[Bug 1881077] Re: [SRU] openvswitch 2.9.7

[Launchpad Bug Tracker]

This bug was fixed in the package openvswitch - 2.9.7-0ubuntu0.18.04.2

---------------
openvswitch (2.9.7-0ubuntu0.18.04.2) bionic-security; urgency=medium

  * SECURITY UPDATE: buffer overflow decoding malformed packets in lldp
    - debian/patches/CVE-2015-8011.patch: check lengths in lib/lldp/lldp.c.
    - CVE-2015-8011
  * SECURITY UPDATE: Externally triggered memory leak in lldp
    - debian/patches/CVE-2020-27827.patch: properly free memory in
      lib/lldp/lldp.c.
    - CVE-2020-27827

 -- Marc Deslauriers <marc.deslauriers at ubuntu.com>  Fri, 08 Jan 2021
07:30:25 -0500

** Changed in: openvswitch (Ubuntu Bionic)
       Status: Fix Committed => Fix Released

** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2015-8011

** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-27827

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to openvswitch in Ubuntu.
https://bugs.launchpad.net/bugs/1881077

Title:
  [SRU] openvswitch 2.9.7

Status in Ubuntu Cloud Archive:
  Invalid
Status in Ubuntu Cloud Archive queens series:
  Fix Committed
Status in openvswitch package in Ubuntu:
  Invalid
Status in openvswitch source package in Bionic:
  Fix Released

Bug description:
  [Impact]
  This release sports mostly bug-fixes and we would like to make sure all of our users have access to these improvements.
  The update contains the following package updates:

     * openvswitch 2.9.7

  [Test Case]

  The following SRU process was followed:

  https://wiki.ubuntu.com/OpenStack/StableReleaseUpdates

  In order to avoid regression of existing consumers, the OpenStack team
  will run their continuous integration test against the packages that
  are in -proposed. A successful run of all available tests will be
  required before the proposed packages can be let into -updates.

  The OpenStack team will be in charge of attaching the output summary
  of the executed tests. The OpenStack team members will not mark
  ‘verification-done’ until this has happened.

  [Regression Potential]
  In order to mitigate the regression potential, the results of the
  aforementioned tests are attached to this bug.

To manage notifications about this bug go to:
https://bugs.launchpad.net/cloud-archive/+bug/1881077/+subscriptions