Uncontrolled resource consumption in openstack-neutron
Priority MEDIUM 62CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 3 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01065 64th percentileScored 2026-11-07
Fix Partial neutron (PyPI): 19.5.0, 18.6.0, 20.3.0Red Hat: 3 advisoriesRed Hat: 3 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | openstack-neutron | As shipped with Red Hat Openstack 13, 16.1, and 16.2 | — | No fix listed | CNA |
| — | neutron (PyPI) | 19.0.0.0rc1 to before 19.5.0 | 19.5.0 | Patch available | GHSA-w446-h7vg-wv3p |
| — | neutron (PyPI) | before 18.6.0 | 18.6.0 | Patch available | GHSA-w446-h7vg-wv3p |
| — | neutron (PyPI) | 20.0.0.0rc1 to before 20.3.0 | 20.3.0 | Patch available | GHSA-w446-h7vg-wv3p |
- openstack-neutron Vendor— Affected As shipped with Red Hat Openstack 13, 16.1, and 16.2 Fixed in — No fix listed CNA
- neutron (PyPI) Vendor— Affected 19.0.0.0rc1 to before 19.5.0 Fixed in 19.5.0 Patch available GHSA-w446-h7vg-wv3p
- neutron (PyPI) Vendor— Affected before 18.6.0 Fixed in 18.6.0 Patch available GHSA-w446-h7vg-wv3p
- neutron (PyPI) Vendor— Affected 20.0.0.0rc1 to before 20.3.0 Fixed in 20.3.0 Patch available GHSA-w446-h7vg-wv3p
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openstack:neutron:*:*:*:*:*:*:*:* | before 18.6.0; 19.0.0 to before 19.5.0 | Vulnerable | OpenStack |
| cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:* | 13.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openstack_platform:16.1:*:*:*:*:*:*:* | 16.1 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openstack_platform:16.2:*:*:*:*:*:*:* | 16.2 | Vulnerable | Red Hat |
- cpe:2.3:a:openstack:neutron:*:*:*:*:*:*:*:* Versions before 18.6.0; 19.0.0 to before 19.5.0 Vulnerable ·OpenStack
- cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:* Versions 13.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openstack_platform:16.1:*:*:*:*:*:*:* Versions 16.1 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openstack_platform:16.2:*:*:*:*:*:*:* Versions 16.2 Vulnerable ·Red Hat
Remediation
- Fix · GHSA-w446-h7vg-wv3p neutron (PyPI) Fixed in 19.5.0 Advisory →
- Fix · GHSA-w446-h7vg-wv3p neutron (PyPI) Fixed in 18.6.0 Advisory →
- Fix · GHSA-w446-h7vg-wv3p neutron (PyPI) Fixed in 20.3.0 Advisory →
Red Hat 3 advisories
- RHSA-2023:0275 Released 2023-01-25 · Red Hat rating ModerateRed Hat OpenStack Platform 17.0 (openstack-neutron) security update
- Red Hat OpenStack Platform 17.0 openstack-neutron-1:18.4.1-0.20221128170741.5258354.el9ost
- RHSA-2022:8870 Released 2022-12-07 · Red Hat rating ModerateRed Hat OpenStack Platform 16.1.9 (openstack-neutron) security update
- Red Hat OpenStack Platform 16.1 openstack-neutron-1:15.2.1-1.20221005123225.40d217c.el8ost, openstack-neutron-common-1:15.2.1-1.20221005123225.40d217c.el8ost, openstack-neutron-linuxbridge-1:15.2.1-1.20221005123225.40d217c.el8ost +7
- RHSA-2022:8855 Released 2022-12-07 · Red Hat rating ModerateRed Hat OpenStack Platform 16.2.4 (openstack-neutron) security update
- Red Hat OpenStack Platform 16.2 openstack-neutron-1:15.3.5-2.20221005184727.c81fb5b.el8ost, openstack-neutron-common-1:15.3.5-2.20221005184727.c81fb5b.el8ost, openstack-neutron-linuxbridge-1:15.3.5-2.20221005184727.c81fb5b.el8ost +7
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 16.1 | Fixed | RHSA-2022:8870 |
| Red Hat OpenStack Platform 16.2 | Fixed | RHSA-2022:8855 |
| Red Hat OpenStack Platform 17.0 | Fixed | RHSA-2023:0275 |
Not affected: 1 product
- Red Hat OpenStack Platform 17.0
Timeline
- 2026-10-02 Threatist record created from CVE-2022-3277
- 2026-10-03 Alias added: GHSA-w446-h7vg-wv3p
References
Patch 2
Other 7
- https://github.com/openstack/neutron/commit/01fc2b9195f999df4d810df4ee63f77ecbc81f7e
- https://github.com/openstack/neutron/commit/717e3e09556f1fb9a7a420863746fa785eb6c316
- https://github.com/openstack/neutron/commit/733ef4f2d8c2a3734c360d1c1dd3a6fcd600cb8c
- https://github.com/openstack/neutron/commit/cbeee87fa44cd200d4997e02042098460167dce1
- https://github.com/openstack/neutron/commit/d0e1b54fb1de932b2b30ab4269cf5789632df476
- https://github.com/openstack/neutron/commit/fd7fb0e9d8c602380f54975367d935ab69e10c05
- https://github.com/openstack/neutron
Sources
- CVE-2022-3277 · CVE Program
- CVE-2022-3277 · NVD
- FIRST EPSS
- GHSA-w446-h7vg-wv3p · GitHub Advisory Database · CC BY 4.0
- CVE-2022-3277 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences