OpenStack Neutron before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to cause a denial of service (crash or long firewall rule updates) by creating a large number of allowed address pairs.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Neutron | Openstack | 2013.2.4 (including) | 2013.2.4 (including) |
| Neutron | Openstack | 2014.1 (including) | 2014.1 (including) |
| Neutron | Openstack | 2014.1.1 (including) | 2014.1.1 (including) |
| Neutron | Openstack | juno-1 (including) | juno-1 (including) |
| OpenStack 4 for RHEL 6 | RedHat | openstack-neutron-0:2013.2.3-16.el6ost | * |
| Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6 | RedHat | openstack-neutron-0:2014.1.2-2.el6ost | * |
| Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7 | RedHat | openstack-neutron-0:2014.1.2-2.el7ost | * |
| Neutron | Ubuntu | trusty | * |
| Neutron | Ubuntu | upstream | * |
References
- http://lists.openstack.org/pipermail/openstack-announce/2014-July/000255.html
- http://rhn.redhat.com/errata/RHSA-2014-1119.html
- http://rhn.redhat.com/errata/RHSA-2014-1120.html
- http://seclists.org/oss-sec/2014/q3/200
- http://secunia.com/advisories/60766
- http://secunia.com/advisories/60804
- http://www.securityfocus.com/bid/68765
- https://bugs.launchpad.net/neutron/+bug/1336207
- http://lists.openstack.org/pipermail/openstack-announce/2014-July/000255.html
- http://rhn.redhat.com/errata/RHSA-2014-1119.html
- http://rhn.redhat.com/errata/RHSA-2014-1120.html
- http://seclists.org/oss-sec/2014/q3/200
- http://secunia.com/advisories/60766
- http://secunia.com/advisories/60804
- http://www.securityfocus.com/bid/68765
- https://bugs.launchpad.net/neutron/+bug/1336207