Information Disclosure

os-vif is vulnerable to information disclosure. Users are able to view content of packets for instances belonging to other tenants sharing the same network. This is due to a hard-coded MAC aging time of 0 which disables MAC learning in linuxbridge and forces obligatory Ethernet flooding of...

CVE-2019-15753

In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC learning in linuxbridge, forcing obligatory Ethernet flooding of non-local destinations, which both impedes network performance and allows users to possibly view the content of packets for instance...