CVE-2015-5240

CWE-362 — Race Condition9 documents7 sources
Severity
3.5LOW
EPSS
0.1%
top 67.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Openstack Neutron
Timeline
PublishedOct 27
Latest updateMay 17

Description

Race condition in OpenStack Neutron before 2014.2.4 and 2015.1 before 2015.1.2, when using the ML2 plugin or the security groups AMQP API, allows remote authenticated users to bypass IP anti-spoofing controls by changing the device owner of a port to start with network: before the security group rules are applied.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 6.8 | Impact: 2.9

Affected Packages3 packages

▶NVDopenstack/neutron2014.2.3, 2015.1.0, 2015.1.1+2
▶PyPIneutron< 7.0.0
▶Debianneutron< 1:7.0.0-1+3

🔴Vulnerability Details

4
OSV
OpenStack Neutron Race condition vulnerability↗2022-05-17
▶
GHSA
OpenStack Neutron Race condition vulnerability↗2022-05-17
▶
OSV
CVE-2015-5240: Race condition in OpenStack Neutron before 2014↗2015-10-27
▶
CVEList
CVE-2015-5240: Race condition in OpenStack Neutron before 2014↗2015-10-27
▶

📋Vendor Advisories

2
Red Hat
openstack-neutron: Firewall rules bypass through port update↗2015-09-08
▶
Debian
CVE-2015-5240: neutron - Race condition in OpenStack Neutron before 2014.2.4 and 2015.1 before 2015.1.2, ...↗2015
▶

💬Community

2
Bugzilla
CVE-2015-5240 openstack-neutron: Firewall rules bypass through port update [fedora-all]↗2015-09-09
▶
Bugzilla
CVE-2015-5240 openstack-neutron: Firewall rules bypass through port update↗2015-08-31
▶
CVE-2015-5240 (LOW CVSS 3.5) | Race condition in OpenStack Neutron | cvebase.io