CVE-2023-3637
Fixed in a distro release EPSS 1%CVSS 4.3
An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.
Products: Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 13 (Queens) Operational Tools, Red Hat OpenStack Platform 16.1, Red Hat OpenStack Platform 17.0, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | neutron | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat openstack 16.2 | openstack-neutron | 1:15.3.5-2.20230216175503.el8ost |
| Red Hat openstack 16.2 | openstack-neutron-common | 1:15.3.5-2.20230216175503.el8ost |
| Red Hat openstack 16.2 | openstack-neutron-linuxbridge | 1:15.3.5-2.20230216175503.el8ost |
| Red Hat openstack 16.2 | openstack-neutron-macvtap-agent | 1:15.3.5-2.20230216175503.el8ost |
| Red Hat openstack 16.2 | openstack-neutron-metering-agent | 1:15.3.5-2.20230216175503.el8ost |
| Red Hat openstack 16.2 | openstack-neutron-ml2 | 1:15.3.5-2.20230216175503.el8ost |
| Red Hat openstack 16.2 | openstack-neutron-openvswitch | 1:15.3.5-2.20230216175503.el8ost |
| Red Hat openstack 16.2 | openstack-neutron-rpc-server | 1:15.3.5-2.20230216175503.el8ost |
| Red Hat openstack 16.2 | openstack-neutron-sriov-nic-agent | 1:15.3.5-2.20230216175503.el8ost |
| Red Hat openstack 16.2 | python3-neutron | 1:15.3.5-2.20230216175503.el8ost |
| Ubuntu 16.04 LTS | neutron | no fix |
| Ubuntu 18.04 LTS | neutron | no fix |
| Ubuntu 20.04 LTS | neutron | no fix |
| Ubuntu 22.04 LTS | neutron | no fix |
| Ubuntu 24.04 LTS | neutron | no fix |
| Ubuntu 25.10 | neutron | no fix |
| Ubuntu 26.04 LTS | neutron | no fix |
| Ubuntu 26.10 | neutron | no fix |