GHSA-fh73-gjvg-349c

OpenStack Neutron vulnerable to authenticated attackers reconfiguring dnsmasq via crafted extra_dhcp_opts value

Source: GitHub Advisory Database (reviewed) High CVE-2021-40085

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	neutron	< 16.4.1	16.4.1
PyPI	neutron	>= 17.0.0, < 17.2.1	17.2.1
PyPI	neutron	>= 18.0.0, < 18.1.1	18.1.1

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. Authenticated attackers can reconfigure dnsmasq via a crafted extra_dhcp_opts value.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-40085 advisory
https://github.com/openstack/neutron/commit/df891f0593d234e01f27d7c0376d9702e178ecfb web
https://github.com/openstack/neutron package
https://github.com/pypa/advisory-database/tree/main/vulns/neutron/PYSEC-2021-361.yaml web
https://launchpad.net/bugs/1939733 web
https://lists.debian.org/debian-lts-announce/2021/10/msg00005.html web
https://lists.debian.org/debian-lts-announce/2022/05/msg00038.html web
https://security.openstack.org/ossa/OSSA-2021-005.html web
https://www.debian.org/security/2021/dsa-4983 web
http://www.openwall.com/lists/oss-security/2021/08/31/2 web