PT-2018-12630 · Openstack · Openstack Neutron

Published 2018-09-10 · Updated 2022-05-13 · CVE-2018-14635

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions openstack-neutron versions prior to 13.0.0.0b2 openstack-neutron version 12.0.3 and earlier openstack-neutron version 11.0.5 and earlier

Description The issue allows non-privileged tenants to create and attach ports without specifying an IP address, bypassing IP address validation. This could lead to a denial of service if an IP address conflicting with existing guests or routers is assigned from outside the allowed allocation pool.

Recommendations For versions prior to 13.0.0.0b2, update to version 13.0.0.0b2 or later. For version 12.0.3 and earlier, update to version 12.0.4 or later. For version 11.0.5 and earlier, update to version 11.0.6 or later.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-14635

GHSA-X634-34M9-96MP

PYSEC-2018-93

RHSA-2018:2710

RHSA-2018:2715

RHSA-2018:3792

Affected Products

Openstack Neutron

References · 19

• https://access.redhat.com/errata/RHSA-2018:2721 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x634-34m9-96mp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-14635 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:3792 · Vendor Advisory
• https://git.openstack.org/cgit/openstack/neutron/commit/?id=54aa6e81cb17b33ce4d5d469cc11dec2869c762d · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-14635 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2715 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-14635 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14635 · Patch
• https://access.redhat.com/errata/RHSA-2018:2710 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14635 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-14635 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2018-93 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-14635 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-14635 · Security Note