CVE-2021-40797
First published: Wed Sep 08 2021(Updated: )
An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authenticated user may cause the API worker to consume increasing amounts of memory, resulting in API performance degradation or denial of service.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenStack Neutron | <16.4.1 | |
| OpenStack Neutron | >=17.0.0<17.2.1 | |
| OpenStack Neutron | >=18.0.0<18.1.1 | |
| pip/neutron | >=18.0.0<18.1.1 | 18.1.1 |
| pip/neutron | >=17.0.0<17.2.1 | 17.2.1 |
| pip/neutron | <16.4.1 | 16.4.1 |
| <16.4.1 | ||
| >=17.0.0<17.2.1 | ||
| >=18.0.0<18.1.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2021/09/09/2
- https://launchpad.net/bugs/1942179
- https://security.openstack.org/ossa/OSSA-2021-006.html
- https://nvd.nist.gov/vuln/detail/CVE-2021-40797
- https://github.com/openstack/neutron/commit/e610a5eb9e71aa2549fb11e2139370d227787da2
- https://github.com/advisories/GHSA-cpx3-696p-3cw9 (Advisory)
- https://github.com/pypa/advisory-database/tree/main/vulns/neutron/PYSEC-2021-329.yaml
Frequently Asked Questions
What is the severity of CVE-2021-40797?
The severity of CVE-2021-40797 is medium with a CVSS score of 6.5.
Which versions of OpenStack Neutron are affected by CVE-2021-40797?
OpenStack Neutron versions before 16.4.1, between 17.0.0 and 17.2.1, and between 18.0.0 and 18.1.1 are affected by CVE-2021-40797.
What is the impact of CVE-2021-40797?
An authenticated user can cause the API worker to consume increasing amounts of memory, resulting in API performance degradation.
How can I mitigate CVE-2021-40797?
Update to OpenStack Neutron version 16.4.1 or later, 17.2.1 or later, or 18.1.1 or later to mitigate CVE-2021-40797.
Where can I find more information about CVE-2021-40797?
You can find more information about CVE-2021-40797 on the OpenStack Security Advisory (OSSA) page and the OpenWall mailing list.
- collector/nvd-index
- agent/type
- agent/remedy
- agent/severity
- agent/weakness
- agent/description
- agent/author
- agent/softwarecombine
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- agent/event
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-cpx3-696p-3cw9
- alias/CVE-2021-40797
- agent/references
- agent/last-modified-date
- agent/tags
- collector/github-advisory
- agent/trending
- vendor/openstack
- canonical/openstack neutron
- version/openstack neutron/17.0.0
- version/openstack neutron/18.0.0
- package-manager/pip