PT-2017-16770 · Openstack+1 · Openstack Nova-Lxd+1

James Page + 1 · Published 2017-02-08 · Updated 2022-05-13 · CVE-2017-5936

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack Nova-LXD versions prior to 13.1.1

Description The issue allows remote attackers to bypass intended security restrictions due to the wrong name being used for the veth pairs when applying Neutron security group rules for instances.

Recommendations For versions prior to 13.1.1, update to version 13.1.1 or later to resolve the issue.

Fix

Related Identifiers

CVE-2017-5936

GHSA-6XC7-4CX8-J3XC

PYSEC-2017-21

USN-3195-1

Affected Products

Openstack Nova-Lxd

Ubuntu

References · 19

• https://github.com/openstack/nova-lxd/commit/1b76cefb92081efa1e88cd8f330253f857028bd2 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-5936 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-5936 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6xc7-4cx8-j3xc · Vendor Advisory
• https://bugs.launchpad.net/nova-lxd/+bug/1656847 · Patch
• https://osv.dev/vulnerability/USN-3195-1 · Vendor Advisory
• http://ubuntu.com/usn/USN-3195-1 · Vendor Advisory
• http://openwall.com/lists/oss-security/2017/02/09/3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-5936 · Security Note
• https://ubuntu.com/security/CVE-2017-5936 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2017-21 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3195-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-5936 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5936 · Security Note
• https://github.com/pypa/advisory-database/tree/main/vulns/nova-lxd/PYSEC-2017-21.yaml · Note