Description
The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | neutron | 2013.2.2-4 | — |
| Debian 13 | neutron | 2013.2.2-4 | — |
| Debian 12 | neutron | 2013.2.2-4 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 4 | python-neutron +17 | 2013.2.3-7.el6ost | RHSA-2014:0516 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | neutron | >= 2012.2, < 2013.2.3 | 2013.2.3 | GHSA-72p9-6gc7-q93r |
Advisories 1
- RHSA-2014:0516 Red Hat Security Advisory: openstack-neutron security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 1, 2026
References
- [oss-security] 20140328 [OSSA 2014-008] Routers can be cross plugged by other tenants (CVE-2014-0056) mailing-list
- RHSA-2014:0516 vendor-advisory
- USN-2194-1 vendor-advisory
- https://bugs.launchpad.net/neutron/+bug/1243327