Średnia

Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor. This brief window could be extended indefinitely if the instance's port is set administratively

Ujawniono: 10.09.2018
Aktualizacja: 11.10.2026 12:20

Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor. This brief window could be extended indefinitely if the instance's port is set administratively down prior to live-migration and kept down after the migration is complete. This is possible due to the Open vSwitch integration bridge being connected to the instance during migration. When connected to the integration bridge, all traffic for instances using the same Open vSwitch instance would potentially be visible to the migrated guest, as the required Open vSwitch VLAN filters are only applied post-migration. Versions of openstack-neutron before 13.0.0.0b2, 12.0.3, 11.0.5 are vulnerable.

Czego dotyczy

Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.

Platforma	Paczka	Podatne wersje	Poprawka w wersji
Python (PyPI)	neutron	>= 7.0.0, < 11.0.5, >= 12.0.0, < 12.0.3	11.0.5, 12.0.3

Odnośniki

Ocena CVSS 5.3/10

Wektor CVSS: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Słabość (CWE): -
Platforma: Python (PyPI)
Paczka: neutron
Ujawniono: 10.09.2018
Aktualizacja: 11.10.2026 12:20

Źródła i licencje

OSV / GitHub Advisory Database - GHSA-8q95-jj7p-x93x - CC BY 4.0

OSV / GitHub Advisory Database - PYSEC-2018-94 - PyPA Advisory Database; CC BY 4.0

Historia podatności: neutron

Wszystkie opisane podatności tej paczki (Python (PyPI)), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.

Wszystkie (21) w archiwum

Wszystkich wpisów: 21
Pierwsza → ostatnia: 09.2018 06.2026
Bez poprawki: 1
Wykorzystywana w atakach: 0

Rozkład istotności

Krytyczna 1
Wysoka 9
Średnia 9
Niska 2

Ujawnienia w latach

2018: 2
2019: 2
2020: 0
2021: 4
2022: 8
2023: 2
2024: 1
2025: 0
2026: 2

17.05.2022

OpenStack Neutron Intended MAC-spoofing protection mechanism bypass

Wysoka · 8.2 CVE-2016-5363 < 7.1.0, >= 8.0.0, < 8.1.0 7.1.0, 8.1.0
14.05.2022

OpenStack Neutron allows remote attackers to bypass an intended DHCP-spoofing protection mechanism

Wysoka · 8.2 CVE-2016-5362 < 7.0.5, >= 8.0.0, < 8.1.1 7.0.5, 8.1.1
14.05.2022

OpenStack Neutron allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism

Krytyczna · 9.1 CVE-2015-8914 < 7.0.5, >= 8.0.0, < 8.1.1 7.0.5, 8.1.1
08.09.2021

An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authentica

Wysoka · 6.5 CVE-2021-40797 < 16.4.1, >= 17.0.0, < 17.2.1, >= 18.0.0, < 18.1.1 16.4.1, 17.2.1, 18.1.1
31.08.2021

An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. Authenticated attackers can reconfigure dnsmasq via a crafted extra_dhcp_opts value.

Wysoka · 6.5 CVE-2021-40085 < 16.4.1, >= 17.0.0, < 17.2.1, >= 18.0.0, < 18.1.1 16.4.1, 17.2.1, 18.1.1
23.08.2021

OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending ca

Wysoka · 9.1 CVE-2021-38598 < 16.4.1, >= 17.0.0, < 17.1.3, >= 18.0.0, < 18.1.0 16.4.1, 17.1.3, 18.1.0
28.05.2021

A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonat

Wysoka · 7.1 CVE-2021-20267 < 15.3.3, >= 16.0.0, < 16.3.1, >= 17.0.0, < 17.1.1 15.3.3, 16.3.1, 17.1.1
05.04.2019

An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated use

Wysoka · 6.5 CVE-2019-10876 >= 12.0.0, < 12.0.6, < 11.0.7, >= 13.0.0, < 13.0.3 12.0.6, 11.0.7, 13.0.3
13.03.2019

An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By setting a destination port in a security

Wysoka · 6.5 CVE-2019-9735 >= 12.0.0, < 12.0.6, >= 13.0.0, < 13.0.3, >= 11.0.0, < 11.0.7, < 10.0.8 12.0.6, 13.0.3, 11.0.7, 10.0.8
10.09.2018

Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor. This brief window could be extended indefinitely if the instance's port is set administratively ten wpis

Średnia · 5.3 CVE-2018-14636 >= 7.0.0, < 11.0.5, >= 12.0.0, < 12.0.3 11.0.5, 12.0.3
10.09.2018

When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address, bypassing IP address validation. A potential denial of service coul

Wysoka · 6.5 CVE-2018-14635 < 11.0.6, >= 12.0.0, < 12.0.4 11.0.6, 12.0.4

Dowiedz się, które podatności dotyczą Twojej aplikacji

Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.

Podłącz swoją aplikację