CVE-2015-3221
published 2015-08-26CVE-2015-3221: OpenStack Neutron before 2014.2.4 (juno) and 2015.1.x before 2015.1.1 (kilo), when using the IPTables firewall driver, allows remote authenticated users to…
PriorityP423medium4CVSS 2.0
AVNACLAuSCNINAP
EXPLOIT
EPSS
11.34%
95.4th percentile
OpenStack Neutron before 2014.2.4 (juno) and 2015.1.x before 2015.1.1 (kilo), when using the IPTables firewall driver, allows remote authenticated users to cause a denial of service (L2 agent crash) by adding an address pair that is rejected by the ipset tool.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | neutron | < neutron 2015.1.0+2015.06.24.git61.bdf194a0e1-1 (bookworm) | neutron 2015.1.0+2015.06.24.git61.bdf194a0e1-1 (bookworm) |
| openstack | neutron | >= 0 < 2015.1.0+2015.06.24.git61.bdf194a0e1-1 | 2015.1.0+2015.06.24.git61.bdf194a0e1-1 |
| openstack | neutron | >= 0 < 2015.1.0+2015.06.24.git61.bdf194a0e1-1 | 2015.1.0+2015.06.24.git61.bdf194a0e1-1 |
| openstack | neutron | >= 0 < 2015.1.0+2015.06.24.git61.bdf194a0e1-1 | 2015.1.0+2015.06.24.git61.bdf194a0e1-1 |
| openstack | neutron | >= 0 < 2015.1.0+2015.06.24.git61.bdf194a0e1-1 | 2015.1.0+2015.06.24.git61.bdf194a0e1-1 |
| openstack | neutron | >= 0 < 2014.2.4 | 2014.2.4 |
| openstack | neutron | >= 2014.2 < 2014.2.4 | 2014.2.4 |
| openstack | neutron | >= 2015.1.0 < 2015.1.1 | 2015.1.1 |
| openstack | neutron | >= 2015.1.0 < 2015.1.1 | 2015.1.1 |
CVSS provenance
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:N/A:P
osv4.0MEDIUM
vendor_debian4.0MEDIUM
vendor_redhat4.0MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
OpenStack Neutron Improper Input Validation vulnerability
osv·2022-05-14
CVE-2015-3221 [MEDIUM] OpenStack Neutron Improper Input Validation vulnerability
OpenStack Neutron Improper Input Validation vulnerability
OpenStack Neutron before 2014.2.4 (juno) and 2015.1.x before 2015.1.1 (kilo), when using the IPTables firewall driver, allows remote authenticated users to cause a denial of service (L2 agent crash) by adding an address pair that is rejected by the ipset tool.
GHSA
OpenStack Neutron Improper Input Validation vulnerability
ghsa·2022-05-14
CVE-2015-3221 [MEDIUM] CWE-20 OpenStack Neutron Improper Input Validation vulnerability
OpenStack Neutron Improper Input Validation vulnerability
OpenStack Neutron before 2014.2.4 (juno) and 2015.1.x before 2015.1.1 (kilo), when using the IPTables firewall driver, allows remote authenticated users to cause a denial of service (L2 agent crash) by adding an address pair that is rejected by the ipset tool.
OSV
CVE-2015-3221: OpenStack Neutron before 2014
osv·2015-08-26·CVSS 4.0
CVE-2015-3221 [MEDIUM] CVE-2015-3221: OpenStack Neutron before 2014
OpenStack Neutron before 2014.2.4 (juno) and 2015.1.x before 2015.1.1 (kilo), when using the IPTables firewall driver, allows remote authenticated users to cause a denial of service (L2 agent crash) by adding an address pair that is rejected by the ipset tool.
Red Hat
openstack-neutron: L2 agent DoS through incorrect allowed address pairs
vendor_redhat·2015-06-23·CVSS 4.0
CVE-2015-3221 [MEDIUM] CWE-248 openstack-neutron: L2 agent DoS through incorrect allowed address pairs
openstack-neutron: L2 agent DoS through incorrect allowed address pairs
OpenStack Neutron before 2014.2.4 (juno) and 2015.1.x before 2015.1.1 (kilo), when using the IPTables firewall driver, allows remote authenticated users to cause a denial of service (L2 agent crash) by adding an address pair that is rejected by the ipset tool.
A Denial-of-Service flaw was found in the OpenStack Networking (neutron) L2 agent when using the iptables firewall driver. By submitting an address pair that is rejected as invalid by the ipset tool (with zero prefix size), an authenticated attacker can cause the L2 agent to crash.
Package: openstack-neutron (Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse)) - Not affected
Package: openstack-neutron (Red Hat Enterprise Linux OpenStack Platform 7 (Kilo
Debian
CVE-2015-3221: neutron - OpenStack Neutron before 2014.2.4 (juno) and 2015.1.x before 2015.1.1 (kilo), wh...
vendor_debian·2015·CVSS 4.0
CVE-2015-3221 [MEDIUM] CVE-2015-3221: neutron - OpenStack Neutron before 2014.2.4 (juno) and 2015.1.x before 2015.1.1 (kilo), wh...
OpenStack Neutron before 2014.2.4 (juno) and 2015.1.x before 2015.1.1 (kilo), when using the IPTables firewall driver, allows remote authenticated users to cause a denial of service (L2 agent crash) by adding an address pair that is rejected by the ipset tool.
Scope: local
bookworm: resolved (fixed in 2015.1.0+2015.06.24.git61.bdf194a0e1-1)
bullseye: resolved (fixed in 2015.1.0+2015.06.24.git61.bdf194a0e1-1)
forky: resolved (fixed in 2015.1.0+2015.06.24.git61.bdf194a0e1-1)
sid: resolved (fixed in 2015.1.0+2015.06.24.git61.bdf194a0e1-1)
trixie: resolved (fixed in 2015.1.0+2015.06.24.git61.bdf194a0e1-1)
No detection rules found.
Bugzilla
CVE-2015-3221 openstack-neutron: L2 agent DoS through incorrect allowed address pairs [fedora-all]
bugzilla·2015-07-06·CVSS 4.0
CVE-2015-3221 [MEDIUM] CVE-2015-3221 openstack-neutron: L2 agent DoS through incorrect allowed address pairs [fedora-all]
CVE-2015-3221 openstack-neutron: L2 agent DoS through incorrect allowed address pairs [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple s
Bugzilla
CVE-2015-3221 openstack-neutron: L2 agent DoS through incorrect allowed address pairs
bugzilla·2015-06-16·CVSS 4.0
CVE-2015-3221 [MEDIUM] CVE-2015-3221 openstack-neutron: L2 agent DoS through incorrect allowed address pairs
CVE-2015-3221 openstack-neutron: L2 agent DoS through incorrect allowed address pairs
Title: Neutron L2 agent DoS through incorrect allowed address pairs
Reporter: Darragh O'Reilly (HP)
Products: Neutron
Affects: 2014.2 versions through 2014.2.3 and 2015.1.0 version
Description:
Darragh O'Reilly from HP reported a vulnerability in Neutron. By adding
an address pair which is rejected as invalid by the ipset tool, an
authenticated user may crash the Neutron L2 agent resulting in a denial
of service attack. Neutron setups using the IPTables firewall driver are
affected.
Acknowledgements:
Red Hat would like to thank the OpenStack upstream for reporting this issue. Upstream acknowledges Darragh O'Reilly (HP) as the original reporter.
Discussion:
Created attachment 1040537
cve-2015-3221-ma
http://lists.openstack.org/pipermail/openstack-announce/2015-June/000377.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1680.htmlhttp://www.securityfocus.com/bid/75368https://bugs.launchpad.net/neutron/+bug/1461054http://lists.openstack.org/pipermail/openstack-announce/2015-June/000377.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1680.htmlhttp://www.securityfocus.com/bid/75368https://bugs.launchpad.net/neutron/+bug/1461054
2015-08-26
Published