CVE-2021-40797
Fixed in a distro release EPSS 2%
An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authenticated user may cause the API worker to consume increasing amounts of memory, resulting in API performance degradation or denial of service.
Products: openstack neutron
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | neutron | 16.4.1 |
| PyPI | neutron | 17.2.1 |
| PyPI | neutron | 18.1.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | neutron | 2:19.0.0-1 |
| Debian 13 | neutron | 2:19.0.0-1 |
| Debian 14 | neutron | 2:19.0.0-1 |
| Red Hat openstack 16.1 | openstack-neutron | 1:15.2.1-1.20220112133420.el8ost |
| Red Hat openstack 16.1 | openstack-neutron-common | 1:15.2.1-1.20220112133420.el8ost |
| Red Hat openstack 16.1 | openstack-neutron-linuxbridge | 1:15.2.1-1.20220112133420.el8ost |
| Red Hat openstack 16.1 | openstack-neutron-macvtap-agent | 1:15.2.1-1.20220112133420.el8ost |
| Red Hat openstack 16.1 | openstack-neutron-metering-agent | 1:15.2.1-1.20220112133420.el8ost |
| Red Hat openstack 16.1 | openstack-neutron-ml2 | 1:15.2.1-1.20220112133420.el8ost |
| Red Hat openstack 16.1 | openstack-neutron-openvswitch | 1:15.2.1-1.20220112133420.el8ost |
| Red Hat openstack 16.1 | openstack-neutron-rpc-server | 1:15.2.1-1.20220112133420.el8ost |
| Red Hat openstack 16.1 | openstack-neutron-sriov-nic-agent | 1:15.2.1-1.20220112133420.el8ost |
| Red Hat openstack 16.1 | python3-neutron | 1:15.2.1-1.20220112133420.el8ost |
| Red Hat openstack 16.2 | openstack-neutron | 1:15.3.5-2.20220113150031.el8ost |
| Red Hat openstack 16.2 | openstack-neutron-common | 1:15.3.5-2.20220113150031.el8ost |
| Red Hat openstack 16.2 | openstack-neutron-linuxbridge | 1:15.3.5-2.20220113150031.el8ost |
| Red Hat openstack 16.2 | openstack-neutron-macvtap-agent | 1:15.3.5-2.20220113150031.el8ost |
| Red Hat openstack 16.2 | openstack-neutron-metering-agent | 1:15.3.5-2.20220113150031.el8ost |
| Red Hat openstack 16.2 | openstack-neutron-ml2 | 1:15.3.5-2.20220113150031.el8ost |
| Red Hat openstack 16.2 | openstack-neutron-openvswitch | 1:15.3.5-2.20220113150031.el8ost |
| Red Hat openstack 16.2 | openstack-neutron-rpc-server | 1:15.3.5-2.20220113150031.el8ost |
| Red Hat openstack 16.2 | openstack-neutron-sriov-nic-agent | 1:15.3.5-2.20220113150031.el8ost |
| Red Hat openstack 16.2 | python3-neutron | 1:15.3.5-2.20220113150031.el8ost |
| SUSE HPE Helion OpenStack 8 | openstack-neutron | 11.0.9~dev69-3.43.1 |
| SUSE HPE Helion OpenStack 8 | openstack-neutron-doc | 11.0.9~dev69-3.43.1 |
| SUSE OpenStack Cloud 8 | openstack-neutron | 11.0.9~dev69-3.43.1 |
| SUSE OpenStack Cloud 8 | openstack-neutron-doc | 11.0.9~dev69-3.43.1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-neutron | 11.0.9~dev69-3.43.1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-neutron-doc | 11.0.9~dev69-3.43.1 |
| Ubuntu 16.04 LTS | neutron | no fix |
| Ubuntu 18.04 LTS | neutron | 2:12.1.1-0ubuntu8.1 |
| Ubuntu 20.04 LTS | neutron | 2:16.4.2-0ubuntu6.2 |
| Ubuntu 22.04 LTS | neutron | 2:20.3.0-0ubuntu1.1 |