lldp/openvswitch

CVE-2020-27827

HIGH 7.5

At a glance

Source: NVD
EPSS: EPSS 3.23 % · percentile 88 (2026-10-31)
State: PUBLISHED
Published: 2021-03-18 00:00 UTC
Updated: 2025-12-03 18:20 UTC
Assigner: redhat
NVD status: Modified

Search on…

Description

A flaw was found in multiple versions of OpenvSwitch. Specially crafted LLDP packets can cause memory to be lost when allocating data to handle specific optional TLVs, potentially causing a denial of service. The highest threat from this vulnerability is to system availability.

Weaknesses (CWE)

CWE-400 — Uncontrolled Resource Consumption

References

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	CISA-ADP
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · nvd@nist.gov (Primary)
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
CVSS 2.0	HIGH 7.1	AV:N/AC:M/Au:N/C:N/I:N/A:C	NVD · nvd@nist.gov (Primary)

European references

ENISA EUVD · EUVD-2020-20326
GCVE · GCVE-0-2020-27827

CERT-FR advisories

CERTFR-2023-AVI-0051 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
CERTFR-2021-AVI-518 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:lldpd_project:lldpd:*:*:*:*:*:*:*:* < 1.0.8
cpe:2.3:a:openvswitch:openvswitch:*:*:*:*:*:*:*:* ≥ 2.6.0 < 2.6.9
cpe:2.3:a:openvswitch:openvswitch:*:*:*:*:*:*:*:* ≥ 2.7.0 < 2.7.12
cpe:2.3:a:openvswitch:openvswitch:*:*:*:*:*:*:*:* ≥ 2.8.0 < 2.8.10
cpe:2.3:a:openvswitch:openvswitch:*:*:*:*:*:*:*:* ≥ 2.9.0 < 2.9.8
cpe:2.3:a:openvswitch:openvswitch:*:*:*:*:*:*:*:* ≥ 2.10.0 < 2.10.6
cpe:2.3:a:openvswitch:openvswitch:*:*:*:*:*:*:*:* ≥ 2.11.0 < 2.11.5
cpe:2.3:a:openvswitch:openvswitch:*:*:*:*:*:*:*:* ≥ 2.12.0 < 2.12.2
cpe:2.3:a:openvswitch:openvswitch:*:*:*:*:*:*:*:* ≥ 2.13.0 < 2.13.2
cpe:2.3:a:openvswitch:openvswitch:*:*:*:*:*:*:*:* ≥ 2.14.0 < 2.14.1
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*
cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_hmi_unified_comfort_panels_firmware:*:*:*:*:*:*:*:* < 17
cpe:2.3:o:siemens:simatic_net_cp_1243-1_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_net_cp_1243-8_irc_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_net_cp_1542sp-1_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_net_cp_1542sp-1_irc_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_net_cp_1543-1_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_net_cp_1543sp-1_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_net_cp_1545-1_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:tim_1531_irc_firmware:*:*:*:*:*:*:*:* < 2.2
cpe:2.3:o:siemens:sinumerik_one_firmware:*:*:*:*:*:*:*:* < 2.0.1

Affected products

Product	Versions
lldp/openvswitch	affected lldpd 1.0.8, openvswitch 2.14.1, openvswitch 2.13.2, openvswitch 2.12.2, openvswitch 2.11.5, openvswitch 2.10.6, openvswitch 2.9.8, openvswitch 2.8.10, openvswitch 2.7.12, openvswitch 2.6.9

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ lldp/openvswitch