openstack-neutron: unrestricted creation of security groups

An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significa...

Moderate: Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.9 (openstack-neutron) security update

An update for openstack-neutron is now available for Red Hat OpenStack Platform 16.1.9 Train for Red Hat Enterprise Linux RHEL 8.2. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

openstack-neutron: unrestricted creation of security groups

An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significa...

Denial Of Service (DoS)

Nova is vulnerable to denial of service DoS due to changing neutron ports. An attacker creates a neutron port with the direct vnictype, instantiates an instance bound to the port, then changes the bound port to macvtap, resulting in compute services failure to restart, leading to a denial of...

CVE-2022-3277

An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significa...

RHEL 7 : Red Hat OpenStack Platform 13.0 (openstack-neutron) (RHSA-2021:3503)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:3503 advisory. Neutron is a virtual network service for OpenStack. Just like OpenStack Nova provides an API to dynamically request and configure virtual servers,...

RHEL 8 : Red Hat OpenStack Platform 16.1 (openstack-neutron) (RHSA-2021:3481)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:3481 advisory. Neutron is a virtual network service for Openstack, and a part of Netstack. Just like OpenStack Nova provides an API to dynamically request and...

RHEL 8 : Red Hat OpenStack Platform 16.2 (openstack-neutron) (RHSA-2021:3488)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:3488 advisory. Neutron is a virtual network service for OpenStack. Just like OpenStack Nova provides an API to dynamically request and configure virtual servers,...

RHEL 7 : Red Hat OpenStack Platform 10.0 (openstack-neutron) (RHSA-2021:3502)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:3502 advisory. Neutron is a virtual network service for OpenStack. Just like OpenStack Nova provides an API to dynamically request and configure virtual servers,...

GHSA-V725-C588-H936 OpenStack Nova Changing vnic_type breaks compute service restart

An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2. By creating a neutron port with the direct vnictype, creating an instance bound to that port, and then changing the vnictype of the bound port to macvtap, an authenticated user may cause the compu...

CVE-2022-37394

An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2. By creating a neutron port with the direct vnictype, creating an instance bound to that port, and then changing the vnictype of the bound port to macvtap, an authenticated user may cause the compu...

Design/Logic Flaw

An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2. By creating a neutron port with the direct vnictype, creating an instance bound to that port, and then changing the vnictype of the bound port to macvtap, an authenticated user may cause the compu...

CVE-2022-37394

An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2. By creating a neutron port with the direct vnictype, creating an instance bound to that port, and then changing the vnictype of the bound port to macvtap, an authenticated user may cause the compu...

CVE-2022-37394

An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2. By creating a neutron port with the direct vnictype, creating an instance bound to that port, and then changing the vnictype of the bound port to macvtap, an authenticated user may cause the compu...

PT-2022-23970

Name of the Vulnerable Software and Affected Versions OpenStack Nova versions prior to 23.2.2 OpenStack Nova versions 24.x prior to 24.1.2 OpenStack Nova versions 25.x prior to 25.0.2 Description An issue was discovered in OpenStack Nova where an authenticated user may cause the compute service t...

Debian: Security Advisory (DLA-3027-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2022:1884-1 Security update for openstack-neutron

This update for openstack-neutron fixes the following issues: - CVE-2021-40797: Fixed routes middleware memory leak for nonexistent controllers bsc1190339. - CVE-2021-40085: Fixed arbitrary dnsmasq reconfiguration via extradhcpopts bsc1189794...

[SECURITY] [DLA 3027-1] neutron security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3027-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb May 26, 2022 https://wiki.debian.org/LTS - -------------------------------------------------------------------------...

DLA-3027-1 neutron - security update

Bulletin has no description...

GHSA-CPX3-696P-3CW9 OpenStack Neutron Denial of Service vulnerability

An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authenticated user may cause the API worker to consume increasing amounts of memory, resulting in API...