CVE-2017-5936: OpenStack Nova-LXD bypass security restrictions
(updated )
OpenStack Nova-LXD before 13.1.1 uses the wrong name for the veth pairs when applying Neutron security group rules for instances, which allows remote attackers to bypass intended security restrictions.
References
- bugs.launchpad.net/nova-lxd/+bug/1656847
- github.com/advisories/GHSA-6xc7-4cx8-j3xc
- github.com/openstack/nova-lxd
- github.com/openstack/nova-lxd/commit/1b76cefb92081efa1e88cd8f330253f857028bd2
- github.com/pypa/advisory-database/tree/main/vulns/nova-lxd/PYSEC-2017-21.yaml
- nvd.nist.gov/vuln/detail/CVE-2017-5936
- web.archive.org/web/20200227193915/http://www.securityfocus.com/bid/96182
Code Behaviors & Features
Detect and mitigate CVE-2017-5936 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →