OpenStack Nova-LXD bypass security restrictions

HIGH 7.5CVE-2017-5936 · GHSA-6xc7-4cx8-j3xc · PYSEC-2017-21 · Published 12/04/2017 · updated 17/06/2026

Package	Affected versions	Patched versions
nova-lxd PyPI	`< 13.1.1`	`13.1.1`
nova-lxd openstack	`≤ 13.1.0`	No fix yet

Description

OpenStack Nova-LXD before 13.1.1 uses the wrong name for the veth pairs when applying Neutron security group rules for instances, which allows remote attackers to bypass intended security restrictions.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2017-5936 · ADVISORY
openstack/nova-lxd commit 1b76cef · WEB
bugs.launchpad.net/nova-lxd/+bug/1656847 · WEB
openstack/nova-lxd · PACKAGE
pypa/advisory-database · WEB
web.archive.org/web/20200227193915/http://www.securityfocus.com/bid/96182 · WEB
openwall.com/lists/oss-security/2017/02/09/3 · WEB
ubuntu.com/usn/USN-3195-1 · WEB
securityfocus.com/bid/96182 · Third Party Advisory
GitHub Advisory GHSA-6xc7-4cx8-j3xc · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free