CVE-2021-40085: OpenStack Neutron vulnerable to authenticated attackers reconfiguring dnsmasq via crafted extra_dhcp_opts value
(updated )
An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. Authenticated attackers can reconfigure dnsmasq via a crafted extra_dhcp_opts value.
References
- github.com/advisories/GHSA-fh73-gjvg-349c
- github.com/openstack/neutron
- github.com/openstack/neutron/commit/df891f0593d234e01f27d7c0376d9702e178ecfb
- github.com/pypa/advisory-database/tree/main/vulns/neutron/PYSEC-2021-361.yaml
- launchpad.net/bugs/1939733
- lists.debian.org/debian-lts-announce/2021/10/msg00005.html
- lists.debian.org/debian-lts-announce/2022/05/msg00038.html
- nvd.nist.gov/vuln/detail/CVE-2021-40085
- security.openstack.org/ossa/OSSA-2021-005.html
- www.debian.org/security/2021/dsa-4983
Code Behaviors & Features
Detect and mitigate CVE-2021-40085 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →