Все бюллетени/sisyphus/ALT-PU-2019-4233-1
ALT-PU-2019-4233-1

Обновление пакета openstack-neutron в ветке sisyphus

Версия13.0.2-alt1
Задание#219190
Опубликовано2019-01-11
Макс. серьёзностьMEDIUM
Серьёзность:

Закрытые проблемы (4)

CVE-2017-7543
MEDIUM5.9

A race-condition flaw was discovered in openstack-neutron before 7.2.0-12.1, 8.x before 8.3.0-11.1, 9.x before 9.3.1-2.1, and 10.x before 10.0.2-1.1, where, following a minor overcloud update, neutron security groups were disabled. Specifically, the following were reset to 0: net.bridge.bridge-nf-call-ip6tables and net.bridge.bridge-nf-call-iptables. The race was only triggered by an update, at which point an attacker could access exposed tenant VMs and network resources.

Опубликовано: 2018-07-26Изменено: 2024-11-21
CVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSS 3.xСРЕДНЯЯ 5.9
CVSS:3.x/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Ссылки
CVE-2018-14636
MEDIUM5.3

Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor. This brief window could be extended indefinitely if the instance's port is set administratively down prior to live-migration and kept down after the migration is complete. This is possible due to the Open vSwitch integration bridge being connected to the instance during migration. When connected to the integration bridge, all traffic for instances using the same Open vSwitch instance would potentially be visible to the migrated guest, as the required Open vSwitch VLAN filters are only applied post-migration. Versions of openstack-neutron before 13.0.0.0b2, 12.0.3, 11.0.5 are vulnerable.

Опубликовано: 2018-09-10Изменено: 2024-11-21
CVSS 2.0НИЗКАЯ 3.5
CVSS:2.0/AV:N/AC:M/Au:S/C:P/I:N/A:N
CVSS 3.xСРЕДНЯЯ 5.3
CVSS:3.x/CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Ссылки
GHSA-8q95-jj7p-x93x
MEDIUM6.0

Openstack Neutron vulnerable to eavesdropping on private traffic

Опубликовано: 2022-05-13Изменено: 2024-09-26
CVSS 3.xСРЕДНЯЯ 6.0
CVSS:3.x/CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 4.0СРЕДНЯЯ 6.0
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Ссылки
GHSA-hvxr-2fvv-c3wq
MEDIUM5.9

OpenStack Neutron Race Condition vulnerability

Опубликовано: 2022-05-13Изменено: 2023-02-08
CVSS 3.xСРЕДНЯЯ 5.9
CVSS:3.x/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Ссылки