Lucene search

RedhatCVE-2014-0071

HistoryApr 17, 2014 - 2:55 p.m.

CVE-2014-0071

2014-04-1714:55:06

CWE-264

redhat

web.nvd.nist.gov

packstack

red hat

openstack 4.0

security groups

neutron

bypass

unauthorized connections

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

AI Score

6.9

Confidence

Low

EPSS

0.003

Percentile

65.3%

JSON

PackStack in Red Hat OpenStack 4.0 does not enforce the default security groups when deployed to Neutron, which allows remote attackers to bypass intended access restrictions and make unauthorized connections.

Affected configurations

Nvd

Node

redhatopenstackMatch4.0

VendorProductVersionCPE
redhatopenstack4.0cpe:2.3:a:redhat:openstack:4.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redhat	openstack	4.0	cpe:2.3:a:redhat:openstack:4.0:::::::*

References

rhn.redhat.com/errata/RHSA-2014-0233.html

www.securityfocus.com/bid/66001

bugzilla.redhat.com/show_bug.cgi?id=1064163

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

AI Score

6.9

Confidence

Low

EPSS

0.003

Percentile

65.3%

JSON

Related for CVE-2014-0071