CVE-2016-5362 OpenStack Neutron allows remote attackers to bypass an intended DHCP-spoofing protection mechanism
HighCVSS 8.2
EPSS 3.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended DHCP-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a crafted DHCP discovery message.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi neutron(PyPI) | < 7.0.5 | 7.0.5 |
| pypi neutron(PyPI) | = 0.0 | No fix listed |
| pypi neutron(PyPI) | >= 8.0.0, < 8.1.1 | 8.1.1 |
| debian/neutron(Debian:12) | < 2:8.1.2-1 | 2:8.1.2-1 |
| debian/neutron(Debian:13) | < 2:8.1.2-1 | 2:8.1.2-1 |
| debian/neutron(Debian:14) | < 2:8.1.2-1 | 2:8.1.2-1 |
| OpenStack Neutron | >= 7.0.0, < 7.0.4 | 7.0.4 |
| OpenStack Neutron | >= 8.0.0, <= 8.1.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- RHSA-2016:1473 third-party-advisory vendor-advisory
- RHSA-2016:1474 third-party-advisory vendor-advisory
- bugs.launchpad.net third-party-advisory
- github.com product
- review.openstack.org third-party-advisory vendor-advisory
- security.openstack.org vendor-advisory
- [oss-security] 20160610 CVE request for vulnerability in OpenStack Neutron mailing-list third-party-advisory
- [oss-security] 20160610 Re: CVE request for vulnerability in OpenStack Neutron mailing-list third-party-advisory
- pypi.org product
- github.com vendor-advisory
- Debian Security Tracker CVE-2016-5362 vendor-advisory