{"cve":"CVE-2019-15753","nvd":{"published":"2019-08-28T21:15:10.943","modified":"2026-06-17T02:21:01.080","status":"Modified","description":"In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC learning in linuxbridge, forcing obligatory Ethernet flooding of non-local destinations, which both impedes network performance and allows users to possibly view the content of packets for instances belonging to other tenants sharing the same network. Only deployments using the linuxbridge backend are affected. This occurs in PyRoute2.add() in internal/command/ip/linux/impl_pyroute2.py.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","score":9.1},"cwes":["CWE-770"],"references":["http://www.openwall.com/lists/oss-security/2019/08/29/2","https://launchpad.net/bugs/1837252","https://review.opendev.org/672834","https://review.opendev.org/678098","https://security.openstack.org/ossa/OSSA-2019-004.html"],"products":["openstack:os-vif"],"source":"nvd","synced_at":"2026-10-19T20:58:39.700375520+00:00"},"epss":{"cve":"CVE-2019-15753","score":0.02612,"percentile":0.85421,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-mcpw-cp35-p3h8","url":"https://osv.dev/vulnerability/GHSA-mcpw-cp35-p3h8","summary":"OpenStack os-vif Ageing time of 0 disables linuxbridge MAC learning","modified":"2026-06-29T12:26:33.685166928Z","packages":[{"ecosystem":"PyPI","name":"os-vif","purl":"pkg:pypi/os-vif","ranges":[">=1.15.0 <1.15.2"],"fixed":["1.15.2"]},{"ecosystem":"PyPI","name":"os-vif","purl":"pkg:pypi/os-vif","ranges":[">=1.16.0 <1.17.0"],"fixed":["1.17.0"]}]},{"id":"PYSEC-2026-440","url":"https://osv.dev/vulnerability/PYSEC-2026-440","summary":"OpenStack os-vif Ageing time of 0 disables linuxbridge MAC learning","modified":"2026-07-02T13:00:05.007485089Z","packages":[{"ecosystem":"PyPI","name":"os-vif","purl":"pkg:pypi/os-vif","ranges":[">=1.15.0 <1.15.2",">=1.16.0 <1.17.0"],"fixed":["1.15.2","1.17.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}