CVE-2015-3221
OpenStack Neutron before 2014.2.4 (juno) and 2015.1.x before 2015.1.1 (kilo), when using the IPTables firewall driver, allows remote authenticated users to cause a denial of service (L2 agent crash) by adding an address pair that is rejected by the…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 11.4%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
OpenStack Neutron before 2014.2.4 (juno) and 2015.1.x before 2015.1.1 (kilo), when using the IPTables firewall driver, allows remote authenticated users to cause a denial of service (L2 agent crash) by adding an address pair that is rejected by the ipset tool.
- CVSS 2.0
- 4.0 MEDIUMAV:N/AC:L/Au:S/C:N/I:N/A:P
- EPSS
- 11.43% probability · 96th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- openstack/neutron
- Source
- secalert@redhat.com
References
- http://lists.openstack.org/pipermail/openstack-announce/2015-June/000377.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1680.htmlVendor Advisory
- http://www.securityfocus.com/bid/75368Third Party Advisory, VDB Entry
- https://bugs.launchpad.net/neutron/+bug/1461054Third Party Advisory
- http://lists.openstack.org/pipermail/openstack-announce/2015-June/000377.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1680.htmlVendor Advisory
- http://www.securityfocus.com/bid/75368Third Party Advisory, VDB Entry
- https://bugs.launchpad.net/neutron/+bug/1461054Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.