VDB
CVE-2017-7543
CVE-2017-7543
PUBLISHED
CVSS 5.300000190734863 MEDIUM
A race-condition flaw was discovered in openstack-neutron before 7.2.0-12.1, 8.x before 8.3.0-11.1, 9.x before 9.3.1-2.1, and 10.x before 10.0.2-1.1, where, following a minor overcloud update, neutron security groups were disabled. Specifically, the following were reset to 0: net.bridge.bridge-nf-call-ip6tables and net.bridge.bridge-nf-call-iptables. The race was only triggered by an update, at which point an attacker could access exposed tenant VMs and network resources.
EPSS 1.85% · 77.4th percentile
Risk Scores
CVSS 3.0
5.300000190734863
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS Score
1.85%
77.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openstack-neutron | openstack-neutron-8.3.0-11.1, openstack-neutron-9.3.1-2.1, openstack-neutron-7.2.0-12.1 |
| redhat | openstack | 7.0, 6.0, 8 |
| openstack | neutron | 10.0.0, 9.0.0, 8.0.0 |
| PyPI | neutron | 0, 8.0.0, 9.0.0 |
Timeline
- Jul 26, 2018 CVE Published
- Oct 9, 2019 CVE Updated
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 24, 2021 EPSS Score
- Oct 26, 2021 EPSS Score
- Dec 28, 2021 EPSS Score
- Feb 4, 2022 EPSS Score
- Feb 28, 2022 EPSS Score
- May 2, 2022 EPSS Score
- Sep 5, 2022 EPSS Score
- Nov 7, 2022 EPSS Score
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7543 url
- RHSA-2017:2448 vendor-advisory
- 100237 vdb
- RHSA-2017:2452 vendor-advisory
- RHSA-2017:2449 vendor-advisory
- RHSA-2017:2447 vendor-advisory
- RHSA-2017:2451 vendor-advisory
- RHSA-2017:2450 vendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2017-7543 advisory
- https://access.redhat.com/security/cve/CVE-2017-7543 url
- https://bugzilla.redhat.com/show_bug.cgi?id=1473792 url
- https://opendev.org/openstack/neutron package
- https://web.archive.org/web/20200227153412/https://www.securityfocus.com/bid/100237 url