6.5

CVE-2018-14635: openstack neutron Improper Input Validation

CVSS: 6.5v3.0MediumModified
AliasesGHSA-x634-34m9-96mpPYSEC-2018-93RHSA-2018:2710
Published 10-09-2018Last modified 05-08-2024
Open JSON

Vulnerability summary

CVE-2018-14635 is a medium (CVSS 6.5) Improper Input Validation vulnerability in openstack neutron. EPSS estimates a 2.53% chance of exploitation in the next 30 days, higher than 84.6% of scored vulnerabilities.

Overall risk
27/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.0 (CVE.org)
EPSS score
2.53%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 10-09-2018
    PublishedVulnerability first disclosed.
  2. 05-08-2024
    Last modifiedVulnerability information updated.

Description

When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address, bypassing IP address validation. A potential denial of service could occur if an IP address, conflicting with existing guests or routers, is then assigned from outside of the allowed allocation pool. Versions of openstack-neutron before 13.0.0.0b2, 12.0.3 and 11.0.5 are vulnerable.

CVSS metrics

8 scores · 6 sources · 3 versions

EPSS trend

Probability

2.53%

Chance of exploitation in the next 30 days

Percentile

85%

Versus all other CVEs

30-day change

0.00 pp

From 2.53% on 18-09-2026

18-09-202618-10-2026
EPSS score
2.53%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Redhat12 products
  • openstack10 | 12 | 13
  • openstack-neutron< 1:12.0.3-5.el7ost | < 1:9.4.1-28.el7ost | < 1:11.0.4-6.el7ost
  • openstack-neutron-common< 1:12.0.3-5.el7ost | < 1:9.4.1-28.el7ost | < 1:11.0.4-6.el7ost
  • openstack-neutron-linuxbridge< 1:12.0.3-5.el7ost | < 1:9.4.1-28.el7ost | < 1:11.0.4-6.el7ost
  • openstack-neutron-macvtap-agent< 1:12.0.3-5.el7ost | < 1:9.4.1-28.el7ost | < 1:11.0.4-6.el7ost
Debian1 product
  • neutron< 2:13.0.0-1
Openstack1 product
  • neutron≥ 11.0.0, ≤ 11.0.5 | ≥ 12.0.0, ≤ 12.0.3 | 13.0.0.0:b1
PyPI1 product
  • neutron≥ 13.0.0.0b1, < 13.0.0.0b2 | < 11.0.6 | ≥ 12.0.0, < 12.0.4
The openstack project1 product
Ubuntu1 product
  • neutronAll versions (No fix recorded) | < 2:12.0.3-0ubuntu1

6 vendors · 17 products

References

35 links
Show all 35 references