{
  "cveId": "CVE-2025-0650",
  "url": "https://patchblox.com/security/cve/CVE-2025-0650",
  "summary": "CVE-2025-0650 is fixed in 10 products on 1 platform, first by ovn-central 20.03.2-0ubuntu0.20.04.6, released January 23, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "ovn-central: A flaw was found in the Open Virtual Network (OVN)",
  "description": "A flaw was found in the Open Virtual Network (OVN). Specially crafted UDPpackets may bypass egress access control lists (ACLs) in OVN installationsconfigured with a logical switch with DNS records set on it and if the sameswitch has any egress ACLs configured. This issue can lead to unauthorizedaccess to virtual machines and containers running on the OVN network.OVN provides rudimentary DNS caching as an optional feature to speed uplookups of frequently-used domains. When this feature is enabled, due tothe OpenFlow rules that OVN installs in Open vSwitch, it is possible foran attacker to craft a UDP packet that can bypass egress ACL rules.Egress ACL rules are those that have the \u0022direction\u0022 set to \u0022to-lport\u0022.The OVN installation is vulnerable if a logical switch has DNS recordsset on it AND if the same switch has any egress ACLs configured on it.The switch is considered to have egress ACLs configured if the switchhas an egress ACL configured directly on it using the \u0022acls\u0022 column ofthe logical switch. A switch is also considered to have egress ACLsconfigured if any of its logical switch ports are part of a port groupthat has egress ACLs configured in its \u0022acls\u0022 column.A python script (vuln_test.py) is attached to this advisory and can beused to determine if your installation is vulnerable. Run it in alocation where \u0022ovn-nbctl\u0022 is installed and can access the northbounddatabase. The script will print to the console whether the installationis vulnerable.",
  "published": "2025-01-23T09:15:00Z",
  "severity": "Medium",
  "cvss": 8.1,
  "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00865,
  "epssPercentile": 0.58868,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "openvswitch",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "3.1.7-150600.33.9.1",
      "fix": "SUSE-SU-2026:0280-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0280-1",
      "released": "2026-01-23T15:33:56Z"
    },
    {
      "platform": "linux",
      "product": "openvswitch",
      "release": "sles 15.6",
      "fixedVersion": "3.1.7-150600.33.9.1",
      "fix": "SUSE-SU-2026:0280-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0280-1",
      "released": "2026-01-23T15:33:56Z"
    },
    {
      "platform": "linux",
      "product": "openvswitch3",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "3.1.7-150500.3.25.1",
      "fix": "SUSE-SU-2026:0290-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0290-1",
      "released": "2026-01-26T10:34:13Z"
    },
    {
      "platform": "linux",
      "product": "ovn",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "25.03.0~git20250216.7c69af7-1",
      "fix": "DEBIAN-CVE-2025-0650",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-0650",
      "released": "2025-01-23T17:15:22Z"
    },
    {
      "platform": "linux",
      "product": "ovn-central",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "20.03.2-0ubuntu0.20.04.6",
      "fix": "ovn-central 20.03.2-0ubuntu0.20.04.6",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-ovn-central-20.03.2-0ubuntu0.20.04.6",
      "released": "2025-01-23T09:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ovn-central",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "22.03.3-0ubuntu0.22.04.5",
      "fix": "ovn-central 22.03.3-0ubuntu0.22.04.5",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-ovn-central-22.03.3-0ubuntu0.22.04.5",
      "released": "2025-01-23T09:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ovn-central",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "24.03.2-0ubuntu0.24.04.2",
      "fix": "ovn-central 24.03.2-0ubuntu0.24.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-ovn-central-24.03.2-0ubuntu0.24.04.2",
      "released": "2025-01-23T09:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ovn-central",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "24.09.0-1ubuntu0.1",
      "fix": "ovn-central 24.09.0-1ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-ovn-central-24.09.0-1ubuntu0.1",
      "released": "2026-01-16T01:42:23Z"
    },
    {
      "platform": "linux",
      "product": "ovn-common",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "20.03.2-0ubuntu0.20.04.6",
      "fix": "ovn-common 20.03.2-0ubuntu0.20.04.6",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-ovn-common-20.03.2-0ubuntu0.20.04.6",
      "released": "2025-01-23T09:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ovn-common",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "22.03.3-0ubuntu0.22.04.5",
      "fix": "ovn-common 22.03.3-0ubuntu0.22.04.5",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-ovn-common-22.03.3-0ubuntu0.22.04.5",
      "released": "2025-01-23T09:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ovn-common",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "24.03.2-0ubuntu0.24.04.2",
      "fix": "ovn-common 24.03.2-0ubuntu0.24.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-ovn-common-24.03.2-0ubuntu0.24.04.2",
      "released": "2025-01-23T09:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ovn-common",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "24.09.0-1ubuntu0.1",
      "fix": "ovn-common 24.09.0-1ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-ovn-common-24.09.0-1ubuntu0.1",
      "released": "2026-01-16T01:42:23Z"
    },
    {
      "platform": "linux",
      "product": "ovn-controller-vtep",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "20.03.2-0ubuntu0.20.04.6",
      "fix": "ovn-controller-vtep 20.03.2-0ubuntu0.20.04.6",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-ovn-controller-vtep-20.03.2-0ubuntu0.20.04.6",
      "released": "2025-01-23T09:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ovn-controller-vtep",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "22.03.3-0ubuntu0.22.04.5",
      "fix": "ovn-controller-vtep 22.03.3-0ubuntu0.22.04.5",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-ovn-controller-vtep-22.03.3-0ubuntu0.22.04.5",
      "released": "2025-01-23T09:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ovn-controller-vtep",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "24.03.2-0ubuntu0.24.04.2",
      "fix": "ovn-controller-vtep 24.03.2-0ubuntu0.24.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-ovn-controller-vtep-24.03.2-0ubuntu0.24.04.2",
      "released": "2025-01-23T09:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ovn-controller-vtep",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "24.09.0-1ubuntu0.1",
      "fix": "ovn-controller-vtep 24.09.0-1ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-ovn-controller-vtep-24.09.0-1ubuntu0.1",
      "released": "2026-01-16T01:42:23Z"
    },
    {
      "platform": "linux",
      "product": "ovn-docker",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "20.03.2-0ubuntu0.20.04.6",
      "fix": "ovn-docker 20.03.2-0ubuntu0.20.04.6",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-ovn-docker-20.03.2-0ubuntu0.20.04.6",
      "released": "2025-01-23T09:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ovn-docker",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "22.03.3-0ubuntu0.22.04.5",
      "fix": "ovn-docker 22.03.3-0ubuntu0.22.04.5",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-ovn-docker-22.03.3-0ubuntu0.22.04.5",
      "released": "2025-01-23T09:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ovn-docker",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "24.03.2-0ubuntu0.24.04.2",
      "fix": "ovn-docker 24.03.2-0ubuntu0.24.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-ovn-docker-24.03.2-0ubuntu0.24.04.2",
      "released": "2025-01-23T09:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ovn-host",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "20.03.2-0ubuntu0.20.04.6",
      "fix": "ovn-host 20.03.2-0ubuntu0.20.04.6",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-ovn-host-20.03.2-0ubuntu0.20.04.6",
      "released": "2025-01-23T09:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ovn-host",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "22.03.3-0ubuntu0.22.04.5",
      "fix": "ovn-host 22.03.3-0ubuntu0.22.04.5",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-ovn-host-22.03.3-0ubuntu0.22.04.5",
      "released": "2025-01-23T09:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ovn-host",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "24.03.2-0ubuntu0.24.04.2",
      "fix": "ovn-host 24.03.2-0ubuntu0.24.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-ovn-host-24.03.2-0ubuntu0.24.04.2",
      "released": "2025-01-23T09:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ovn-host",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "24.09.0-1ubuntu0.1",
      "fix": "ovn-host 24.09.0-1ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-ovn-host-24.09.0-1ubuntu0.1",
      "released": "2026-01-16T01:42:23Z"
    },
    {
      "platform": "linux",
      "product": "ovn-ic",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "20.03.2-0ubuntu0.20.04.6",
      "fix": "ovn-ic 20.03.2-0ubuntu0.20.04.6",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-ovn-ic-20.03.2-0ubuntu0.20.04.6",
      "released": "2025-01-23T09:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ovn-ic",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "22.03.3-0ubuntu0.22.04.5",
      "fix": "ovn-ic 22.03.3-0ubuntu0.22.04.5",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-ovn-ic-22.03.3-0ubuntu0.22.04.5",
      "released": "2025-01-23T09:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ovn-ic",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "24.03.2-0ubuntu0.24.04.2",
      "fix": "ovn-ic 24.03.2-0ubuntu0.24.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-ovn-ic-24.03.2-0ubuntu0.24.04.2",
      "released": "2025-01-23T09:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ovn-ic",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "24.09.0-1ubuntu0.1",
      "fix": "ovn-ic 24.09.0-1ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-ovn-ic-24.09.0-1ubuntu0.1",
      "released": "2026-01-16T01:42:23Z"
    },
    {
      "platform": "linux",
      "product": "ovn-ic-db",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "20.03.2-0ubuntu0.20.04.6",
      "fix": "ovn-ic-db 20.03.2-0ubuntu0.20.04.6",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-ovn-ic-db-20.03.2-0ubuntu0.20.04.6",
      "released": "2025-01-23T09:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ovn-ic-db",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "22.03.3-0ubuntu0.22.04.5",
      "fix": "ovn-ic-db 22.03.3-0ubuntu0.22.04.5",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-ovn-ic-db-22.03.3-0ubuntu0.22.04.5",
      "released": "2025-01-23T09:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ovn-ic-db",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "24.03.2-0ubuntu0.24.04.2",
      "fix": "ovn-ic-db 24.03.2-0ubuntu0.24.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-ovn-ic-db-24.03.2-0ubuntu0.24.04.2",
      "released": "2025-01-23T09:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ovn-ic-db",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "24.09.0-1ubuntu0.1",
      "fix": "ovn-ic-db 24.09.0-1ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-ovn-ic-db-24.09.0-1ubuntu0.1",
      "released": "2026-01-16T01:42:23Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}