| Name | CVE-2018-14635 |
| Description | When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address, bypassing IP address validation. A potential denial of service could occur if an IP address, conflicting with existing guests or routers, is then assigned from outside of the allowed allocation pool. Versions of openstack-neutron before 13.0.0.0b2, 12.0.3 and 11.0.5 are vulnerable. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| neutron (PTS) | jessie | 2014.1.3-12 | vulnerable |
| stretch (security), stretch (lts), stretch | 2:9.1.1-3+deb9u3 | vulnerable | |
| buster (security), buster, buster (lts) | 2:13.0.7+git.2021.09.27.bace3d1890-0+deb10u1 | fixed | |
| bullseye (security), bullseye | 2:17.2.1-0+deb11u1 | fixed | |
| bookworm | 2:21.0.0-7 | fixed | |
| trixie | 2:25.0.0-3 | fixed | |
| sid | 2:25.0.0-4 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| neutron | source | (unstable) | 2:13.0.0-1 |
[stretch] - neutron <ignored> (Minor issue)
[jessie] - neutron <ignored> (Minor issue)
https://bugs.launchpad.net/neutron/+bug/1757482
https://git.openstack.org/cgit/openstack/neutron/commit/?id=54aa6e81cb17b33ce4d5d469cc11dec2869c762d