CVE-2017-7543

Publication date 26 July 2018

Last updated 24 July 2024

Ubuntu priority

Cvss 3 Severity Score

A race-condition flaw was discovered in openstack-neutron before 7.2.0-12.1, 8.x before 8.3.0-11.1, 9.x before 9.3.1-2.1, and 10.x before 10.0.2-1.1, where, following a minor overcloud update, neutron security groups were disabled. Specifically, the following were reset to 0: net.bridge.bridge-nf-call-ip6tables and net.bridge.bridge-nf-call-iptables. The race was only triggered by an update, at which point an attacker could access exposed tenant VMs and network resources.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
neutron	17.04 zesty	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release

Notes

mdeslaur

per Debian, this is a Red Hat specific packaging issue

Severity score breakdown

Parameter	Value
Base score	5.9 · Medium
Attack vector	Network
Attack complexity	High
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	None
Availability impact	None
Vector	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N