USN-2321-1: OpenStack Neutron vulnerabilities
21 August 2014
OpenStack Neutron could be made to expose sensitive information or crash.
- neutron - OpenStack Virtual Network Service
Liping Mao discovered that OpenStack Neutron did not properly handle
requests for a large number of allowed address pairs. A remote
authenticated attacker could exploit this to cause a denial of service.
Zhi Kun Liu discovered that OpenStack Neutron incorrectly filtered certain
tokens. An attacker could possibly use this issue to obtain authentication
tokens used in REST requests. (CVE-2014-4615)