Improper Access Control Affecting neutron package, versions [0,11.0.7) [12.0.0,12.0.6) [13.0.0,13.0.3)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-NEUTRON-1579276
- published 1 Sep 2021
- disclosed 5 Apr 2019
- credit Diko Parvanov
Introduced: 5 Apr 2019
CVE-2019-10876 Open this link in a new tabHow to fix?
Upgrade neutron to version 11.0.7, 12.0.6, 13.0.3 or higher.
Overview
neutron is an OpenStack project to provide “network connectivity as a service” between interface devices (e.g., vNICs) managed by other OpenStack services (e.g., nova). It implements the Neutron API.
Affected versions of this package are vulnerable to Improper Access Control. By creating two security groups with separate/overlapping port ranges, an authenticated user may prevent neutron from being able to configure networks on any compute nodes where those security groups are present, because of an Open vSwitch (OVS) firewall KeyError.