Description
When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address, bypassing IP address validation. A potential denial of service could occur if an IP address, conflicting with existing guests or routers, is then assigned from outside of the allowed allocation pool. Versions of openstack-neutron before 13.0.0.0b2, 12.0.3 and 11.0.5 are vulnerable.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| The Openstack Project | openstack-neutron | 13.0.0.0b2, 12.0.3, 11.0.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | neutron | 2:13.0.0-1 | — |
| Debian 13 | neutron | 2:13.0.0-1 | — |
| Debian 12 | neutron | 2:13.0.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | neutron | 2:12.0.3-0ubuntu1 | — |
| Ubuntu 16.04 LTS | neutron | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 13 | python-neutron +9 | 1:12.0.3-5.el7ost | RHSA-2018:2710 |
| Red Hat OpenStack 12 | python-neutron +10 | 1:11.0.4-6.el7ost | RHSA-2018:3792 |
| Red Hat OpenStack 10 | python-neutron +10 | 1:9.4.1-28.el7ost | RHSA-2018:2715 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | neutron | >= 13.0.0.0b1, < 13.0.0.0b2 | 13.0.0.0b2 | GHSA-x634-34m9-96mp |
| PyPI | neutron | < 11.0.6 | 11.0.6 | GHSA-x634-34m9-96mp |
| PyPI | neutron | >= 12.0.0, < 12.0.4 | 12.0.4 | GHSA-x634-34m9-96mp |
| PyPI | neutron | < 11.0.6 · >= 12.0.0, < 12.0.4 | 11.0.6, 12.0.4 | PYSEC-2018-93 |
Advisories 3
- RHSA-2018:3792 Red Hat Security Advisory: openstack-neutron security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2018:2715 Red Hat Security Advisory: openstack-neutron security and bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2018:2710 Red Hat Security Advisory: openstack-neutron security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- RHSA-2018:2710 vendor-advisory
- RHSA-2018:2715 vendor-advisory
- https://bugs.launchpad.net/neutron/+bug/1757482
- RHSA-2018:2721 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14635
- RHSA-2018:3792 vendor-advisory
- https://git.openstack.org/cgit/openstack/neutron/commit/?id=54aa6e81cb17b33ce4d5d469cc11dec2869c762d