PT-2018-12631 · Openstack · Openstack Neutron

Laura Pardo · Published 2018-09-10 · Updated 2022-05-13 · CVE-2018-14636

Positive Technologies (AI Summary)

CVSS v4.0

6.0

Medium

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions openstack-neutron versions prior to 13.0.0.0b2 openstack-neutron versions prior to 12.0.3 openstack-neutron versions prior to 11.0.5

Description A security issue allows live-migrated instances to briefly inspect traffic for other instances on the same hypervisor. This can be extended indefinitely if the instance's port is set administratively down before and after live-migration. The issue arises from the Open vSwitch integration bridge being connected to the instance during migration, potentially making all traffic for instances using the same Open vSwitch instance visible to the migrated guest. This is because the required Open vSwitch VLAN filters are only applied post-migration.

Recommendations For versions prior to 13.0.0.0b2, update to version 13.0.0.0b2 or later. For versions prior to 12.0.3, update to version 12.0.3 or later. For versions prior to 11.0.5, update to version 11.0.5 or later.

Fix

Weakness Enumeration

CWE-300

Related Identifiers

CVE-2018-14636

GHSA-8Q95-JJ7P-X93X

PYSEC-2018-94

Affected Products

Openstack Neutron

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2018-14636 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-14636 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-14636 · Security Note
• https://ubuntu.com/security/CVE-2018-14636 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2018-94 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-14636 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-14636 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-14636 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8q95-jj7p-x93x · Vendor Advisory
• https://github.com/openstack/neutron · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/neutron/PYSEC-2018-94.yaml · Note
• https://bugs.launchpad.net/neutron/+bug/1734320 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14636 · Note
• https://bugs.launchpad.net/neutron/+bug/1767422 · Note