CVE-2014-0056

Publication date 1 April 2014

Last updated 24 July 2024

Ubuntu priority

The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
neutron	14.04 LTS trusty	Not in release
	13.10 saucy	Fixed 1:2013.2.3-0ubuntu1.1
	12.10 quantal	Not in release
	12.04 LTS precise	Not in release
	10.04 LTS lucid	Not in release

How can I get the fixes?
What do statuses mean?

Notes

jdstrand

fixed in 1:2013.2.3-0ubuntu1. Needs a rebuild for saucy-security

References

MITRE
NVD
Launchpad
Debian

Related Ubuntu Security Notices (USN)

USN-2194-1
OpenStack Neutron vulnerability
5 May 2014

Other references

https://www.cve.org/CVERecord?id=CVE-2014-0056