CVE-2023-3637 Openstack-neutron: unrestricted creation of security groups (fix for cve-2022-3277)
An authenticated user can cause denial of service by creating unconstrained security groups via invalid project queries in OpenStack Neutron.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-3637?
CVE-2023-3637 is a medium-severity denial of service vulnerability in Red Hat OpenStack Platform 13 (Queens) Operational Tools, published on 25 Jul 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.
Weakness: CWE-400
Which versions are affected by CVE-2023-3637?
3 open source packages ship an affected version, including neutron. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
neutron PyPI | All versions to 22.0.2 | None |
neutron PyPI | All versions to 22.0.2 | None |
neutron PyPI | All versions to 22.0.2 | None |
Linux distribution packages (10)
openstack-neutron Red Hat:openstack:16.2::el8 | All versions | 1:15.3.5-2.20230216175503.el8ost |
openstack-neutron-common Red Hat:openstack:16.2::el8 | All versions | 1:15.3.5-2.20230216175503.el8ost |
openstack-neutron-linuxbridge Red Hat:openstack:16.2::el8 | All versions | 1:15.3.5-2.20230216175503.el8ost |
openstack-neutron-macvtap-agent Red Hat:openstack:16.2::el8 | All versions | 1:15.3.5-2.20230216175503.el8ost |
openstack-neutron-metering-agent Red Hat:openstack:16.2::el8 | All versions | 1:15.3.5-2.20230216175503.el8ost |
openstack-neutron-ml2 Red Hat:openstack:16.2::el8 | All versions | 1:15.3.5-2.20230216175503.el8ost |
openstack-neutron-openvswitch Red Hat:openstack:16.2::el8 | All versions | 1:15.3.5-2.20230216175503.el8ost |
openstack-neutron-rpc-server Red Hat:openstack:16.2::el8 | All versions | 1:15.3.5-2.20230216175503.el8ost |
openstack-neutron-sriov-nic-agent Red Hat:openstack:16.2::el8 | All versions | 1:15.3.5-2.20230216175503.el8ost |
python3-neutron Red Hat:openstack:16.2::el8 | All versions | 1:15.3.5-2.20230216175503.el8ost |
Products include Redhat Openstack Platform.
How do I fix CVE-2023-3637?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-3637 being exploited?
There is no known exploitation of CVE-2023-3637 in the wild and no public exploit code.
Other vulnerabilities in Red Hat OpenStack Platform 13 (Queens) Operational Tools
- CVE-2020-10731 Misconfiguration in nova libvirt container provided by the Red Hat OpenStack Platform
- CVE-2024-8007 Openstack-tripleo-common: rhosp director disables tls verification for registry mirrors
- CVE-2017-15114 Missing authorization in n/a
- CVE-2022-3596 Instack-undercloud: rsync leaks information to undercloud
- CVE-2023-6725 Tripleo-ansible: bind keys are world readable
Sources
Also known as GHSA-r3jh-qhgj-gvr8, PYSEC-2026-1694, RHSA-2023:4283, UBUNTU-CVE-2023-3637.