PT-2017-16770 · Openstack+1 · Openstack Nova-Lxd+1

James Page + 1 · Publicado 2017-02-08 · Atualizado 2022-05-13 · CVE-2017-5936

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack Nova-LXD versions prior to 13.1.1

Description The issue allows remote attackers to bypass intended security restrictions due to the wrong name being used for the veth pairs when applying Neutron security group rules for instances.

Recommendations For versions prior to 13.1.1, update to version 13.1.1 or later to resolve the issue.

Correção

Identificadores relacionados

CVE-2017-5936

GHSA-6XC7-4CX8-J3XC

PYSEC-2017-21

USN-3195-1

Produtos afetados

Openstack Nova-Lxd

Ubuntu

Referências · 19

• https://github.com/pypa/advisory-database/tree/main/vulns/nova-lxd/PYSEC-2017-21.yaml · Nota
• https://github.com/openstack/nova-lxd · Nota
• https://github.com/openstack/nova-lxd/commit/1b76cefb92081efa1e88cd8f330253f857028bd2 · Correção
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-5936 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-5936 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-6xc7-4cx8-j3xc · Aviso do Fabricante
• https://launchpad.net/bugs/1656847 · Nota
• https://bugs.launchpad.net/nova-lxd/+bug/1656847 · Correção
• https://osv.dev/vulnerability/USN-3195-1 · Aviso do Fabricante
• http://ubuntu.com/usn/USN-3195-1 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2017/02/09/3 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2017-5936 · Nota de Segurança
• http://securityfocus.com/bid/96182 · Nota
• https://ubuntu.com/security/CVE-2017-5936 · Aviso do Fabricante
• https://web.archive.org/web/20200227193915/http://securityfocus.com/bid/96182 · Nota