GHSA-cpx3-696p-3cw9

OpenStack Neutron Denial of Service vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2021-40797

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	neutron	< 16.4.1	16.4.1
PyPI	neutron	>= 17.0.0, < 17.2.1	17.2.1
PyPI	neutron	>= 18.0.0, < 18.1.1	18.1.1

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authenticated user may cause the API worker to consume increasing amounts of memory, resulting in API performance degradation or denial of service.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-40797 advisory
https://github.com/openstack/neutron/commit/e610a5eb9e71aa2549fb11e2139370d227787da2 web
https://github.com/openstack/neutron package
https://github.com/pypa/advisory-database/tree/main/vulns/neutron/PYSEC-2021-329.yaml web
https://launchpad.net/bugs/1942179 web
https://security.openstack.org/ossa/OSSA-2021-006.html web
http://www.openwall.com/lists/oss-security/2021/09/09/2 web