CVE-2017-5936 in Nova-LXD

الملخص

بحسب MITRE

OpenStack Nova-LXD before 13.1.1 uses the wrong name for the veth pairs when applying Neutron security group rules for instances, which allows remote attackers to bypass intended security restrictions.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

• حجز: 08/02/2017
• إفشاء: 12/04/2017
• الاعتدال: تمت الموافقة
• إدخال: VDB-99737
• CPE: جاهز
• CWE: CWE-254 (مؤكد)
• CVSS: 7.5 (NVD)
• EPSS: 0.02910
• KEV: لا
• النشاطات: منخفض جدًا
• القطاع: Hospital, Finance, ...

المصادر

• MITRE: https://www.cve.org/CVERecord?id=CVE-2017-5936
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2017-5936
• CVE Details: https://www.cvedetails.com/cve/CVE-2017-5936/