CVE-2019-15753

Name	CVE-2019-15753
Description	In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC learning in linuxbridge, forcing obligatory Ethernet flooding of non-local destinations, which both impedes network performance and allows users to possibly view the content of packets for instances belonging to other tenants sharing the same network. Only deployments using the linuxbridge backend are affected. This occurs in PyRoute2.add() in internal/command/ip/linux/impl_pyroute2.py.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	939288

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python-os-vif (PTS)	buster	1.11.1-1	fixed
	bullseye	2.2.0-2	fixed
	bookworm	3.0.0-2	fixed
	sid, trixie	3.5.0-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Debian Bugs
python-os-vif	source	stretch	(not affected)
python-os-vif	source	buster	(not affected)
python-os-vif	source	(unstable)	1.15.2-1	low	939288

Notes

[buster] - python-os-vif <not-affected> (Vulnerable code introduced in 1.15.0)
[stretch] - python-os-vif <not-affected> (Vulnerable code introduced in 1.15.0)
https://security.openstack.org/ossa/OSSA-2019-004.html
https://launchpad.net/bugs/1837252