TI-2018-10501 Aliases CVE-2018-14636 GHSA-8q95-jj7p-x93x

Live-migrated instances are briefly able to inspect traffic for other instances on the…

LOW 26CWE-300Published 2018-09-10 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · None · None
Fix status: Partial Red Hat: 9 without a fix

Attack profile from CVSS 3.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor. This brief window could be extended indefinitely if the instance's port is set administratively down prior to live-migration and kept down after the migration is complete. This is possible due to the Open vSwitch integration bridge being connected to the instance during migration. When connected to the integration bridge, all traffic for instances using the same Open vSwitch instance would potentially be visible to the migrated guest, as the required Open vSwitch VLAN filters are only applied post-migration. Versions of openstack-neutron before 13.0.0.0b2, 12.0.3, 11.0.5 are vulnerable.

Why it matters now

EPSS 0.01173 67th percentileScored 2026-11-07

Fix Partial neutron (PyPI): 13.0.0.0b2, 12.0.3, 11.0.5Red Hat: 9 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
The Openstack Project	openstack-neutron	13.0.0.0b2; 12.0.3; 11.0.5	—	No fix listed	CNA
—	neutron (PyPI)	13.0.0.0b1 to before 13.0.0.0b2	13.0.0.0b2	Patch available	GHSA-8q95-jj7p-x93x
—	neutron (PyPI)	12.0.0 to before 12.0.3	12.0.3	Patch available	GHSA-8q95-jj7p-x93x
—	neutron (PyPI)	11.0.0 to before 11.0.5	11.0.5	Patch available	GHSA-8q95-jj7p-x93x

openstack-neutron VendorThe Openstack Project Affected 13.0.0.0b2; 12.0.3; 11.0.5 Fixed in — No fix listed CNA
neutron (PyPI) Vendor— Affected 13.0.0.0b1 to before 13.0.0.0b2 Fixed in 13.0.0.0b2 Patch available GHSA-8q95-jj7p-x93x
neutron (PyPI) Vendor— Affected 12.0.0 to before 12.0.3 Fixed in 12.0.3 Patch available GHSA-8q95-jj7p-x93x
neutron (PyPI) Vendor— Affected 11.0.0 to before 11.0.5 Fixed in 11.0.5 Patch available GHSA-8q95-jj7p-x93x

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:openstack:neutron::::::::	7.0.0 – 11.0.4; 12.0.0 – 12.0.2	Vulnerable	OpenStack
cpe:2.3:a:openstack:neutron:13.0.0:b1::::::	13.0.0 b1	Vulnerable	OpenStack

cpe:2.3:a:openstack:neutron:*:*:*:*:*:*:*:* Versions 7.0.0 – 11.0.4; 12.0.0 – 12.0.2 Vulnerable ·OpenStack
cpe:2.3:a:openstack:neutron:13.0.0:b1:*:*:*:*:*:* Versions 13.0.0 b1 Vulnerable ·OpenStack

Remediation

Fix · GHSA-8q95-jj7p-x93x neutron (PyPI) Fixed in 13.0.0.0b2 Advisory →
Fix · GHSA-8q95-jj7p-x93x neutron (PyPI) Fixed in 12.0.3 Advisory →
Fix · GHSA-8q95-jj7p-x93x neutron (PyPI) Fixed in 11.0.5 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenStack Platform 10 (Newton)	Affected	No fix planned: Out of support scope
Red Hat OpenStack Platform 12 (Pike)	Affected	No fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)	Affected	No fix planned: Out of support scope
Red Hat OpenStack Platform 14 (Rocky)	Affected	No fix planned: Out of support scope
Red Hat OpenStack Platform 16.2	Affected	No fix planned: Out of support scope
Red Hat OpenStack Platform 17.1	Affected	No fix planned: Out of support scope
Red Hat OpenStack Platform 18.0	Affected	No fix yet: Fix deferred
Red Hat OpenStack Platform 8 (Liberty)	Affected	No fix planned: Out of support scope
Red Hat OpenStack Platform 9 (Mitaka)	Affected	No fix planned: Out of support scope

Not affected: 1 product

Red Hat Fuse 7

Timeline

2026-10-02 Threatist record created from CVE-2018-14636
2026-10-03 Alias added: GHSA-8q95-jj7p-x93x
2026-10-07 Affected versions changed · Red Hat

References

Advisory 4

Other 2

TI-2022-03027 Uncontrolled resource consumption in openstack-neutron CVSS 3.1MEDIUM 6.5
TI-2015-07327 The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows… CVSS 3.0CRITICAL 9.1
TI-2014-00181 The openvswitch-agent process in OpenStack Neutron 2013.1 before 2013.2.4 and 2014.1… CVSS 2.0HIGH 9.0
TI-2021-16185 OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address… CVSS 3.1CRITICAL 9.1
TI-2016-04653 The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows… CVSS 3.0HIGH 8.2
TI-2016-04654 The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows… CVSS 3.0HIGH 8.2

See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences