Vulnerability Details : CVE-2014-0187
The openvswitch-agent process in OpenStack Neutron 2013.1 before 2013.2.4 and 2014.1 before 2014.1.1 allows remote authenticated users to bypass security group restrictions via an invalid CIDR in a security group rule, which prevents further rules from being applied.
Products affected by CVE-2014-0187
- cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
- cpe:2.3:a:openstack:neutron:2013.2:*:*:*:*:*:*:*
- cpe:2.3:a:openstack:neutron:2013.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:openstack:neutron:2013.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:openstack:neutron:2013.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:openstack:neutron:2013.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:openstack:neutron:2013.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:openstack:neutron:2013.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:openstack:neutron:2013.1:*:*:*:*:*:*:*
- cpe:2.3:a:openstack:neutron:2013.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:openstack:neutron:2013.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:openstack:neutron:2014.1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2014-0187
0.28%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 64 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-0187
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.0
|
HIGH | AV:N/AC:L/Au:S/C:C/I:C/A:C |
8.0
|
10.0
|
NIST |
CWE ids for CVE-2014-0187
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-0187
-
http://lists.opensuse.org/opensuse-updates/2014-08/msg00035.html
openSUSE-SU-2014:1051-1: moderate: - Update to version neutron-2013.2.4.
-
http://www.openwall.com/lists/oss-security/2014/04/22/8
oss-security - [OSSA 2014-014] Neutron security groups bypass through invalid CIDR (CVE-2014-0187)
-
https://bugs.launchpad.net/neutron/+bug/1300785
Bug #1300785 “[OSSA 2014-014] neutron allows security group rule...” : Bugs : neutronVendor Advisory
-
http://www.ubuntu.com/usn/USN-2255-1
USN-2255-1: OpenStack Neutron vulnerabilities | Ubuntu security notices
Jump to