CVE-2017-5936

Published: Apr 12, 2017Modified: May 13, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

OpenStack Nova-LXD before 13.1.1 uses the wrong name for the veth pairs when applying Neutron security group rules for instances, which allows remote attackers to bypass intended security restrictions.

Affected (2)

Products: Canonical: Ubuntu Linux · Openstack: Nova Lxd

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 16.04

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Openstack Nova Lxd	Up to 13.1.0

References (10)

http://www.openwall.com/lists/oss-security/2017/02/09/3

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

http://www.securityfocus.com/bid/96182

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-3195-1

Source: cve@mitre.org

Third Party Advisory

https://bugs.launchpad.net/nova-lxd/+bug/1656847

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://github.com/openstack/nova-lxd/commit/1b76cefb92081efa1e88cd8f330253f857028bd2

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2017/02/09/3