CVE-2022-3277

2023-03-0600:00:00

ubuntu.com

openstack-neutron resource-consumption denial-of-service authentication-uncontrolled-user security-groups bug-fix cve-2022-3277.

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

46.7%

JSON

An uncontrolled resource consumption flaw was found in openstack-neutron.
This flaw allows a remote authenticated user to query a list of security
groups for an invalid project. This issue creates resources that are
unconstrained by the user’s quota. If a malicious user were to submit a
significant number of requests, this could lead to a denial of service.

Bugs

Notes

Author	Note
mdeslaur	This issue was fixed in (2:20.3.0-0ubuntu1) in jammy-proposed, and was later released to -security.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchneutron< 2:12.1.1-0ubuntu8.1UNKNOWN
ubuntu20.04noarchneutron< 2:16.4.2-0ubuntu6.2UNKNOWN
ubuntu22.04noarchneutron< 2:20.3.0-0ubuntu1.1UNKNOWN
ubuntu16.04noarchneutron< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	neutron	< 2:12.1.1-0ubuntu8.1	UNKNOWN
ubuntu	20.04	noarch	neutron	< 2:16.4.2-0ubuntu6.2	UNKNOWN
ubuntu	22.04	noarch	neutron	< 2:20.3.0-0ubuntu1.1	UNKNOWN
ubuntu	16.04	noarch	neutron	< any	UNKNOWN