GitHub Advisoryadvisory · PyPI

GHSA-cpx3-696p-3cw9 OpenStack Neutron Denial of Service vulnerability

HIGH Published 2022-05-24 Modified 2024-09-25 Official page ↗
Aliases
CVE-2021-40797
Ecosystem
PyPI
Packages
neutron
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-772
Reviewed
2024-02-23

Affected packages

• PyPI neutron: < 16.4.1 → fixed in 16.4.1 • PyPI neutron: >= 17.0.0, < 17.2.1 → fixed in 17.2.1 • PyPI neutron: >= 18.0.0, < 18.1.1 → fixed in 18.1.1

Description

An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authenticated user may cause the API worker to consume increasing amounts of memory, resulting in API performance degradation or denial of service.

Related

Alias · CVE (1)

  • CVE-2021-40797 An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. vulnerability

Weakness · CWE (1)

  • CWE-772 Missing Release of Resource after Effective Lifetime weakness

References