PT-2015-6812 · Openstack · Openstack Neutron

Kevin Benton · Publicado 2015-10-15 · Atualizado 2026-06-04 · CVE-2015-5240

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Neutron versions prior to 2014.2.4 OpenStack Neutron versions prior to 2015.1.2

Description A race condition exists when using the ML2 plugin or the security groups AMQP API, allowing remote authenticated users to bypass IP anti-spoofing controls by changing the device owner of a port to start with 'network:' before the security group rules are applied.

Recommendations For OpenStack Neutron versions prior to 2014.2.4, update to version 2014.2.4 or later to resolve the issue. For OpenStack Neutron versions prior to 2015.1.2, update to version 2015.1.2 or later to resolve the issue.

Correção

DoS

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

CVE-2015-5240

GHSA-HHPJ-6PJ7-WPX5

RHSA-2015:1909

SUSE-SU-2015:1890-1

SUSE-SU-2015:2220-1

Produtos afetados

Openstack Neutron

Referências · 38

• https://github.com/openstack/neutron · Nota
• https://github.com/openstack/neutron/commit/bbca973986fdc99eae9d1b2545e8246c0b2be2e2 · Nota
• https://github.com/openstack/neutron/commit/fdc3431ccd219accf6a795079d9b67b8656eed8e · Nota
• https://github.com/openstack/neutron/commit/767cea23de44a963c6793ffe30ea5c6827d27a38 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-5240 · Nota de Segurança
• https://bugzilla.suse.com/935017 · Nota
• https://bugzilla.suse.com/927625 · Nota
• https://osv.dev/vulnerability/GHSA-hhpj-6pj7-wpx5 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1258458 · Nota
• https://bugzilla.suse.com/945923 · Nota
• https://suse.com/security/cve/CVE-2015-3280 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-5240 · Aviso do Fabricante
• https://security.openstack.org/ossa/OSSA-2015-018.html · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2015-5240 · Aviso do Fabricante
• https://bugs.launchpad.net/neutron/+bug/1489111 · Nota