CVE-2021-40797: Medium severity Openstack Neutron vulnerability
An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authenticated user may cause the API worker to consume increasing amounts of memory, resulting in API performance degradation or denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/neutronto a version that resolves this vulnerability.Fixed in 18.1.1 - Upgrade
Upgrade
pip/neutronto a version that resolves this vulnerability.Fixed in 17.2.1 - Upgrade
Upgrade
pip/neutronto a version that resolves this vulnerability.Fixed in 16.4.1
Event History
Frequently Asked Questions
What is the severity of CVE-2021-40797?
The severity of CVE-2021-40797 is medium with a CVSS score of 6.5.
Which versions of OpenStack Neutron are affected by CVE-2021-40797?
OpenStack Neutron versions before 16.4.1, between 17.0.0 and 17.2.1, and between 18.0.0 and 18.1.1 are affected by CVE-2021-40797.
What is the impact of CVE-2021-40797?
An authenticated user can cause the API worker to consume increasing amounts of memory, resulting in API performance degradation.
How can I mitigate CVE-2021-40797?
Update to OpenStack Neutron version 16.4.1 or later, 17.2.1 or later, or 18.1.1 or later to mitigate CVE-2021-40797.
Where can I find more information about CVE-2021-40797?
You can find more information about CVE-2021-40797 on the OpenStack Security Advisory (OSSA) page and the OpenWall mailing list.