Description
OpenStack Neutron before 2014.2.4 and 2014.1 before 2014.1.2 allows remote authenticated users to set admin network attributes to default values via unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | neutron | 2014.1.3-1 | — |
| Debian 13 | neutron | 2014.1.3-1 | — |
| Debian 12 | neutron | 2014.1.3-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | neutron | 1:2014.1.3-0ubuntu1.1 | USN-2408-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 5 | python-neutron +22 | 2014.1.3-7.el7ost | RHSA-2014:1786, RHSA-2014:1785 |
| Red Hat OpenStack 5 | python-neutronclient | 2.3.4-3.el6ost | RHSA-2014:1786, RHSA-2014:1785 |
| Red Hat OpenStack 4 | python-neutron +17 | 2013.2.4-5.el6ost | RHSA-2014:1686 |
Advisories 4
- RHSA-2014:1786 Red Hat Security Advisory: openstack-neutron security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2014:1785 Red Hat Security Advisory: openstack-neutron security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2014:1686 Red Hat Security Advisory: openstack-neutron security and bug fix update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- USN-2408-1 neutron vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
References
- https://bugs.launchpad.net/neutron/+bug/1357379
- [oss-security] 20140916 CVE request for vulnerability in OpenStack Neutron mailing-list
- RHSA-2014:1686 vendor-advisory
- RHSA-2014:1786 vendor-advisory
- RHSA-2014:1785 vendor-advisory
- USN-2408-1 vendor-advisory
- 62299 third-party-advisory