Description
OpenStack Neutron before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (crash) via a crafted dns_nameservers value in the DNS configuration.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | neutron | 2014.1.3-6 | — |
| Debian 13 | neutron | 2014.1.3-6 | — |
| Debian 12 | neutron | 2014.1.3-6 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 5 | python-neutron +22 | 2014.1.3-11.el7ost | RHSA-2014:1942, RHSA-2014:1938 |
| Red Hat OpenStack 4 | python-neutron +17 | 2013.2.4-6.el6ost | RHSA-2015:0044 |
Advisories 3
- RHSA-2015:0044 Red Hat Security Advisory: openstack-neutron security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2014:1938 Red Hat Security Advisory: openstack-neutron security and bug fix update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2014:1942 Red Hat Security Advisory: openstack-neutron security and bug fix update Red Hat Security Advisories (RHSA) · Aug 1, 2026
References
- RHSA-2014:1938 vendor-advisory
- neutron-cve20147821-dos(98818) vdb-entry
- RHSA-2015:0044 vendor-advisory
- FEDORA-2015-5997 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
- [openstack-announce] 20141119 [OSSA 2014-039] Neutron DoS through invalid DNS configuration (CVE-2014-7821) mailing-list
- RHSA-2014:1942 vendor-advisory
- 62586 third-party-advisory
- https://bugs.launchpad.net/neutron/+bug/1378450