PT-2021-22954 · Openstack+3 · Openstack Neutron+3

Slawek Kaplonski · Published 2021-09-08 · Updated 2024-08-07 · CVE-2021-40797

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack Neutron versions prior to 16.4.1 OpenStack Neutron versions 17.x prior to 17.2.1 OpenStack Neutron versions 18.x prior to 18.1.1

Description An issue in the routes middleware allows an authenticated user to cause API performance degradation or denial of service by making API requests involving nonexistent controllers, resulting in the API worker consuming increasing amounts of memory.

Recommendations For OpenStack Neutron versions prior to 16.4.1, update to version 16.4.1 or later. For OpenStack Neutron versions 17.x prior to 17.2.1, update to version 17.2.1 or later. For OpenStack Neutron versions 18.x prior to 18.1.1, update to version 18.1.1 or later.

Exploit

Fix

DoS

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

ALT-PU-2024-10658

ALT-PU-2024-1575

CVE-2021-40797

GHSA-CPX3-696P-3CW9

PYSEC-2021-329

RHSA-2022:0990

RHSA-2022:0996

SUSE-SU-2022:1884-1

USN-6067-1

Affected Products

Alt Linux

Linuxmint

Openstack Neutron

Ubuntu

References · 28

• 🔥 https://launchpad.net/bugs/1942179 · Exploit
• https://ubuntu.com/security/CVE-2022-3277 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40797 · Security Note
• https://ubuntu.com/security/CVE-2021-40797 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:1884-1 · Vendor Advisory
• http://openwall.com/lists/oss-security/2021/09/09/2 · Patch
• https://cve.org/CVERecord?id=CVE-2021-40797 · Security Note
• https://osv.dev/vulnerability/USN-6067-1 · Vendor Advisory
• https://security.openstack.org/ossa/OSSA-2021-006.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-40797 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-20267 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-40797 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-329 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-38598 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cpx3-696p-3cw9 · Vendor Advisory