Mittel

Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor. This brief window could be extended indefinitely if the instance's port is set administratively

Veröffentlicht: 10.09.2018
Aktualisiert: 11.10.2026 12:20

Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor. This brief window could be extended indefinitely if the instance's port is set administratively down prior to live-migration and kept down after the migration is complete. This is possible due to the Open vSwitch integration bridge being connected to the instance during migration. When connected to the integration bridge, all traffic for instances using the same Open vSwitch instance would potentially be visible to the migrated guest, as the required Open vSwitch VLAN filters are only applied post-migration. Versions of openstack-neutron before 13.0.0.0b2, 12.0.3, 11.0.5 are vulnerable.

Betroffene Software

Klicken Sie auf eine Technologie, um alle zugehörigen Schwachstellen anzuzeigen.

Plattform	Paket	Anfällige Versionen	Behoben in
Python (PyPI)	neutron	>= 7.0.0, < 11.0.5, >= 12.0.0, < 12.0.3	11.0.5, 12.0.3

Verweise

CVSS-Wert 5.3/10

CVSS-Vektor: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Schwäche (CWE): -
Plattform: Python (PyPI)
Paket: neutron
Veröffentlicht: 10.09.2018
Aktualisiert: 11.10.2026 12:20

Quellen und Lizenzen

OSV / GitHub Advisory Database - GHSA-8q95-jj7p-x93x - CC BY 4.0

OSV / GitHub Advisory Database - PYSEC-2018-94 - PyPA Advisory Database; CC BY 4.0

Schwachstellenhistorie: neutron

Alle veröffentlichten Schwachstellen dieses Pakets (Python (PyPI)), neueste zuerst. Zeigt, ob es ein einmaliger Ausrutscher ist oder ein Paket, das man im Auge behalten muss.

Alle (21) im Archiv

Einträge insgesamt: 21
Erste → letzte: 09.2018 06.2026
Ohne Fix: 1
In Angriffen ausgenutzt: 0

Verteilung nach Schweregrad

Kritisch 1
Hoch 9
Mittel 9
Niedrig 2

Veröffentlichungen pro Jahr

2018: 2
2019: 2
2020: 0
2021: 4
2022: 8
2023: 2
2024: 1
2025: 0
2026: 2

17.05.2022

OpenStack Neutron Intended MAC-spoofing protection mechanism bypass

Hoch · 8.2 CVE-2016-5363 < 7.1.0, >= 8.0.0, < 8.1.0 7.1.0, 8.1.0
14.05.2022

OpenStack Neutron allows remote attackers to bypass an intended DHCP-spoofing protection mechanism

Hoch · 8.2 CVE-2016-5362 < 7.0.5, >= 8.0.0, < 8.1.1 7.0.5, 8.1.1
14.05.2022

OpenStack Neutron allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism

Kritisch · 9.1 CVE-2015-8914 < 7.0.5, >= 8.0.0, < 8.1.1 7.0.5, 8.1.1
08.09.2021

An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authentica

Hoch · 6.5 CVE-2021-40797 < 16.4.1, >= 17.0.0, < 17.2.1, >= 18.0.0, < 18.1.1 16.4.1, 17.2.1, 18.1.1
31.08.2021

An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. Authenticated attackers can reconfigure dnsmasq via a crafted extra_dhcp_opts value.

Hoch · 6.5 CVE-2021-40085 < 16.4.1, >= 17.0.0, < 17.2.1, >= 18.0.0, < 18.1.1 16.4.1, 17.2.1, 18.1.1
23.08.2021

OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending ca

Hoch · 9.1 CVE-2021-38598 < 16.4.1, >= 17.0.0, < 17.1.3, >= 18.0.0, < 18.1.0 16.4.1, 17.1.3, 18.1.0
28.05.2021

A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonat

Hoch · 7.1 CVE-2021-20267 < 15.3.3, >= 16.0.0, < 16.3.1, >= 17.0.0, < 17.1.1 15.3.3, 16.3.1, 17.1.1
05.04.2019

An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated use

Hoch · 6.5 CVE-2019-10876 >= 12.0.0, < 12.0.6, < 11.0.7, >= 13.0.0, < 13.0.3 12.0.6, 11.0.7, 13.0.3
13.03.2019

An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By setting a destination port in a security

Hoch · 6.5 CVE-2019-9735 >= 12.0.0, < 12.0.6, >= 13.0.0, < 13.0.3, >= 11.0.0, < 11.0.7, < 10.0.8 12.0.6, 13.0.3, 11.0.7, 10.0.8
10.09.2018

Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor. This brief window could be extended indefinitely if the instance's port is set administratively dieser Eintrag

Mittel · 5.3 CVE-2018-14636 >= 7.0.0, < 11.0.5, >= 12.0.0, < 12.0.3 11.0.5, 12.0.3
10.09.2018

When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address, bypassing IP address validation. A potential denial of service coul

Hoch · 6.5 CVE-2018-14635 < 11.0.6, >= 12.0.0, < 12.0.4 11.0.6, 12.0.4

Erkennen Sie Schwachstellen in Ihrer Anwendung

Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.

Anwendung verbinden