~ / search / GHSA-x634-34m9-96mp

GHSA-x634-34m9-96mp

OpensStack Neutron Denial of Service Vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2018-14635

Packages

EcosystemPackageAffectedFixed in
PyPI neutron >= 13.0.0.0b1, < 13.0.0.0b2 13.0.0.0b2
PyPI neutron < 11.0.6 11.0.6
PyPI neutron >= 12.0.0, < 12.0.4 12.0.4

Details

As written in the advisory (Markdown source, shown as plain text).

When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address, bypassing IP address validation. A potential denial of service could occur if an IP address, conflicting with existing guests or routers, is then assigned from outside of the allowed allocation pool. Versions of openstack-neutron before 13.0.0.0b2, 12.0.3 and 11.0.5 are vulnerable.

References

External links from the advisory. They lead to third-party sites.