CVE-2014-0056

Currently unrated

Key Information:

Vendor
Openstack
Status
Neutron
Vendor
CVE Published:
8 May 2014

Summary

The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command.

References

http://www.openwall.com/lists/oss-security/2014/03/27/5
mailing-listx_refsource_MLIST
http://rhn.redhat.com/errata/RHSA-2014-0516.html
vendor-advisoryx_refsource_REDHAT
http://www.ubuntu.com/usn/USN-2194-1
vendor-advisoryx_refsource_UBUNTU

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.