CVE-2014-0056

2014-05-0814:29:00

Debian Security Bug Tracker

security-tracker.debian.org

2.1 Low

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:S/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

53.3%

JSON

The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command.

OSVersionArchitecturePackageVersionFilename
Debian12allneutron< 2013.2.2-4neutron_2013.2.2-4_all.deb
Debian11allneutron< 2013.2.2-4neutron_2013.2.2-4_all.deb
Debian10allneutron< 2013.2.2-4neutron_2013.2.2-4_all.deb
Debian999allneutron< 2013.2.2-4neutron_2013.2.2-4_all.deb
Debian13allneutron< 2013.2.2-4neutron_2013.2.2-4_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	neutron	< 2013.2.2-4	neutron_2013.2.2-4_all.deb
Debian	11	all	neutron	< 2013.2.2-4	neutron_2013.2.2-4_all.deb
Debian	10	all	neutron	< 2013.2.2-4	neutron_2013.2.2-4_all.deb
Debian	999	all	neutron	< 2013.2.2-4	neutron_2013.2.2-4_all.deb
Debian	13	all	neutron	< 2013.2.2-4	neutron_2013.2.2-4_all.deb