PT-2016-4058 · Openstack · Openstack Neutron

Romain Aviolat · Published 2016-06-17 · Updated 2022-05-14 · CVE-2015-8914

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenStack Neutron versions prior to 7.0.4 OpenStack Neutron versions 8.0.0 through 8.1.0

Description The issue allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism, which can lead to a denial of service or the interception of network traffic via a link-local source address.

Recommendations For versions prior to 7.0.4, update to version 7.0.4 or later. For versions 8.0.0 through 8.1.0, update to a version later than 8.1.0.

Exploit

Fix

DoS

Weakness Enumeration

CWE-923

CWE-254

Related Identifiers

CVE-2015-8914

GHSA-3VJ4-CVJP-482H

RHSA-2016:1473

RHSA-2016:1474

Affected Products

Openstack Neutron

References · 18

• 🔥 https://bugs.launchpad.net/neutron/+bug/1502933 · Exploit
• https://access.redhat.com/errata/RHSA-2016:1474 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-8914 · Vendor Advisory
• https://security.openstack.org/ossa/OSSA-2016-009.html · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2016:1473 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-8914 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-8914 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-8914 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-8914 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-8914 · Security Note
• https://osv.dev/vulnerability/GHSA-3vj4-cvjp-482h · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8914 · Vendor Advisory
• https://github.com/openstack/neutron · Note
• http://openwall.com/lists/oss-security/2016/06/10/5 · Note
• https://review.openstack.org/#/c/310652 · Note