OpenStack

Records333All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical23CVSS 9.0–10.0

CVSS high77CVSS 7.0–8.9

Exploited now

OpenStack records in CISA KEV

No OpenStack vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Keystone 44 records MEDIUM Nova 39 records HIGH Folsom 25 records LOW Neutron 25 records MEDIUM Horizon 24 records MEDIUM Essex 15 records LOW Image Registry And Delivery Service (glance) 15 records LOW Swift 15 records MEDIUM

Records

25 records in Neutron · all components

TI-2022-03027 CVE-2022-3277 · GHSA-w446-h7vg-wv3p

Uncontrolled resource consumption in openstack-neutron

MEDIUM 62

An uncontrolled resource consumption flaw was found in openstack-neutron.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01065 Published 2023-03-06 Partial fix · 19.5.0, 18.6.0 +1 CWE-400

TI-2015-07327 CVE-2015-8914 · GHSA-3vj4-cvjp-482h

The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows…

MEDIUM 46

The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism and consequently cause a denial of service or intercept n…

CVSS 3.0CRITICAL 9.1 Network No auth No interaction EPSS 0.04283 Published 2016-06-17 Partial fix · 7.0.5, 8.1.1 CWE-254

TI-2014-00181 CVE-2014-0187 · GHSA-x3fg-cp39-r4h6

The openvswitch-agent process in OpenStack Neutron 2013.1 before 2013.2.4 and 2014.1…

MEDIUM 44

The openvswitch-agent process in OpenStack Neutron 2013.1 before 2013.2.4 and 2014.1 before 2014.1.1 allows remote authenticated users to bypass security group restrictions via an invalid CIDR in a security group rule, w…

CVSS 2.0HIGH 9.0 Network Low privileges Interaction — EPSS 0.02999 Published 2014-04-28 Fixed CWE-264

TI-2021-16185 CVE-2021-38598 · GHSA-hvm4-mc7m-22w4

OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address…

MEDIUM 42

OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01216 Published 2021-08-23 Partial fix · 16.4.1, 17.1.3 CWE-290

TI-2016-04653 CVE-2016-5362 · GHSA-qpwc-p365-pqrr

The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows…

MEDIUM 42

The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended DHCP-spoofing protection mechanism and consequently cause a denial of service or intercept net…

CVSS 3.0HIGH 8.2 Network No auth No interaction EPSS 0.03439 Published 2016-06-17 Partial fix · 7.0.5, 8.1.1 CWE-254

TI-2016-04654 CVE-2016-5363 · GHSA-9pp3-cvmq-9p22

The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows…

MEDIUM 41

The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended MAC-spoofing protection mechanism and consequently cause a denial of service or intercept netw…

CVSS 3.0HIGH 8.2 Network No auth No interaction EPSS 0.03266 Published 2016-06-17 Partial fix · 7.1.0, 8.1.0 CWE-254

TI-2013-05386 CVE-2013-6433 · GHSA-943v-q963-5fvx

The default configuration in the Red Hat openstack-neutron package before 2013.2.3-7 does…

LOW 39

The default configuration in the Red Hat openstack-neutron package before 2013.2.3-7 does not properly set a configuration file for rootwrap, which allows remote attackers to gain privileges via a crafted configuration f…

CVSS 2.0HIGH 7.6 Network No auth Interaction — EPSS 0.03324 Published 2014-06-02 Partial fix CWE-264

TI-2014-02953 CVE-2014-3632 · GHSA-hr9q-fc36-qcfj

The default configuration in a sudoers file in the Red Hat openstack-neutron package…

LOW 38

The default configuration in a sudoers file in the Red Hat openstack-neutron package before 2014.1.2-4, as used in Red Hat Enterprise Linux Open Stack Platform 5.0 for Red Hat Enterprise Linux 6, allows remote attackers…

CVSS 2.0HIGH 7.6 Network No auth Interaction — EPSS 0.02501 Published 2014-10-07 Fixed CWE-264

TI-2019-07128 CVE-2019-9735 · GHSA-9773-3fqg-8w25

An issue was discovered in the iptables firewall module in OpenStack Neutron before…

LOW 35

An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.03705 Published 2019-03-13 Fixed in 10.0.8, 11.0.7 +2 CWE-755

TI-2018-10500 CVE-2018-14635 · GHSA-x634-34m9-96mp

Improper input validation in openstack-neutron

LOW 34

When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address, bypassing IP address validation.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02527 Published 2018-09-10 Partial fix · 13.0.0.0b2, 11.0.6 +1 CWE-20

TI-2021-17282 CVE-2021-40085 · GHSA-fh73-gjvg-349c

An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x…

LOW 33

An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01866 Published 2021-08-31 Fixed in 16.4.1, 17.2.1 +1

TI-2021-03558 CVE-2021-20267 · GHSA-w8hx-f868-pvch

Insufficient verification of data authenticity in openstack-neutron

LOW 33

A flaw was found in openstack-neutron's default Open vSwitch firewall rules.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.01043 Published 2021-05-28 Partial fix · 16.3.1, 15.3.3 +1 CWE-345

TI-2021-17741 CVE-2021-40797 · GHSA-cpx3-696p-3cw9

An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x…

LOW 32

An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01809 Published 2021-09-08 Partial fix · 16.4.1, 17.2.1 +1 CWE-772

TI-2019-08099 CVE-2019-10876 · GHSA-jr9m-v5qh-mh2j

An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and…

LOW 32

An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01725 Published 2019-04-05 Fixed in 11.0.7, 12.0.6 +1

TI-2015-02850 CVE-2015-3221 · GHSA-wf44-4mgj-rwvx

OpenStack Neutron before 2014.2.4 (juno) and 2015.1.x before 2015.1.1 (kilo), when using…

LOW 32

OpenStack Neutron before 2014.2.4 (juno) and 2015.1.x before 2015.1.1 (kilo), when using the IPTables firewall driver, allows remote authenticated users to cause a denial of service (L2 agent crash) by adding an address…

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.11434 Published 2015-08-26 Fixed in 2014.2.4, 2015.1.1 CWE-20

TI-2017-05184 CVE-2017-7543 · GHSA-hvxr-2fvv-c3wq

Race condition in Red Hat openstack-neutron

LOW 30

A race-condition flaw was discovered in openstack-neutron before 7.2.0-12.1, 8.x before 8.3.0-11.1, 9.x before 9.3.1-2.1, and 10.x before 10.0.2-1.1, where, following a minor overcloud update, neutron security groups wer…

CVSS 3.0MEDIUM 5.9 Network No auth No interaction EPSS 0.01838 Published 2018-07-26 Fixed in 7.2.0-12.1, 8.3.0-11.1 +2 CWE-362

TI-2014-03801 CVE-2014-4615 · GHSA-9wrh-vfjh-96rg

The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer)…

LOW 28

The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno before Juno-2, and Oslo allows remote authe…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02774 Published 2014-08-19 Partial fix CWE-200

TI-2018-10501 CVE-2018-14636 · GHSA-8q95-jj7p-x93x

Live-migrated instances are briefly able to inspect traffic for other instances on the…

LOW 26

Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor.

CVSS 3.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.01173 Published 2018-09-10 Partial fix · 13.0.0.0b2, 12.0.3 +1 CWE-300

TI-2014-06494 CVE-2014-7821 · GHSA-3v86-wqpm-qc9x

OpenStack Neutron before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote…

LOW 26

OpenStack Neutron before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (crash) via a crafted dns_nameservers value in the DNS configuration.

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.03936 Published 2014-11-24 Fixed CWE-20

TI-2014-06768 CVE-2014-8153 · GHSA-rqg5-f3m3-r3xh

The L3 agent in OpenStack Neutron 2014.2.x before 2014.2.2, when using radvd 2.0+, allows…

LOW 23

The L3 agent in OpenStack Neutron 2014.2.x before 2014.2.2, when using radvd 2.0+, allows remote authenticated users to cause a denial of service (blocked router update processing) by creating eight routers and assigning…

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.01919 Published 2015-01-15 No fix listed CWE-20

TI-2014-05269 CVE-2014-6414 · GHSA-94x8-hxww-p5g2

OpenStack Neutron before 2014.2.4 and 2014.1 before 2014.1.2 allows remote authenticated…

LOW 23

OpenStack Neutron before 2014.2.4 and 2014.1 before 2014.1.2 allows remote authenticated users to set admin network attributes to default values via unspecified vectors.

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.02089 Published 2014-10-02 Fixed CWE-264

TI-2014-02880 CVE-2014-3555

OpenStack Neutron before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows…

LOW 23

OpenStack Neutron before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to cause a denial of service (crash or long firewall rule updates) by creating a large number of allowed…

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.02209 Published 2014-07-23 Fixed CWE-264

TI-2014-03406 CVE-2014-4167 · GHSA-r7cp-gqhf-qm59

The L3-agent in OpenStack Neutron before 2013.2.4, 2014.x before 2014.1.2, and Juno…

LOW 20

The L3-agent in OpenStack Neutron before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to cause a denial of service (IPv4 address attachment outage) by attaching an IPv6 priva…

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.01659 Published 2014-07-11 Partial fix CWE-264

TI-2015-04400 CVE-2015-5240 · GHSA-hhpj-6pj7-wpx5

Race condition in OpenStack Neutron before 2014.2.4 and 2015.1 before 2015.1.2, when…

LOW 19

Race condition in OpenStack Neutron before 2014.2.4 and 2015.1 before 2015.1.2, when using the ML2 plugin or the security groups AMQP API, allows remote authenticated users to bypass IP anti-spoofing controls by changing…

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.00976 Published 2015-10-27 Fixed in 7.0.0 CWE-362

TI-2014-00052 CVE-2014-0056 · GHSA-72p9-6gc7-q93r

The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id…

LOW 14

The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in…

CVSS 2.0LOW 2.1 Network Low privileges Interaction — EPSS 0.01445 Published 2014-05-08 Partial fix · 2013.2.3 CWE-287

Open these records in search →