Folks,
A vulnerability in the VPP IPSec plugin was identified by Benoit Ganne
who has also provided a fix that has been committed to master and
cherry-picked to all affected VPP Release branches.
Here is the Security Advisory report for CVE-2022-46397 [0]:
Description:
FP.io VPP (Vector Packet Processor) 22.10, 22.06, 22.02, 21.10, 21.06,
21.01, 20.09, 20.05, 20.01, 19.08, and 19.04 Generates a Predictable IV
with CBC Mode.
Vulnerability Type Other:
CWE-329: Generation of Predictable IV with CBC Mode
Severity:
Moderate
Vendor of Product:
https://fd.io
Affected Product Code Base:
vpp - v22.10, v22.06, v22.02, v21.10, v21.06, v21.01, v20.09, v20.05,
v20.01, v19.08, v19.04
Credit:
This issue was reported by Benoit Ganne of Cisco Systems, Inc per the
FD.io Security Policy [1].
Resolution:
The fix for the vulnerability was committed to the VPP repository's main
development branch and cherry-picked to all affected release branches on
2023-02-07. See FD.io VPP Jira ticket VPP-2037 [2] for details.
Maintenance releases were performed on 2023-02-10 for the currently
supported releases (VPP 22.06, VPP 22.10) and release artifacts for VPP
22.06.1 and VPP 22.10.1 uploaded to the FD.io packagecloud.io release
repository [3]. All release branches prior to 2206 are UNSUPPORTED and
will NOT undergo maintenance releases. Packages for each VPP release
version prior to VPP-22.06.1 SHOULD NOT BE INSTALLED from
https://packagecloud.io/fdio/release, but should be built from the
latest source code in the release branch.
Reference:
[0] https://www.cve.org/CVERecord?id=CVE-2022-46397
[1] https://wiki.fd.io/view/TSC:Vulnerability_Management
[2] https://jira.fd.io/browse/VPP-2037
[3] https://packagecloud.io/fdio/release
Thanks,
FD.io Security Response Team
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#22587): https://lists.fd.io/g/vpp-dev/message/22587
Mute This Topic: https://lists.fd.io/mt/96953693/21656
Group Owner: vpp-dev+ow...@lists.fd.io
Unsubscribe: https://lists.fd.io/g/vpp-dev/leave/1480452/21656/631435203/xyzzy
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
