CVE-2014-0056: Low severity Openstack Neutron vulnerability
Published May 8, 2014
·Updated
The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command.
Affected Software
15 affected components
Openstack Neutron=2012.2
Openstack Neutron=2012.2.1
Openstack Neutron=2012.2.2
Openstack Neutron=2012.2.3
Openstack Neutron=2012.2.4
Openstack Neutron=2013.1
Openstack Neutron=2013.1.1
Openstack Neutron=2013.1.2
Openstack Neutron=2013.1.3
Openstack Neutron=2013.1.4
Openstack Neutron=2013.1.5
Openstack Neutron=2013.2
Openstack Neutron=2013.2.1
Openstack Neutron=2013.2.2
Canonical Ubuntu Linux=13.10
Event History
May 8, 2014
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Data Sourced
via NVD·02:29 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-0056?
CVE-2014-0056 has been classified as a moderate severity vulnerability.
2
How do I fix CVE-2014-0056?
To fix CVE-2014-0056, upgrade OpenStack Neutron to a version that is later than 2013.2.3.
3
Who is affected by CVE-2014-0056?
CVE-2014-0056 affects OpenStack Neutron versions 2012.2 through 2013.2.2.
4
What type of vulnerability is CVE-2014-0056?
CVE-2014-0056 is a security vulnerability that involves insufficient tenant ID checks.
5
Can CVE-2014-0056 be exploited remotely?
Yes, CVE-2014-0056 can be exploited remotely by authenticated users to manipulate tenant resources.