{"cve":"CVE-2018-17205","nvd":{"published":"2018-09-19T16:29:01.003","modified":"2026-06-17T01:45:32.547","status":"Modified","description":"An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting ofproto_rule_insert__ in ofproto/ofproto.c. During bundle commit, flows that are added in a bundle are applied to ofproto in order. If a flow cannot be added (e.g., the flow action is a go-to for a group id that does not exist), OvS tries to revert back all previous flows that were successfully applied from the same bundle. This is possible since OvS maintains list of old flows that were replaced by flows from the bundle. While reinserting old flows, OvS has an assertion failure due to a check on rule state != RULE_INITIALIZED. This would work for new flows, but for an old flow the rule state is RULE_REMOVED. The assertion failure causes an OvS crash.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-617"],"references":["https://access.redhat.com/errata/RHSA-2018:3500","https://access.redhat.com/errata/RHSA-2019:0053","https://access.redhat.com/errata/RHSA-2019:0081","https://github.com/openvswitch/ovs/commit/0befd1f3745055c32940f5faf9559be6a14395e6","https://usn.ubuntu.com/3873-1/"],"products":["canonical:ubuntu_linux","openvswitch:openvswitch","redhat:openstack"],"source":"nvd","synced_at":"2026-10-19T20:53:14.491561039+00:00"},"epss":{"cve":"CVE-2018-17205","score":0.02531,"percentile":0.84916,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}