---
title: CVE-2024-53916
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2024-53916
---

# CVE-2024-53916

Publication date 25 November 2024

Last updated 11 July 2025

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

## Cvss 3 Severity Score

**7.5 · High**

[Score breakdown](https://ubuntu.com/security/CVE-2024-53916#impact-score)

Toggle side navigation

## Description

In OpenStack Neutron before 25.0.1, neutron/extensions/tagging.py can use
an incorrect ID during policy enforcement. It does not apply the proper
policy check for changing network tags. An unprivileged tenant is able to
change (add and clear) tags on network objects that do not belong to the
tenant, and this action is not subjected to the proper policy authorization
check. This affects 23 before 23.2.1, 24 before 24.0.2, and 25 before
25.0.1.

[Read the notes from the security team](https://ubuntu.com/security/CVE-2024-53916#notes)

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| neutron | 26.04 LTS resolute | Not affected |
| 25.10 questing | Not affected |
| 25.04 plucky | Not affected |
| 24.10 oracular | Ignored end of life, was needed |
| 24.04 LTS noble | Vulnerable |
| 22.04 LTS jammy | Not affected |
| 20.04 LTS focal | Not affected |
| 18.04 LTS bionic | Not affected |
| 16.04 LTS xenial | Not affected |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)
* [Patch details](https://ubuntu.com/security/CVE-2024-53916#patch-details)

## Notes

---

### [mdeslaur](https://launchpad.net/~mdeslaur)

per Debian, introduced with the following commit:
https://opendev.org/openstack/neutron/commit/f9b91289a5c2948429e69e1b58098cec846fba99
This is fixed in 2:24.1.0-0ubuntu1 in noble-updates (needs a
no-change rebuild into the -security pocket)

### Patch details

For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)

| Package | Patch details |
| --- | --- |
| neutron | * Upstream:   <https://review.opendev.org/c/openstack/neutron/+/936849> * Upstream:   <https://review.opendev.org/c/openstack/neutron/+/936846> * Upstream:   <https://review.opendev.org/c/openstack/neutron/+/936843> * Upstream:   <https://review.opendev.org/c/openstack/neutron/+/935883> |

## Severity score breakdown

CVSS version:
CVSS v3.0

**Base score**

7.5 · High

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Network |
  | Attack complexity | Low |
  | Privileges required | None |
  | User interaction | None |
  | Scope | Unchanged |
  | Confidentiality impact | None |
  | Integrity impact | High |
  | Availability impact | None |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 7.5 · High |
  | Exploitability score | - |
  | Impact score | - |

**Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53916)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-53916)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2024-53916)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2024-53916)

### Other references

* <https://www.cve.org/CVERecord?id=CVE-2024-53916>
* <https://github.com/openstack/neutron/blob/363ffa6e9e1ab5968f87d45bc2f1cb6394f48b9f/neutron/extensions/tagging.py#L138-L232>
* <https://review.opendev.org/q/project:openstack/neutron>
* <https://www.openwall.com/lists/oss-security/2024/12/03/1>