [openvswitch]

    Details (1)

    • 3.7.1-36.1 · noarch · tumbleweed

      Unknown · Fixed: 3.1.0-12.1

      Version impact unknown

      dsa · openvswitch · opensuse · tumbleweed

  • [openvswitch-ipsec]Unknown

    Source package: [openvswitch]

    Details (1)

    • 3.7.1-36.1 · noarch · tumbleweed

      Unknown · Fixed: 3.1.0-12.1

      Version impact unknown

      dsa · openvswitch · opensuse · tumbleweed

  • [openvswitch-pki]Unknown

    Source package: [openvswitch]

    Details (1)

    • 3.7.1-36.1 · noarch · tumbleweed

      Unknown · Fixed: 3.1.0-12.1

      Version impact unknown

      dsa · openvswitch · opensuse · tumbleweed

  • [openvswitch-test]Unknown

    Source package: [openvswitch]

    Details (1)

    • 3.7.1-36.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.1.0-12.1

      Version impact unknown

      dsa · openvswitch · opensuse · tumbleweed

  • [openvswitch-vtep]Unknown

    Source package: [openvswitch]

    Details (1)

    • 3.7.1-36.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.1.0-12.1

      Version impact unknown

      dsa · openvswitch · opensuse · tumbleweed

  • [ovn]Unknown

    Source package: [openvswitch]

    Details (1)

    • 26.03.2-36.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.1.0-12.1

      Version impact unknown

      dsa · openvswitch · opensuse · tumbleweed

  • [ovn-br-controller]Unknown

    Source package: [openvswitch]

    Details (1)

    • 3.7.1-36.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.1.0-12.1

      Version impact unknown

      dsa · openvswitch · opensuse · tumbleweed

  • [ovn-central]Unknown

    Source package: [openvswitch]

    Details (1)

    • 26.03.2-36.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.1.0-12.1

      Version impact unknown

      dsa · openvswitch · opensuse · tumbleweed

  • [ovn-devel]Unknown

    Source package: [openvswitch]

    Details (1)

    • 26.03.2-36.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.1.0-12.1

      Version impact unknown

      dsa · openvswitch · opensuse · tumbleweed

  • [ovn-doc]Unknown

    Source package: [openvswitch]

    Details (1)

    • 26.03.2-36.1 · noarch · tumbleweed

      Unknown · Fixed: 3.1.0-12.1

      Version impact unknown

      dsa · openvswitch · opensuse · tumbleweed

  • [ovn-docker]Unknown

    Source package: [openvswitch]

    Details (1)

    • 26.03.2-36.1 · noarch · tumbleweed

      Unknown · Fixed: 3.1.0-12.1

      Version impact unknown

      dsa · openvswitch · opensuse · tumbleweed

  • [ovn-host]Unknown

    Source package: [openvswitch]

    Details (1)

    • 26.03.2-36.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.1.0-12.1

      Version impact unknown

      dsa · openvswitch · opensuse · tumbleweed

  • [ovn-vtep]Unknown

    Source package: [openvswitch]

    Details (1)

    • 26.03.2-36.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.1.0-12.1

      Version impact unknown

      dsa · openvswitch · opensuse · tumbleweed

  • [python3-openvswitch]Unknown

    Source package: [openvswitch]

    Details (1)

    • 3.7.1-36.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.1.0-12.1

      Version impact unknown

      dsa · openvswitch · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [openvswitch-common]Fixed

    Source package: [openvswitch]

    Details (4)

    • 3.1.0-2+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 3.1.0~git20221212.739bcf2-4

      dsa · openvswitch · debian · bookworm

    • 3.1.0-2+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 3.1.0~git20221212.739bcf2-4

      dsa · openvswitch · debian · bookworm

    • 3.1.0-2+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 3.1.0~git20221212.739bcf2-4

      dsa · openvswitch · debian · bookworm

    • 3.1.0-2+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 3.1.0~git20221212.739bcf2-4

      dsa · openvswitch · debian · bookworm

  • [openvswitch-doc]Fixed

    Source package: [openvswitch]

    Details (4)

    • 3.1.0-2+deb12u1 · all · bookworm

      Fixed · Fixed: 3.1.0~git20221212.739bcf2-4

      dsa · openvswitch · debian · bookworm

    • 3.1.0-2+deb12u1 · all · bookworm

      Fixed · Fixed: 3.1.0~git20221212.739bcf2-4

      dsa · openvswitch · debian · bookworm

    • 3.1.0-2+deb12u1 · all · bookworm-security

      Fixed · Fixed: 3.1.0~git20221212.739bcf2-4

      dsa · openvswitch · debian · bookworm

    • 3.1.0-2+deb12u1 · all · bookworm-security

      Fixed · Fixed: 3.1.0~git20221212.739bcf2-4

      dsa · openvswitch · debian · bookworm

  • [openvswitch-ipsec]Fixed

    Source package: [openvswitch]

    Details (4)

    • 3.1.0-2+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 3.1.0~git20221212.739bcf2-4

      dsa · openvswitch · debian · bookworm

    • 3.1.0-2+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 3.1.0~git20221212.739bcf2-4

      dsa · openvswitch · debian · bookworm

    • 3.1.0-2+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 3.1.0~git20221212.739bcf2-4

      dsa · openvswitch · debian · bookworm

    • 3.1.0-2+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 3.1.0~git20221212.739bcf2-4

      dsa · openvswitch · debian · bookworm

Next results

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]