Lucene search

K
ubuntucveUbuntu.comUB:CVE-2023-3637
HistoryJul 25, 2023 - 12:00 a.m.

CVE-2023-3637

2023-07-2500:00:00
ubuntu.com
ubuntu.com
4
openstack-neutron
resource consumption
security groups
denial of service
remote authenticated user
invalid project
uncontrolled

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.9%

An uncontrolled resource consumption flaw was found in openstack-neutron.
This flaw allows a remote authenticated user to query a list of security
groups for an invalid project. This issue creates resources that are
unconstrained by the user’s quota. If a malicious user were to submit a
significant number of requests, this could lead to a denial of service.

Bugs

Notes

Author Note
mdeslaur The relation to CVE-2022-3277 is unclear. As of 2024-06-17, no details whether the original fix was incomplete, or if this CVE applies only to a Red Hat specific issue.

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.9%