CVE-2022-3277: Medium severity Openstack Neutron vulnerability
An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.
Other sources
Upstream bug description: When a non-admin user tries to list security groups for projectid "None", Neutron creates a default security group for that project and returns an empty list to the caller.
To reproduce:
openstack --os-cloud devstack security group list --project None openstack --os-cloud devstack-admin security group list
The API call that is made is essentially
GET /networking/v2.0/security-groups?projectid=None
The expected result would be an authorization failure, since normal users should not be allowed to list security groups for other projects.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/neutronto a version that resolves this vulnerability.Fixed in 20.3.0 - Upgrade
Upgrade
pip/neutronto a version that resolves this vulnerability.Fixed in 18.6.0 - Upgrade
Upgrade
pip/neutronto a version that resolves this vulnerability.Fixed in 19.5.0 - Upgrade
Upgrade
debian/neutronto a version that resolves this vulnerability.Fixed in 2:21.0.0-7Fixed in 2:21.0.0-7+deb12u1Fixed in 2:26.0.3-0+deb13u3Fixed in 2:29.0.0-9 - Upgrade
Upgrade
debian/neutronto a version that resolves this vulnerability.Fixed in 2:21.0.0~rc1-3
Event History
Frequently Asked Questions
What is CVE-2022-3277?
CVE-2022-3277 is an uncontrolled resource consumption flaw in openstack-neutron that allows a remote authenticated user to query a list of security groups for an invalid project, creating resources unconstrained by the user's quota.
Is CVE-2022-3277 critical?
No, CVE-2022-3277 has a severity rating of medium.
How can I fix CVE-2022-3277?
To fix CVE-2022-3277, upgrade to a version of OpenStack Neutron or Redhat Openstack Platform that includes the necessary patches.
Which software versions are affected by CVE-2022-3277?
OpenStack Neutron versions up to 18.6.0, OpenStack Neutron versions between 19.0.0 and 19.5.0, Redhat Openstack Platform 13.0, 16.1, and 16.2 are affected by CVE-2022-3277.
Are there any references for CVE-2022-3277?
Yes, you can find references for CVE-2022-3277 at the following links: [Bugzilla Redhat](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2129211), [OpenDev Review](https://review.opendev.org/c/openstack/python-openstackclient/+/355405), [Redhat Errata](https://access.redhat.com/errata/RHSA-2022:8855).