CVE-2014-0056
The MITRE CVE dictionary describes this issue as:
The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command.
Find out more about CVE-2014-0056 from the MITRE CVE dictionary dictionary and NIST NVD.
CVSS v2 metrics
| Base Score | 4.1 |
|---|---|
| Base Metrics | AV:A/AC:L/Au:S/C:P/I:P/A:N |
| Access Vector | Adjacent Network |
| Access Complexity | Low |
| Authentication | Single |
| Confidentiality Impact | Partial |
| Integrity Impact | Partial |
| Availability Impact | None |
Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).
Red Hat Security Errata
| Platform | Errata | Release Date |
|---|---|---|
| Red Hat Enterprise Linux OpenStack Platform 4.0 (openstack-neutron) | RHSA-2014:0516 | 2014-05-29 |
Affected Packages State
| Platform | Package | State |
|---|---|---|
| Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) | openstack-neutron | Not affected |
| Red Hat Enterprise Linux OpenStack Platform 3.0 | openstack-quantum | Will not fix |
Acknowledgements
Red Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges Aaron Rosen from VMware as the original reporter.CVE description copyright © 2017, The MITRE Corporation