CVE-2014-0056
First published: Thu May 08 2014(Updated: )
The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenStack Neutron | =2012.2 | |
| OpenStack Neutron | =2012.2.1 | |
| OpenStack Neutron | =2012.2.2 | |
| OpenStack Neutron | =2012.2.3 | |
| OpenStack Neutron | =2012.2.4 | |
| OpenStack Neutron | =2013.1 | |
| OpenStack Neutron | =2013.1.1 | |
| OpenStack Neutron | =2013.1.2 | |
| OpenStack Neutron | =2013.1.3 | |
| OpenStack Neutron | =2013.1.4 | |
| OpenStack Neutron | =2013.1.5 | |
| OpenStack Neutron | =2013.2 | |
| OpenStack Neutron | =2013.2.1 | |
| OpenStack Neutron | =2013.2.2 | |
| Ubuntu | =13.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2014-0056?
CVE-2014-0056 has been classified as a moderate severity vulnerability.
How do I fix CVE-2014-0056?
To fix CVE-2014-0056, upgrade OpenStack Neutron to a version that is later than 2013.2.3.
Who is affected by CVE-2014-0056?
CVE-2014-0056 affects OpenStack Neutron versions 2012.2 through 2013.2.2.
What type of vulnerability is CVE-2014-0056?
CVE-2014-0056 is a security vulnerability that involves insufficient tenant ID checks.
Can CVE-2014-0056 be exploited remotely?
Yes, CVE-2014-0056 can be exploited remotely by authenticated users to manipulate tenant resources.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/openstack
- canonical/openstack neutron
- version/openstack neutron/2012.2
- version/openstack neutron/2012.2.1
- version/openstack neutron/2012.2.2
- version/openstack neutron/2012.2.3
- version/openstack neutron/2012.2.4
- version/openstack neutron/2013.1
- version/openstack neutron/2013.1.1
- version/openstack neutron/2013.1.2
- version/openstack neutron/2013.1.3
- version/openstack neutron/2013.1.4
- version/openstack neutron/2013.1.5
- version/openstack neutron/2013.2
- version/openstack neutron/2013.2.1
- version/openstack neutron/2013.2.2
- vendor/canonical
- canonical/ubuntu
- version/ubuntu/13.10