Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

neutron

21 known vulnerabilities (1 high, 6 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
21 · 1 high, 6 medium, 1 low
Registry
PyPI

Advisories 21

  • In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set…

    Affected: fixed in 28.0.1.

  • CVE-2026-49299Medium 5.3

    In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the…

    Affected: from 26.0.0, fixed in 26.0.4; from 27.0.0, fixed in 27.0.3; from 28.0.0, fixed in 28.0.1; from 28.0.0, fixed in 28.0.1; from 27.0.0, fixed in 27.0.3; from 26.0.0, fixed in 26.0.4.

  • In OpenStack Neutron before 25.0.1, neutron/extensions/tagging.py can use an incorrect ID during policy enforcement.

    Affected: from 23.0.0, fixed in 23.2.1; from 24.0.0, fixed in 24.0.2; from 25.0.0, fixed in 25.0.1; from 23.0.0, fixed in 23.2.1; from 24.0.0, fixed in 24.0.2; from 25.0.0, fixed in 25.0.1.

  • CVE-2023-3637Medium 4.3

    Openstack-neutron: unrestricted creation of security groups (fix for cve-2022-3277)

    Affected: through 22.0.2.

  • CVE-2022-3277Medium 6.5

    An uncontrolled resource consumption flaw was found in openstack-neutron.

    Affected: from 19.0.0.0rc1, fixed in 19.5.0; fixed in 18.6.0; from 20.0.0.0rc1, fixed in 20.3.0; fixed in 18.6.0; from 19.0.0.0rc1, fixed in 19.5.0; from 20.0.0.0rc1, fixed in 20.3.0.

  • An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1.

    Affected: fixed in 16.4.1; from 17.0.0, fixed in 17.2.1; from 18.0.0, fixed in 18.1.1; fixed in 16.4.1; from 17.0.0, fixed in 17.2.1; from 18.0.0, fixed in 18.1.1.

  • An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1.

    Affected: fixed in 16.4.1; from 17.0.0, fixed in 17.2.1; from 18.0.0, fixed in 18.1.1; fixed in 16.4.1; from 17.0.0, fixed in 17.2.1; from 18.0.0, fixed in 18.1.1.

  • OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with…

    Affected: fixed in 16.4.1; from 17.0.0, fixed in 17.1.3; versions 18.0.0; fixed in 16.4.1; from 17.0.0, fixed in 17.1.3; from 18.0.0, fixed in 18.1.0.

  • A flaw was found in openstack-neutron's default Open vSwitch firewall rules.

    Affected: from 16.0.0, fixed in 16.3.1; fixed in 15.3.3; from 17.0.0, fixed in 17.1.1; fixed in 15.3.3; from 16.0.0, fixed in 16.3.1; from 17.0.0, fixed in 17.1.1.

  • HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate…

    Affected: fixed in 7.0.0a0.

  • An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3.

    Affected: from 12.0.0, fixed in 12.0.6; fixed in 11.0.7; from 13.0.0, fixed in 13.0.3; from 11.0.0, fixed in 11.0.7; from 12.0.0, fixed in 12.0.6; from 13.0.0, fixed in 13.0.3.

  • An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and…

    Affected: fixed in 10.0.8; from 11.0.0, fixed in 11.0.7; from 12.0.0, fixed in 12.0.6; from 13.0.0, fixed in 13.0.3; from 12.0.0, fixed in 12.0.6; from 13.0.0, fixed in 13.0.3; from 11.0.0, fixed in 11.0.7; fixed in 10.0.8.

  • CVE-2018-14636Medium 5.3

    Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor.

    Affected: from 13.0.0.0b1, fixed in 13.0.0.0b2; from 12.0.0, fixed in 12.0.3; from 11.0.0, fixed in 11.0.5; from 7.0.0, fixed in 11.0.5; from 12.0.0, fixed in 12.0.3.

  • CVE-2018-14635Medium 6.5

    When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address…

    Affected: fixed in 11.0.6; from 12.0.0, fixed in 12.0.4; from 13.0.0.0b1, fixed in 13.0.0.0b2; fixed in 11.0.6; from 12.0.0, fixed in 12.0.4.

  • CVE-2017-7543Medium 5.3

    A race-condition flaw was discovered in openstack-neutron before 7.2.0-12.1, 8.x before 8.3.0-11.1, 9.x before 9.3.1-2.1, and 10.x before…

    Affected: fixed in 7.2.0-12.1; from 8.0.0, fixed in 8.3.0-11.1; from 9.0.0, fixed in 9.3.1-2.1; from 10.0.0, fixed in 10.0.2-1.1; fixed in 7.2.0-12.1; from 8.0.0, fixed in 8.3.0-11.1; from 9.0.0, fixed in 9.3.1-2.1; from 10.0.0, fixed in 10.0.2-1.1.

Show all 21 advisoriesShow fewer advisories

  • The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended MAC-spoofing…

    Affected: fixed in 7.1.0; from 8.0.0, fixed in 8.1.0; fixed in 7.1.0; from 8.0.0, fixed in 8.1.0.

  • The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended…

    Affected: fixed in 7.0.5; from 8.0.0, fixed in 8.1.1; fixed in 7.0.5; from 8.0.0, fixed in 8.1.1.

  • The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended…

    Affected: fixed in 7.0.5; from 8.0.0, fixed in 8.1.1; fixed in 7.0.5; from 8.0.0, fixed in 8.1.1.

  • Race condition in OpenStack Neutron before 2014.2.4 and 2015.1 before 2015.1.2, when using the ML2 plugin or the security groups AMQP API…

    Affected: fixed in 7.0.0.

  • OpenStack Neutron before 2014.2.4 (juno) and 2015.1.x before 2015.1.1 (kilo), when using the IPTables firewall driver, allows remote…

    Affected: from 2000, fixed in 2014.2.4; from 2015.1.0, fixed in 2015.1.1; fixed in 2014.2.4; from 2015.1.0, fixed in 2015.1.1.

  • The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote…

    Affected: from 2012.2, fixed in 2013.2.3.