p PatchFirst

CVE-2024-53916

CVE-2024-53916

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In OpenStack Neutron before 25.0.1, neutron/extensions/tagging.py can use an incorrect ID during policy enforcement. It does not apply the proper policy check for changing network tags. An unprivileged tenant is able to change (add and clear) tags on network objects that do not belong to the tenant, and this action is not subjected to the proper policy authorization check. This affects 23 before 23.2.1, 24 before 24.0.2, and 25 before 25.0.1.

CVSS 7.5 · High · EPSS 0.7% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • neutron Debian:13

    Affected ranges
    • ECOSYSTEM: < 2:25.0.0-2

    Update to 2:25.0.0-2

  • neutron Debian:14

    Affected ranges
    • ECOSYSTEM: < 2:25.0.0-2

    Update to 2:25.0.0-2

  • neutron PyPI

    Versions
    • 23.0.0
    • 23.1.0
    • 23.2.0
    Affected ranges
    • ECOSYSTEM: ≥ 23.0.0, < 23.2.1

    Update to 23.2.1

  • neutron PyPI

    Versions
    • 24.0.0
    • 24.0.1
    Affected ranges
    • ECOSYSTEM: ≥ 24.0.0, < 24.0.2

    Update to 24.0.2

  • neutron PyPI

    Versions
    • 25.0.0
    Affected ranges
    • ECOSYSTEM: ≥ 25.0.0, < 25.0.1

    Update to 25.0.1

  • neutron PyPI

    Versions
    • 23.0.0
    • 23.1.0
    • 23.2.0
    • 24.0.0
    • 24.0.1
    • 25.0.0
    Affected ranges
    • ECOSYSTEM: ≥ 23.0.0, < 23.2.1 ∪ ≥ 24.0.0, < 24.0.2 ∪ ≥ 25.0.0, < 25.0.1

    Update to 23.2.1; Update to 24.0.2; Update to 25.0.1

  • neutron Ubuntu:24.04:LTS

    Versions
    • 2:23.0.0-0ubuntu1
    • 2:24.0.0~b1+git2024011914.5ce17647-0ubuntu1
    • 2:24.0.0~rc1-0ubuntu2
    • 2:24.0.0-0ubuntu1
    • 2:24.0.0-0ubuntu2
    • 2:24.1.0-0ubuntu1
    • 2:24.1.0-0ubuntu1.1
    • 2:24.1.0-0ubuntu1.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →