CVE-2014-3555

CVE-2014-3555 affects OpenStack Neutron. Vulnerable versions: Neutron before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2. A remote authenticated user can cause a denial of service (crash or extended firewall rule updates) by creating a large number of allowed address pairs. Remediati...

CVE-2013-6433

The CVE-2013-6433 issue affects the Red Hat openstack-neutron package: its default configuration prior to 2013.2.3-7 does not properly set a rootwrap configuration file, enabling privilege escalation by an attacker via a crafted config. The impact is privilege escalation with network-exposed vect...

CVE-2014-4615

CVE-2014-4615 affects OpenStack components including PyCADF (0.5.0 and earlier), Ceilometer 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno before Juno-2, and Oslo. The issue allows remote authenticated users to read a message queue (v2/meters/http.reque...

CVE-2014-0056

CVE-2014-0056 affects OpenStack Neutron l3-agent (2012.2 before 2013.2.3). The issue: tenant-id not checked when creating ports, allowing remote authenticated users to connect ports to the routers of arbitrary tenants via the device-id in a port-create command. CVSSv2 base score 2.1 (LOW), attack...

CVE-2014-3632

The CVE-2014-3632 issue affects the OpenStack Neutron package in Red Hat Enterprise Linux OpenStack Platform 5.0 on RHEL6, where a default sudoers configuration in the openstack-neutron package before 2014.1.2-4 allows privilege escalation via a crafted configuration file. This is a regression li...

CVE-2014-4167

CVE-2014-4167 affects the OpenStack Neutron L3-agent, where an authenticated remote user can cause a denial of service by attaching an IPv6 private subnet to an L3 router. Affected releases include Neutron before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2. Exploitation results in an...

CVE-2014-0187

CVE-2014-0187 affects OpenStack Neutron where openvswitch-agent could bypass security group rules by using an invalid CIDR in a security group rule, preventing subsequent rules from applying. The issue affected OpenStack Neutron releases prior to 2013.2.4 (and 2014.1 prior to 2014.1.1); multiple ...

CVE-2014-6414

Summary: CVE-2014-6414 affects OpenStack Neutron; unauthenticated? or remote authenticated users could reset admin network attributes to default values due to insufficient access control in Neutron prior to 2014.2.4 (and before 2014.1.2 in 2014.1 line). This could lead to misconfiguration or deni...

CVE-2014-7821

OpenStack Neutron vulnerable to a denial-of-service via a crafted dns_nameservers value in DNS configuration. Affected products: OpenStack Neutron before 2014.1.4 and 2014.2.x before 2014.2.1. Root cause: improper handling of the dns_nameservers parameter leads to crash when an authenticated user...