PT-2023-13194 · Openstack+4 · Openstack Neutron+4

Nick Tait · Publicado 2023-03-06 · Atualizado 2025-03-07 · CVE-2022-3277

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions openstack-neutron (affected versions not specified)

Description An uncontrolled resource consumption flaw was found in openstack-neutron, allowing a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota, potentially leading to a denial of service if a malicious user submits a significant number of requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

ALT-PU-2024-10658

ALT-PU-2024-1575

CVE-2022-3277

GHSA-W446-H7VG-WV3P

RHSA-2022:8855

RHSA-2022:8870

RHSA-2023:0275

USN-6067-1

Produtos afetados

Alt Linux

Debian

Linuxmint

Ubuntu

Openstack Neutron

Referências · 40

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=2129193 · Exploit
• 🔥 https://bugs.launchpad.net/neutron/+bug/1988026 · Exploit
• https://github.com/openstack/neutron · Nota
• https://github.com/openstack/neutron/commit/01fc2b9195f999df4d810df4ee63f77ecbc81f7e · Nota
• https://github.com/openstack/neutron/commit/d0e1b54fb1de932b2b30ab4269cf5789632df476 · Nota
• https://github.com/openstack/neutron/commit/cbeee87fa44cd200d4997e02042098460167dce1 · Nota
• https://github.com/openstack/neutron/commit/717e3e09556f1fb9a7a420863746fa785eb6c316 · Nota
• https://github.com/openstack/neutron/commit/fd7fb0e9d8c602380f54975367d935ab69e10c05 · Nota
• https://github.com/openstack/neutron/commit/733ef4f2d8c2a3734c360d1c1dd3a6fcd600cb8c · Nota
• https://packages.altlinux.org/ru/vuln/CVE-2022-3277 · Nota
• https://launchpad.net/bugs/1942179 · Nota
• https://t.me/cvenotify/45675 · Publicação no Telegram
• https://ubuntu.com/security/notices/USN-6067-1 · Aviso do Fabricante
• https://t.me/cvenotify/113843 · Publicação no Telegram
• https://osv.dev/vulnerability/USN-6067-1 · Aviso do Fabricante