CVE-2019-15753 json
OpenStack os-vif Ageing time of 0 disables linuxbridge MAC learning
published 2019-08-28 7 y ago modified 2026-07-02 4 mo ago also GHSA-mcpw-cp35-p3h8 , PYSEC-2026-440 , EUVD-2022-4542
- cvss
- 9.1
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.6%
- EPSS 2.6% chance of exploitation in 30 days, percentile 85%
- public exploits
- 0
- none known
Summary
In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC learning in linuxbridge, forcing obligatory Ethernet flooding of non-local destinations, which both impedes network performance and allows users to possibly view the content of packets for instances belonging to other tenants sharing the same network. Only deployments using the linuxbridge backend are affected. This occurs in PyRoute2.add() in internal/command/ip/linux/impl_pyroute2.py.
Patch / fix
- pypi os-vif 1.15.2, 1.17.0
- openstack os-vif 1.15.2
- python-os-vif Debian 14, Debian 13, Debian 12 1.15.2-1
debian advisories DEBIAN-CVE-2019-15753
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2019-15753 updated cvss 5.2
python-os-vif: Hard-coded MAC aging time of 0 disables MAC learning in linuxbridge
-
Red Hat OpenStack Platform 15 (Stein) python3-os-vifaffected: no fix planned “Will not fix”
-
Red Hat OpenStack Platform 10 (Newton) python-os-vif Red Hat OpenStack Platform 13 (Queens) python-os-vif, python2-os-vif Red Hat OpenStack Platform 14 (Rocky) python2-os-vifnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
2.61% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 9.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
| NVD | 2.0 | 6.4 | AV:N/AC:L/Au:N/C:P/I:N/A:P |
| GitHub | 3.0 | 9.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
| OSV | 3.0 | 9.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | os-vif | >=1.15.0, <1.15.2 >=1.16.0, <1.17.0 |
1.15.2 1.17.0 |
Classification
- Weakness
-
- CWE-770 Allocation of Resources Without Limits or Throttling
References
-
review.opendev.org
/672834
web, patch
-
review.opendev.org
/678098
web, patch
-
security.openstack.org
/ossa/OSSA-2019-004.html
web, patch, vendor-advisory
-
openwall.com
/lists/oss-security/2019/08/29/2
mailing-list, web, patch, third-party-advisory
-
github.com
/openstack/os-vif/commit/655c83d706f5de8a8cf23430782e065219297aef
web
-
github.com
/openstack/os-vif/commit/ec9d5430300c908ea9a1c64151eee7af522a44e7
web
-
launchpad.net
/bugs/1837252
web, issue-tracking, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2019-15753
advisory
-
github.com
/openstack/os-vif
package
-
pypi.org
/project/os-vif
package
-
github.com
/advisories/GHSA-mcpw-cp35-p3h8
advisory
Sources
- CVE List CVE-2019-15753
- GitHub Advisory GHSA-mcpw-cp35-p3h8
- NVD CVE-2019-15753
- OSV PYSEC-2026-440
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.