PT-2015-6812 · Openstack · Openstack Neutron

Kevin Benton · Published 2015-10-15 · Updated 2023-02-13 · CVE-2015-5240

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Neutron versions prior to 2014.2.4 OpenStack Neutron versions prior to 2015.1.2

Description A race condition exists when using the ML2 plugin or the security groups AMQP API, allowing remote authenticated users to bypass IP anti-spoofing controls by changing the device owner of a port to start with 'network:' before the security group rules are applied.

Recommendations For OpenStack Neutron versions prior to 2014.2.4, update to version 2014.2.4 or later to resolve the issue. For OpenStack Neutron versions prior to 2015.1.2, update to version 2015.1.2 or later to resolve the issue.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2015-5240

GHSA-HHPJ-6PJ7-WPX5

RHSA-2015:1909

SUSE-SU-2015:1890-1

SUSE-SU-2015:2220-1

Affected Products

Openstack Neutron

References · 37

• https://osv.dev/vulnerability/SUSE-SU-2015:1890-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:2220-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hhpj-6pj7-wpx5 · Vendor Advisory
• https://security.openstack.org/ossa/OSSA-2015-018.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1909.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-5240 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5240 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-5240 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-5240 · Vendor Advisory
• https://github.com/openstack/neutron · Note
• https://github.com/openstack/neutron/commit/fdc3431ccd219accf6a795079d9b67b8656eed8e · Note
• https://github.com/openstack/neutron/commit/767cea23de44a963c6793ffe30ea5c6827d27a38 · Note
• https://github.com/openstack/neutron/commit/bbca973986fdc99eae9d1b2545e8246c0b2be2e2 · Note
• https://access.redhat.com/security/cve/CVE-2015-5240 · Note
• https://bugzilla.suse.com/939691 · Note