Skip to content
Fencer Vulns
high 8.1

CVE-2025-0650 json

Ovn: egress acls may be bypassed via specially crafted udp packet

published 2025-01-23 21 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-1804

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 58%
public exploits
0
none known

Summary

A flaw was found in the Open Virtual Network (OVN). Specially crafted UDP packets may bypass egress access control lists (ACLs) in OVN installations configured with a logical switch with DNS records set on it and if the same switch has any egress ACLs configured. This issue can lead to unauthorized access to virtual machines and containers running on the OVN network.

Patch / fix

  • Red Hat Fast Datapath for Red Hat Enterprise Linux 8 0:22.03.7-11.el8fdp, 0:22.06.0-273.el8fdp, 0:22.09.2-86.el8fdp, 0:22.12.1-107.el8fdp, 0:23.03.3-22.el8fdp, 0:23.06.4-26.el8fdp
  • Red Hat Fast Datapath for Red Hat Enterprise Linux 9 0:22.03.7-11.el9fdp, 0:22.06.0-273.el9fdp, 0:22.09.2-86.el9fdp, 0:22.12.1-107.el9fdp, 0:23.03.3-22.el9fdp, 0:23.06.4-26.el9fdp, 0:23.09.6-12.el9fdp, 0:24.03.4-53.el9fdp, 0:24.09.1-66.el9fdp
  • ovn Debian 13 25.03.0~git20250216.7c69af7-1

debian advisories DEBIAN-CVE-2025-0650

  • ovn Ubuntu 20.04 LTS 20.03.2-0ubuntu0.20.04.6
  • ovn Ubuntu 22.04 LTS 22.03.3-0ubuntu0.22.04.5
  • ovn Ubuntu 24.04 LTS 24.03.2-0ubuntu0.24.04.2

ubuntu advisories UBUNTU-CVE-2025-0650

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • ovn24.03 RHEL 9 24.03.4-53.el9fdp
  • ovn24.03-host RHEL 9 24.03.4-53.el9fdp
  • ovn24.03-vtep RHEL 9 24.03.4-53.el9fdp
  • ovn24.03-central RHEL 9 24.03.4-53.el9fdp
  • ovn24.09 RHEL 9 24.09.1-66.el9fdp
  • ovn24.09-host RHEL 9 24.09.1-66.el9fdp
  • ovn24.09-vtep RHEL 9 24.09.1-66.el9fdp
  • ovn24.09-central RHEL 9 24.09.1-66.el9fdp

red hat advisories RHSA-2025:1096RHSA-2025:1097RHSA-2025:1094RHSA-2025:1095RHSA-2025:1093RHSA-2025:1091

  • openvswitch Linux Micro 6.1 3.1.7-slfo.1.1_4.1
  • openvswitch3 SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +3 more 3.1.7-150500.3.25.1
  • openvswitch SLES for SAP 15 SP6, SLES 15 SP6-LTSS, openSUSE Leap 15.6 3.1.7-150600.33.9.1
  • openvswitch Linux Micro 6.0 3.1.7-4.1
  • openvswitch Linux Micro 6.1 3.1.7-slfo.1.1_2.1
  • openvswitch3 SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +3 more 3.1.0-150500.3.22.1
  • openvswitch SLE Module for Server Applications 15 SP6, SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 3.1.0-150600.33.6.1
  • openvswitch SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 2.14.2-150400.24.26.1

suse advisories SUSE-SU-2026:23188-1SUSE-SU-2026:0290-1SUSE-SU-2026:0280-1SUSE-SU-2026:20049-1SUSE-SU-2026:20061-1SUSE-SU-2025:0742-1

  • openvswitch openSUSE Tumbleweed 3.3.2-25.1

opensuse advisories openSUSE-SU-2025:14757-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-0650 updated cvss 8.1

ovn: egress ACLs may be bypassed via specially crafted UDP packet

  • Red Hat OpenShift Container Platform 4 ovn22.06, ovn22.09, ovn22.12, ovn23.03, ovn23.06, ovn22.06-host, +14 more
    affected: workaround, no fix planned “Red Hat Product Security has not identified any mitigations at this time. We recommend updating to a known patched version of OVN.”
  • Red Hat Fast Datapath for Red Hat Enterprise Linux 8 ovn22.03 22.03.7-11.el8fdp, ovn22.09 22.09.2-86.el8fdp, ovn23.03 23.03.3-22.el8fdp, ovn23.06 23.06.4-26.el8fdp, ovn22.06 22.06.0-273.el8fdp, ovn22.12 22.12.1-107.el8fdp, +18 more
    fixed: vendor fix “Red Hat Product Security has not identified any mitigations at this time. We recommend updating to a known patched version of OVN.” RHSA-2025:1083
  • Red Hat Fast Datapath for Red Hat Enterprise Linux 9 ovn22.03 22.03.7-11.el9fdp, ovn22.09 22.09.2-86.el9fdp, ovn23.03 23.03.3-22.el9fdp, ovn23.06 23.06.4-26.el9fdp, ovn23.09 23.09.6-12.el9fdp, ovn24.03 24.03.4-53.el9fdp, +30 more
    fixed: vendor fix “Red Hat Product Security has not identified any mitigations at this time. We recommend updating to a known patched version of OVN.” RHSA-2025:1089
  • Red Hat OpenShift Container Platform 4 ovn23.09, ovn24.03, ovn24.09, ovn23.09-host, ovn23.09-vtep, ovn24.03-host, +6 more
    not affected: vulnerable code not present “Red Hat Product Security has not identified any mitigations at this time. We recommend updating to a known patched version of OVN.”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
21 mo ago

Exploit prediction

0.86% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Red Hat Fast Datapath for Red Hat Enterprise Linux 8
  • Red Hat Fast Datapath for Red Hat Enterprise Linux 9
  • Red Hat Red Hat OpenShift Container Platform 4

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.