Skip to content
Fencer Vulns
medium 5.5

CVE-2021-36980 json

Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after-free in decode_NXAST_RAW_ENCAP (called from ofpact_decode and ofpacts_…

published 2021-07-20 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-23556

cvss
5.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 67%
public exploits
0
none known

Summary

Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after-free in decode_NXAST_RAW_ENCAP (called from ofpact_decode and ofpacts_decode) during the decoding of a RAW_ENCAP action.

Patch / fix

  • openvswitch Debian 14, Debian 13, Debian 12 2.15.0+ds1-10

debian advisories DEBIAN-CVE-2021-36980

  • openvswitch Ubuntu 20.04 LTS 2.13.3-0ubuntu0.20.04.2

ubuntu advisories UBUNTU-CVE-2021-36980

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • jenkins openshift 4.9 2.289.3.1630554997-1.el8
  • openshift openshift 4.9 4.9.0-202110080828.p0.git.894a78b.assembly.stream.el7
  • openshift openshift 4.9 4.9.0-202110080828.p0.git.894a78b.assembly.stream.el8
  • openvswitch2.15 openshift 4.9 2.15.0-28.el8fdp
  • coreos-installer openshift 4.9 0.10.0-2.rhaos4.9.el8
  • openshift-hyperkube openshift 4.9 4.9.0-202110080828.p0.git.894a78b.assembly.stream.el7
  • openshift-hyperkube openshift 4.9 4.9.0-202110080828.p0.git.894a78b.assembly.stream.el8
  • openvswitch2.15-test openshift 4.9 2.15.0-28.el8fdp

red hat advisories RHSA-2021:3758RHSA-2021:3942RHBA-2021:1166RHBA-2021:1163RHBA-2022:8558RHBA-2021:2508

  • openvswitch SLES for SAP 12 SP4, SLES 12 SP4-LTSS, SLES 12 SP4-ESPOS +2 more 2.8.10-4.33.1
  • openvswitch SLE Module for Package Hub 15 SP4, openSUSE Leap 15.4 2.11.5-150100.3.18.2
  • dpdk SLE Module for Package Hub 15 SP4, openSUSE Leap 15.4 18.11.9-150100.4.23.1
  • openvswitch SLE Module for Server Applications 15 SP3, SLE Module for Package Hub 15 SP3, openSUSE Leap 15.3 2.14.2-150300.19.3.1
  • openvswitch SLE Module for Server Applications 15 SP4, SLE Module for Package Hub 15 SP4, openSUSE Leap 15.4 2.14.2-150400.24.3.1
  • openvswitch SLES for SAP 12 SP5, SLES 12 SP5 2.11.5-3.6.1
  • openvswitch openSUSE Leap 15.4, openSUSE Leap 15.3 2.13.2-150200.9.17.1

suse advisories SUSE-SU-2023:2360-1SUSE-SU-2023:1795-1SUSE-SU-2022:3116-1SUSE-SU-2022:3099-1SUSE-SU-2022:3098-1SUSE-SU-2022:3096-1

  • openvswitch openSUSE Tumbleweed 2.17.0-12.1

opensuse advisories openSUSE-SU-2024:11898-1

  • openvswitch Alpine 3.24, Alpine 3.23, Alpine 3.22 +8 more 2.12.3-r2

alpine advisories ALPINE-CVE-2021-36980

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • openvswitch CBL-Mariner 2.0 2.17.0-1

azure linux advisories AZL-6781

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

  • openvswitch Arch Linux 2.15.1-1

arch linux advisories AVG-2177

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-36980 updated cvss 7.5

openvswitch: use-after-free in decode_NXAST_RAW_ENCAP during the decoding of a RAW_ENCAP action

  • Red Hat Fast Datapath for RHEL 7 openvswitch, openvswitch2.12, openvswitch2.15, openvswitch-test, python-openvswitch, openvswitch-ovn-host, +6 more Red Hat Fast Datapath for RHEL 8 openvswitch2.12, openvswitch2.12-test, python3-openvswitch2.12, network-scripts-openvswitch2.12
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openvswitch2.13, openvswitch2.13-test, python3-openvswitch2.13, network-scripts-openvswitch2.13
    affected: no fix planned “Will not fix”
  • Red Hat OpenStack Platform 10 (Newton) openvswitch, opendaylight, openvswitch2.11, openvswitch-test, python-openvswitch, openvswitch-ovn-host, +4 more Red Hat OpenStack Platform 13 (Queens) opendaylight, rhosp-openvswitch, rhosp-openvswitch-test, python-rhosp-openvswitch, rhosp-openvswitch-ovn-host, rhosp-openvswitch-ovn-vtep, +2 more
    affected: no fix planned “Out of support scope”
  • Red Hat Fast Datapath for Red Hat Enterprise Linux 7 openvswitch2.11 2.11.3-89.el7fdp, openvswitch2.13 2.13.0-102.el7fdp, openvswitch2.11-test 2.11.3-89.el7fdp, openvswitch2.13-test 2.13.0-102.el7fdp, openvswitch2.13-ipsec 2.13.0-102.el7fdp, python-openvswitch2.11 2.11.3-89.el7fdp, +1 more
    fixed: vendor fix RHBA-2021:1166
  • Red Hat Fast Datapath for Red Hat Enterprise Linux 8 openvswitch2.11 2.11.3-86.el8fdp, openvswitch2.15 2.15.0-24.el8fdp, openvswitch2.13 2.13.0-114.el8fdp, openvswitch2.11-test 2.11.3-86.el8fdp, openvswitch2.15-test 2.15.0-24.el8fdp, openvswitch2.13-test 2.13.0-114.el8fdp, +8 more
    fixed: vendor fix RHBA-2021:1163
  • Red Hat OpenShift Container Platform 4.9 openvswitch2.15 2.15.0-28.el8fdp, openvswitch2.15-test 2.15.0-28.el8fdp, openvswitch2.15-ipsec 2.15.0-28.el8fdp, python3-openvswitch2.15 2.15.0-28.el8fdp, network-scripts-openvswitch2.15 2.15.0-28.el8fdp
    fixed: vendor fix RHSA-2021:3758
  • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts openvswitch2.11 2.11.3-89.el7fdp, python-openvswitch2.11 2.11.3-89.el7fdp
    fixed: vendor fix RHSA-2021:3942
  • Red Hat Fast Datapath for RHEL 7 openvswitch2.10, openvswitch2.10-test, python-openvswitch2.10, openvswitch2.10-ovn-host, openvswitch2.10-ovn-vtep, openvswitch2.10-ovn-common, +1 more Red Hat Enterprise Linux 8 lldpd Red Hat Enterprise Linux 9 lldpd Red Hat OpenShift Container Platform 4.9 haproxy 2.2.15-1.el8, cri-tools 1.22.0-1.el8, cri-tools 1.22.0-2.el7, python-cmd2 1.4.0-1.1.el8, ovn21.09 21.09.0-20.el8fdp, pycdlib-tools 1.11.0-3.el8, +99 more Red Hat OpenStack Platform 16.1 rhosp-ovn, rhosp-ovn-host, rhosp-ovn-vtep, rhosp-openvswitch, rhosp-ovn-central, python3-rhosp-openvswitch Red Hat OpenStack Platform 16.2 rhosp-ovn, rhosp-ovn-host, rhosp-ovn-vtep, rhosp-openvswitch, rhosp-ovn-central, python3-rhosp-openvswitch, +1 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
18 mo ago

Exploit prediction

1.18% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CNA 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.