PT-2014-3453 · Openstack · Openstack Neutron

Aaron Rosen + 1 · Published 2014-04-01 · Updated 2023-02-13 · CVE-2014-0056

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:N/AC:H/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Neutron versions 2012.2 through 2013.2.2

Description The issue allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command, due to the l3-agent not checking the tenant id when creating ports.

Recommendations For OpenStack Neutron versions 2012.2 through 2013.2.2, update to version 2013.2.3 or later to resolve the issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2014-0056

GHSA-72P9-6GC7-Q93R

RHSA-2014:0516

USN-2194-1

Affected Products

Openstack Neutron

References · 17

• http://ubuntu.com/usn/USN-2194-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-72p9-6gc7-q93r · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-0056 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0516.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-0056 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-0056 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-0056 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-0056 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-0056 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2194-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-0056 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2014-0056 · Note
• http://openwall.com/lists/oss-security/2014/03/27/5 · Note
• https://bugs.launchpad.net/neutron/+bug/1243327 · Note
• https://opendev.org/openstack/neutron · Note