PT-2018-12630 · Openstack · Openstack Neutron

Publicado 2018-09-10 · Atualizado 2022-05-13 · CVE-2018-14635

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions openstack-neutron versions prior to 13.0.0.0b2 openstack-neutron version 12.0.3 and earlier openstack-neutron version 11.0.5 and earlier

Description The issue allows non-privileged tenants to create and attach ports without specifying an IP address, bypassing IP address validation. This could lead to a denial of service if an IP address conflicting with existing guests or routers is assigned from outside the allowed allocation pool.

Recommendations For versions prior to 13.0.0.0b2, update to version 13.0.0.0b2 or later. For version 12.0.3 and earlier, update to version 12.0.4 or later. For version 11.0.5 and earlier, update to version 11.0.6 or later.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-14635

GHSA-X634-34M9-96MP

PYSEC-2018-93

RHSA-2018:2710

RHSA-2018:2715

RHSA-2018:3792

Produtos afetados

Openstack Neutron

Referências · 19

• https://github.com/openstack/neutron · Nota
• https://github.com/openstack/neutron/commit/54aa6e81cb17b33ce4d5d469cc11dec2869c762d · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/neutron/PYSEC-2018-93.yaml · Nota
• https://access.redhat.com/errata/RHSA-2018:2721 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-x634-34m9-96mp · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-14635 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:3792 · Aviso do Fabricante
• https://git.openstack.org/cgit/openstack/neutron/commit/?id=54aa6e81cb17b33ce4d5d469cc11dec2869c762d · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-14635 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:2715 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-14635 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14635 · Correção
• https://access.redhat.com/errata/RHSA-2018:2710 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-14635 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-14635 · Aviso do Fabricante