PT-2023-25557 · Openstack · Openstack Neutron

Avinash Hanwate · Published 2023-07-25 · Updated 2023-07-31 · CVE-2023-3637

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions openstack-neutron (affected versions not specified)

Description An uncontrolled resource consumption flaw was found in openstack-neutron, allowing a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota, potentially leading to a denial of service if a malicious user submits a significant number of requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2023-3637

GHSA-R3JH-QHGJ-GVR8

RHSA-2023:4283

Affected Products

Openstack Neutron

References · 11

• https://osv.dev/vulnerability/CVE-2023-3637 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3637 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-3637 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2222270 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-3637 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2023-3637 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:4283 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r3jh-qhgj-gvr8 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-3637 · Vendor Advisory
• https://t.me/cibsecurity/67234 · Telegram Post
• https://t.me/cvenotify/55112 · Telegram Post