GitHub Advisoryadvisory · PyPI

GHSA-x634-34m9-96mp OpensStack Neutron Denial of Service Vulnerability

HIGH Published 2022-05-13 Modified 2024-09-25 Official page ↗
Aliases
CVE-2018-14635
Ecosystem
PyPI
Packages
neutron
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-20
Reviewed
2024-04-08

Affected packages

• PyPI neutron: >= 13.0.0.0b1, < 13.0.0.0b2 → fixed in 13.0.0.0b2 • PyPI neutron: < 11.0.6 → fixed in 11.0.6 • PyPI neutron: >= 12.0.0, < 12.0.4 → fixed in 12.0.4

Description

When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address, bypassing IP address validation. A potential denial of service could occur if an IP address, conflicting with existing guests or routers, is then assigned from outside of the allowed allocation pool. Versions of openstack-neutron before 13.0.0.0b2, 12.0.3 and 11.0.5 are vulnerable.

Related

Alias · CVE (1)

  • CVE-2018-14635 When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address,… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References