Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 1 articles for you...
100
security advisoryimportantmemory leakSUSE OpenStack Cloud 8: 2022:1884-1 Important Memory Leak Fix
An update that fixes two vulnerabilities is now available. . SUSE Security Update: Security update for openstack-neutron ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1884-1 Rating: important References: #1189794 #1190339 Cross-References: CVE-2021-40085 CVE-2021-40797 CVSS scores: CVE-2021-40085 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVE-2021-40085 (SUSE): 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-40797 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: HPE Helion Openstack 8 SUSE OpenStack Cloud 8 SUSE OpenStack Cloud Crowbar 8 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for openstack-neutron fixes the following issues: - CVE-2021-40797: Fixed routes middleware memory leak for nonexistent controllers (bsc#1190339). - CVE-2021-40085: Fixed arbitrary dnsmasq reconfiguration via extra_dhcp_opts (bsc#1189794). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud Crowbar 8: zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-8-2022-1884=1 - SUSE OpenStack Cloud 8: zypper in -t patch SUSE-OpenStack-Cloud-8-2022-1884=1 - HPE Helion Openstack 8: zypper in -t patch HPE-Helion-OpenStack-8-2022-1884=1 Package List: - SUSE OpenStack Cloud Crowbar 8 (noarch): openstack-neutron-11.0.9~dev69-3.43.1 openstack-neutron-dhcp-agent-11.0.9~dev69-3.43.1 openstack-neutron-doc-11.0.9~dev69-3.43.1 openstack-neutron-ha-tool-11.0.9~dev69-3.43.1 openstack-neutron-l3-agent-11.0.9~dev69-3.43.1 openstack-neutron-linuxbridge-agent-11.0.9~dev69-3.43.1 openstack-neutron-macvtap-agent-11.0.9~dev69-3.43.1 openstack-neutron-metadata-agent-11.0.9~dev69-3.43.1 openstack-neutron-metering-agent-11.0.9~dev69-3.43.1 openstack-neutron-openvswitch-agent-11.0.9~dev69-3.43.1 openstack-neutron-server-11.0.9~dev69-3.43.1 python-neutron-11.0.9~dev69-3.43.1 - SUSE OpenStack Cloud 8 (noarch): openstack-neutron-11.0.9~dev69-3.43.1 openstack-neutron-dhcp-agent-11.0.9~dev69-3.43.1 openstack-neutron-doc-11.0.9~dev69-3.43.1 openstack-neutron-ha-tool-11.0.9~dev69-3.43.1 openstack-neutron-l3-agent-11.0.9~dev69-3.43.1 openstack-neutron-linuxbridge-agent-11.0.9~dev69-3.43.1 openstack-neutron-macvtap-agent-11.0.9~dev69-3.43.1 openstack-neutron-metadata-agent-11.0.9~dev69-3.43.1 openstack-neutron-metering-agent-11.0.9~dev69-3.43.1 openstack-neutron-openvswitch-agent-11.0.9~dev69-3.43.1 openstack-neutron-server-11.0.9~dev69-3.43.1 python-neutron-11.0.9~dev69-3.43.1 - HPE Helion Openstack 8 (noarch): openstack-neutron-11.0.9~dev69-3.43.1 openstack-neutron-dhcp-agent-11.0.9~dev69-3.43.1 openstack-neutron-doc-11.0.9~dev69-3.43.1 openstack-neutron-ha-tool-11.0.9~dev69-3.43.1 openstack-neutron-l3-agent-11.0.9~dev69-3.43.1 openstack-neutron-linuxbridge-agent-11.0.9~dev69-3.43.1 openstack-neutron-macvtap-agent-11.0.9~dev69-3.43.1 openstack-neutron-metadata-agent-11.0.9~dev69-3.43.1 openstack-neutron-metering-agent-11.0.9~dev69-3.43.1 openstack-neutron-openvswitch-agent-11.0.9~dev69-3.43.1 openstack-neutron-server-11.0.9~dev69-3.43.1 python-neutron-11.0.9~dev69-3.43.1 References: https://www.suse.com/security/cve/CVE-2021-40085.html https://www.suse.com/security/cve/CVE-2021-40797.html https://bugzilla.suse.com/1189794 https://bugzilla.suse.com/1190339 . Critical SUSE patch foropenstack-neutron resolves RAM drain and dnsmasq bugs. Make sure to deploy the fix without delay.. OpenStack Neutron, Linux Patch, SUSE Update, Memory Leak, DNS Configuration. . Severity: Important. LinuxSecurity.com Team
May 31, 2022
•Important
SuSE
197
security advisorymoderatesecurity updateDebian 9 Stretch: DLA-3027-1 Moderate: Neutron Security Fix for DoS
It was discovered that the previous upload to neutron to Debian 9 "Stretch" (ie. version 2:9.1.1-3+deb9u2) was incomplete and did not actually apply the fix for CVE-2021-40085. . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3027-1
May 26, 2022
Debian LTS
87
security advisorycriticaldebianDebian 10/11: DSA-4983-1 Critical Neutron Dnsmasq Security Issue
Pavel Toporkov discovered a vulnerability in Neutron, the OpenStack virtual network service, which allowed a reconfiguration of dnsmasq via crafted dhcp_extra_opts parameters. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-4983-1
Oct 10, 2021
•Critical
Debian
172
security advisorysecurity issuesystem hardeningUbuntu: 4036-1 Moderate Risk of Neutron Security Bypass Error
A system hardening measure could be bypassed.. =========================================================================Ubuntu Security Notice USN-4036-1 June 25, 2019 neutron vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.10 - Ubuntu 16.04 LTS Summary: A system hardening measure could be bypassed. Software Description: - neutron: OpenStack Virtual Network Service Details: Erik Olof Gunnar Andersson discovered that OpenStack Neutron incorrectly handled certain security group rules in the iptables firewall module. An authenticated attacker could possibly use this issue to block further application of security group rules for other instances. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.10: python-neutron 2:13.0.2-0ubuntu3.4 python3-neutron 2:13.0.2-0ubuntu3.4 Ubuntu 16.04 LTS: python-neutron 2:8.4.0-0ubuntu7.4 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-4036-1 CVE-2019-9735 Package Information: https://launchpad.net/ubuntu/+source/neutron/2:13.0.2-0ubuntu3.4 https://launchpad.net/ubuntu/+source/neutron/2:8.4.0-0ubuntu7.4 . Ubuntu Security Advisory USN-4036-1 outlines a weakness in neutron that permits authenticated users to circumvent security protocols.. OpenStack Vulnerability, Ubuntu Security, Neutron Attack. . LinuxSecurity.com Team
Jun 25, 2019
Ubuntu
87
security advisorydenial of servicedebianDebian: DSA-4409-1 Moderate: Neutron Denial Of Service Exposure
Erik Olof Gunnar Andersson discovered that incorrect validation of port settings in the iptables security group driver of Neutron, the OpenStack virtual network service, could result in denial of service in a multi tenant setup. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-4409-1
Mar 18, 2019
Debian
98
security advisoryred hatbug fixRed Hat 7.0: RHSA-2016:1474-01 Low: OpenStack-Neutron Risk
An update for openstack-neutron is now available for Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Low: openstack-neutron security, bug fix, and enhancement update Advisory ID: RHSA-2016:1474-01 Product: Red Hat Enterprise Linux OpenStack Platform Advisory URL: https://access.redhat.com/errata/RHSA-2016:1474 Issue date: 2016-07-20 CVE Names: CVE-2015-8914 CVE-2016-5362 CVE-2016-5363 ==================================================================== 1. Summary: An update for openstack-neutron is now available for Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 - noarch 3. Description: OpenStack Networking (neutron) is a pluggable, scalable, and API-driven system that provisions networking services to virtual machines. Its main function is to manage connectivity to and from virtual machines. The following packages have been upgraded to a newer upstream version: openstack-neutron Security Fix(es): * Neutron functionality includes internal firewall management between networks. Due to the relaxed nature of particular rules, it is possible for machines on the same layer 2 networks to forge non-IP traffic, such as ARP and DHCP requests. (CVE-2015-8914, CVE-2016-5362, CVE-2016-5363) 4. Solution: For details on how to apply this update, which includesthe changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1311864 - Neutron L3 Agent shows duplicate ports 1345889 - CVE-2016-5362 openstack-neutron: DHCP spoofing vulnerability 1345891 - CVE-2016-5363 openstack-neutron: MAC source address spoofing vulnerability 1345892 - CVE-2015-8914 openstack-neutron: ICMPv6 source address spoofing vulnerability 1347428 - neutron-meter-agent - makes traffic between internal networks NATed 1350400 - Rebase openstack-neutron to 2015.1.4 6. Package List: Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL7: Source: openstack-neutron-2015.1.4-2.el7ost.src.rpm noarch: openstack-neutron-2015.1.4-2.el7ost.noarch.rpm openstack-neutron-bigswitch-2015.1.4-2.el7ost.noarch.rpm openstack-neutron-brocade-2015.1.4-2.el7ost.noarch.rpm openstack-neutron-cisco-2015.1.4-2.el7ost.noarch.rpm openstack-neutron-common-2015.1.4-2.el7ost.noarch.rpm openstack-neutron-embrane-2015.1.4-2.el7ost.noarch.rpm openstack-neutron-ibm-2015.1.4-2.el7ost.noarch.rpm openstack-neutron-linuxbridge-2015.1.4-2.el7ost.noarch.rpm openstack-neutron-mellanox-2015.1.4-2.el7ost.noarch.rpm openstack-neutron-metaplugin-2015.1.4-2.el7ost.noarch.rpm openstack-neutron-metering-agent-2015.1.4-2.el7ost.noarch.rpm openstack-neutron-midonet-2015.1.4-2.el7ost.noarch.rpm openstack-neutron-ml2-2015.1.4-2.el7ost.noarch.rpm openstack-neutron-nec-2015.1.4-2.el7ost.noarch.rpm openstack-neutron-nuage-2015.1.4-2.el7ost.noarch.rpm openstack-neutron-ofagent-2015.1.4-2.el7ost.noarch.rpm openstack-neutron-oneconvergence-nvsd-2015.1.4-2.el7ost.noarch.rpm openstack-neutron-opencontrail-2015.1.4-2.el7ost.noarch.rpm openstack-neutron-openvswitch-2015.1.4-2.el7ost.noarch.rpm openstack-neutron-ovsvapp-2015.1.4-2.el7ost.noarch.rpm openstack-neutron-plumgrid-2015.1.4-2.el7ost.noarch.rpm openstack-neutron-sriov-nic-agent-2015.1.4-2.el7ost.noarch.rpm openstack-neutron-vmware-2015.1.4-2.el7ost.noarch.rpm python-neutron-2015.1.4-2.el7ost.noarch.rpm python-neutron-tests-2015.1.4-2.el7ost.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2015-8914 https://access.redhat.com/security/cve/CVE-2016-5362 https://access.redhat.com/security/cve/CVE-2016-5363 https://access.redhat.com/security/updates/classification#low 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version:GnuPG v1 iD8DBQFXkBg5XlSAg2UNWIIRAq/gAJ9T5I7X+hD08u8CdAPArBMYg1cykACfZRdB XFm5cqHHPC4R7TcwtCdR+dg=J2xH -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list
Jul 21, 2016
•Low
Red Hat
98
security advisorymoderatered hatModerate: OpenStack Neutron DoS Vulnerability in RHEL OpenStack 6.0
Updated openstack-neutron packages that fix one security issue are now available for Red Hat Enterprise Linux OpenStack Platform 6.0 Red Hat Product Security has rated this update as having a Moderate [More...]. ==================================================================== Red Hat Security Advisory Synopsis: Moderate: openstack-neutron security and bug fix update Advisory ID: RHSA-2015:1680-01 Product: Red Hat Enterprise Linux OpenStack Platform Advisory URL: https://access.redhat.com/errata/RHSA-2015:1680.html Issue date: 2015-08-24 CVE Names: CVE-2015-3221 ==================================================================== 1. Summary: Updated openstack-neutron packages that fix one security issue are now available for Red Hat Enterprise Linux OpenStack Platform 6.0 Red Hat Product Security has rated this update as having a Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux OpenStack Platform 6.0 for RHEL 7 - noarch 3. Description: OpenStack Networking (Neutron) is a pluggable, scalable, and API-driven system that provisions networking services to virtual machines. Its main function is to manage connectivity to and from virtual machines. A Denial of Service flaw was found in the L2 agent when using the IPTables firewall driver. By submitting an address pair that will be rejected as invalid by the ipset tool, an attacker may cause the agent to crash. (CVE-2015-3221) Red Hat would like to thank the OpenStack upstream for reporting this issue. Upstream acknowledges Darragh O'Reilly (HP) as the original reporter. Additionally, the packages address the following issues: * Neutron failed to load multiple configuration files. The Puppet recipe hard-coded the --config-file parameter to a set list of configuration files and additional files were notloaded, even if specified. This fix creates a new Neutron configuration directory, /etc/neutron/conf.d, and any .conf files in that directory are loaded by Puppet and applied to all services. (BZ#1188480) * When configuring load balancer as a service, the Neutron configuration used no group as the default system user group. This group does not exist in the default Red Hat Enterprise Linux 7 configuration, which caused the virtual IP address creation to fail with the error "cannot find group id for 'nogroup'." (BZ#1208002) * Log rotation was set to one week for Neutron, but that could allow the log file to grow to be very large before rotating. The default log rotation policy has been updated to include a size limit of 10MB as well as a time limit to rotate daily. (BZ#1212442) * Previously, dnsmasq did not save lease information in persistent storage. When it was restarted, the lease information was lost. This behavior resulted from removing the '--dhcp-script' option as part of fixing BZ#1202392. As a result, instances were stuck in the network boot process for a long period of time. In addition, NACK messages were noted in the dnsmasq log. This update removes the authoritative option, so that NAKs are not sent in response to DHCPREQUESTs to other servers. This change is expected to prevent dnsmasq from NAKing clients renewing leases issued before it was restarted/rescheduled. DHCPNAK messages should no longer be found in the log files. (BZ#1227635) * Conflict tags were included in the python-neutron package spec that resulted in Neutron unnecessarily blocking the python-oslo-db package. These conflicts have been removed from the spec, so the python-oslo-db package can be successfully installed. (BZ#1250056) All openstack-neutron users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the RedHat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1208002 - LBASS VIP creation fails because system group "nogroup" doesn't exist 1227635 - DHCPNAK after neutron-dhcp-agent restart 1232284 - CVE-2015-3221 openstack-neutron: L2 agent DoS through incorrect allowed address pairs1250056 - neutron unnecessarily blocks python-oslo-db > = 1.1.0 6. Package List: Red Hat Enterprise Linux OpenStack Platform 6.0 for RHEL7: Source: openstack-neutron-2014.2.3-9.el7ost.src.rpm noarch: openstack-neutron-2014.2.3-9.el7ost.noarch.rpm openstack-neutron-bigswitch-2014.2.3-9.el7ost.noarch.rpm openstack-neutron-brocade-2014.2.3-9.el7ost.noarch.rpm openstack-neutron-cisco-2014.2.3-9.el7ost.noarch.rpm openstack-neutron-common-2014.2.3-9.el7ost.noarch.rpm openstack-neutron-embrane-2014.2.3-9.el7ost.noarch.rpm openstack-neutron-hyperv-2014.2.3-9.el7ost.noarch.rpm openstack-neutron-ibm-2014.2.3-9.el7ost.noarch.rpm openstack-neutron-linuxbridge-2014.2.3-9.el7ost.noarch.rpm openstack-neutron-mellanox-2014.2.3-9.el7ost.noarch.rpm openstack-neutron-metaplugin-2014.2.3-9.el7ost.noarch.rpm openstack-neutron-metering-agent-2014.2.3-9.el7ost.noarch.rpm openstack-neutron-midonet-2014.2.3-9.el7ost.noarch.rpm openstack-neutron-ml2-2014.2.3-9.el7ost.noarch.rpm openstack-neutron-nec-2014.2.3-9.el7ost.noarch.rpm openstack-neutron-nuage-2014.2.3-9.el7ost.noarch.rpm openstack-neutron-ofagent-2014.2.3-9.el7ost.noarch.rpm openstack-neutron-oneconvergence-nvsd-2014.2.3-9.el7ost.noarch.rpm openstack-neutron-opencontrail-2014.2.3-9.el7ost.noarch.rpm openstack-neutron-openvswitch-2014.2.3-9.el7ost.noarch.rpm openstack-neutron-plumgrid-2014.2.3-9.el7ost.noarch.rpm openstack-neutron-ryu-2014.2.3-9.el7ost.noarch.rpm openstack-neutron-sriov-nic-agent-2014.2.3-9.el7ost.noarch.rpm openstack-neutron-vmware-2014.2.3-9.el7ost.noarch.rpm openstack-neutron-vpn-agent-2014.2.3-9.el7ost.noarch.rpm python-neutron-2014.2.3-9.el7ost.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-3221 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. . Revised openstack-neutron updates address a Denial-of-Service vulnerabilityand improve networking functionalities for Red Hat OpenStack Platform version 6.0.. OpenStack Neutron Update, Red Hat Advisory, Networking Fix. . LinuxSecurity.com Team
Aug 24, 2015
Red Hat
172
security advisorycriticalaccess controlUbuntu 14.04 LTS USN-2408-1 Critical: Neutron Access Control Issue
OpenStack Neutron would allow unintended access to configuration over the network.. =========================================================================Ubuntu Security Notice USN-2408-1 November 11, 2014 neutron vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.04 LTS Summary: OpenStack Neutron would allow unintended access to configuration over the network. Software Description: - neutron: OpenStack Virtual Network Service Details: Elena Ezhova discovered that OpenStack Neutron did not properly perform access control checks for attributes. A remote authenticated attacker could exploit this to bypass intended access controls and reset admin-only attributes to default values. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 14.04 LTS: python-neutron 1:2014.1.3-0ubuntu1.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-2408-1 CVE-2014-6414 Package Information: https://launchpad.net/ubuntu/+source/neutron/1:2014.1.3-0ubuntu1.1 . The OpenStack Neutron service has encountered a critical security flaw that may lead to unauthorized visibility of network settings. It is crucial to update your Ubuntu system immediately.. OpenStack, Neutron, Access Control Flaw, Network Security, Ubuntu Updates. . Severity: Critical. LinuxSecurity.com Team
Nov 11, 2014
•Critical
Ubuntu
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!