CVE-2022-3277: Medium severity neutron vulnerability
An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.
Other sources
Upstream bug description: When a non-admin user tries to list security groups for projectid "None", Neutron creates a default security group for that project and returns an empty list to the caller.
To reproduce:
openstack --os-cloud devstack security group list --project None openstack --os-cloud devstack-admin security group list
The API call that is made is essentially
GET /networking/v2.0/security-groups?projectid=None
The expected result would be an authorization failure, since normal users should not be allowed to list security groups for other projects.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-3277?
CVE-2022-3277 is an uncontrolled resource consumption flaw in openstack-neutron that allows a remote authenticated user to query a list of security groups for an invalid project, creating resources unconstrained by the user's quota.
Is CVE-2022-3277 critical?
No, CVE-2022-3277 has a severity rating of medium.
How can I fix CVE-2022-3277?
To fix CVE-2022-3277, upgrade to a version of OpenStack Neutron or Redhat Openstack Platform that includes the necessary patches.
Which software versions are affected by CVE-2022-3277?
OpenStack Neutron versions up to 18.6.0, OpenStack Neutron versions between 19.0.0 and 19.5.0, Redhat Openstack Platform 13.0, 16.1, and 16.2 are affected by CVE-2022-3277.
Are there any references for CVE-2022-3277?
Yes, you can find references for CVE-2022-3277 at the following links: [Bugzilla Redhat](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2129211), [OpenDev Review](https://review.opendev.org/c/openstack/python-openstackclient/+/355405), [Redhat Errata](https://access.redhat.com/errata/RHSA-2022:8855).