vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2020-27827

HIGH
7.5
CVSS Score
Published: March 18, 2021 at 12:00 AM UTC
Updated: June 17, 2026 at 03:09 AM UTC
26 products affected across 5 vendorsFedoraEnterprise LinuxOpenShift Container Platform

Using lldp/openvswitch by N/A?

Get instant alerts when new vulnerabilities affect lldp/openvswitch - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.5
Exploit prediction
EPSS 3%
SSVC
No known exploit

Description

A flaw was found in multiple versions of OpenvSwitch. Specially crafted LLDP packets can cause memory to be lost when allocating data to handle specific optional TLVs, potentially causing a denial of service. The highest threat from this vulnerability is to system availability.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Fedora· Fedora Projectrpm
95%
33
Lldpd· Lldpd Project
95%
v < 1.0.8
Affected range stops below 1.0.8, so it looks safe — our inference, not a vendor statement
Openvswitch· Openvswitch
95%
2.10.0 ≤ v < 2.10.62.11.0 ≤ v < 2.11.52.12.0 ≤ v < 2.12.22.13.0 ≤ v < 2.13.22.14.0 ≤ v < 2.14.12.6.0 ≤ v < 2.6.92.7.0 ≤ v < 2.7.122.8.0 ≤ v < 2.8.102.9.0 ≤ v < 2.9.8lldpd 1.0.8, openvswitch 2.14.1, openvswitch 2.13.2, openvswitch 2.12.2, openvswitch 2.11.5, openvswitch 2.10.6, openvswitch 2.9.8, openvswitch 2.8.10, openvswitch 2.7.12, openvswitch 2.6.9
Affected range stops below 2.10.6, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.11.5, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.12.2, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.13.2, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.14.1, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.6.9, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.7.12, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.8.10, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.9.8, so it looks safe — our inference, not a vendor statement
Enterprise Linux· Red Hatrpm
95%
7.08.0
OpenShift Container Platform· Red Hatcontainer
95%
4.0
OpenStack· Red Hatdrupal
95%
1013
Virtualization· Red Hatrpm
95%
4.0
SIMATIC HMI Unified Comfort Panels Firmware· Siemens
95%
v < 17
Affected range stops below 17, so it looks safe — our inference, not a vendor statement
siemens-simatic-hmi-unified-comfort-panels (same device)
SIMATIC .NET Cp 1243-1 Firmware· Siemens
95%
All versions
siemens-simatic-net-cp-1243-1 (same device)
SIMATIC .NET Cp 1243-8 Irc Firmware· Siemens
95%
All versions
siemens-simatic-net-cp-1243-8-irc (same device)

References (8)

Issue TrackingMitigationPatchThird Party Advisory
Source: [email protected]
https://bugzilla.redhat.com/show_bug.cgi?id=1921438
PatchThird Party Advisory
Source: [email protected]
https://cert-portal.siemens.com/productcert/pdf/ssa-941426.pdf
Vendor Advisory
Source: [email protected]
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3T5XHPOGIPWCRRPJUE6P3HVC5PTSD5JS/
Vendor Advisory
Source: [email protected]
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JYA4AMJXCNF6UPFG36L2TPPT32C242SP/
Vendor Advisory
Source: [email protected]
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SKQWHG2SZJZSGC7PXVDAEJYBN7ESDR7D/
Mailing ListMitigationVendor Advisory
Source: [email protected]
https://mail.openvswitch.org/pipermail/ovs-dev/2021-January/379471.html
Vendor Advisory
Source: [email protected]
https://security.gentoo.org/glsa/202311-16
Third Party AdvisoryUS Government Resource
Source: [email protected]
https://us-cert.cisa.gov/ics/advisories/icsa-21-194-07

SSVC — Action Prioritization

SSVCNo known exploitAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.5HIGHCISA-ADP
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-400

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card