Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-mcet-nkj3-bug8

Summary Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor. This brief window could be extended indefinitely if the instance's port is set administratively down prior to live-migration and kept down after the migration is complete. This is possible due to the Open vSwitch integration bridge being connected to the instance during migration. When connected to the integration bridge, all traffic for instances using the same Open vSwitch instance would potentially be visible to the migrated guest, as the required Open vSwitch VLAN filters are only applied post-migration. Versions of openstack-neutron before 13.0.0.0b2, 12.0.3, 11.0.5 are vulnerable.

Aliases

alias	CVE-2018-14636

alias	GHSA-8q95-jj7p-x93x

alias	PYSEC-2018-94

Fixed_packages

url pkg:pypi/neutron@11.0.5

purl pkg:pypi/neutron@11.0.5

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1444-3h31-3kdv

vulnerability	VCID-69mn-brsx-xydy

vulnerability	VCID-jecq-8kqy-sfg8

vulnerability	VCID-p5ww-51mu-buf5

vulnerability	VCID-p6g8-396q-t7ck

vulnerability	VCID-t5sb-ghkg-zbb6

vulnerability	VCID-wa91-gzx6-h7gu

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/neutron@11.0.5

url pkg:pypi/neutron@12.0.3

purl pkg:pypi/neutron@12.0.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1444-3h31-3kdv

vulnerability	VCID-69mn-brsx-xydy

vulnerability	VCID-jecq-8kqy-sfg8

vulnerability	VCID-p5ww-51mu-buf5

vulnerability	VCID-p6g8-396q-t7ck

vulnerability	VCID-t5sb-ghkg-zbb6

vulnerability	VCID-wa91-gzx6-h7gu

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/neutron@12.0.3

url pkg:pypi/neutron@13.0.0.0b2

purl pkg:pypi/neutron@13.0.0.0b2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1444-3h31-3kdv

vulnerability	VCID-69mn-brsx-xydy

vulnerability	VCID-p6g8-396q-t7ck

vulnerability	VCID-wa91-gzx6-h7gu

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/neutron@13.0.0.0b2

Affected_packages

url pkg:pypi/neutron@10.0.5

purl pkg:pypi/neutron@10.0.5

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1444-3h31-3kdv

vulnerability	VCID-69mn-brsx-xydy

vulnerability	VCID-jecq-8kqy-sfg8

vulnerability	VCID-mcet-nkj3-bug8

vulnerability	VCID-p5ww-51mu-buf5

vulnerability	VCID-p6g8-396q-t7ck

vulnerability	VCID-t5sb-ghkg-zbb6

vulnerability	VCID-wa91-gzx6-h7gu

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/neutron@10.0.5

url pkg:pypi/neutron@10.0.6

purl pkg:pypi/neutron@10.0.6

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1444-3h31-3kdv

vulnerability	VCID-69mn-brsx-xydy

vulnerability	VCID-jecq-8kqy-sfg8

vulnerability	VCID-mcet-nkj3-bug8

vulnerability	VCID-p5ww-51mu-buf5

vulnerability	VCID-p6g8-396q-t7ck

vulnerability	VCID-t5sb-ghkg-zbb6

vulnerability	VCID-wa91-gzx6-h7gu

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/neutron@10.0.6

url pkg:pypi/neutron@10.0.7

purl pkg:pypi/neutron@10.0.7

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1444-3h31-3kdv

vulnerability	VCID-69mn-brsx-xydy

vulnerability	VCID-jecq-8kqy-sfg8

vulnerability	VCID-mcet-nkj3-bug8

vulnerability	VCID-p5ww-51mu-buf5

vulnerability	VCID-p6g8-396q-t7ck

vulnerability	VCID-t5sb-ghkg-zbb6

vulnerability	VCID-wa91-gzx6-h7gu

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/neutron@10.0.7

url pkg:pypi/neutron@11.0.0

purl pkg:pypi/neutron@11.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-mcet-nkj3-bug8

vulnerability	VCID-p5ww-51mu-buf5

vulnerability	VCID-t5sb-ghkg-zbb6

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/neutron@11.0.0

url pkg:pypi/neutron@11.0.3

purl pkg:pypi/neutron@11.0.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1444-3h31-3kdv

vulnerability	VCID-69mn-brsx-xydy

vulnerability	VCID-jecq-8kqy-sfg8

vulnerability	VCID-mcet-nkj3-bug8

vulnerability	VCID-p5ww-51mu-buf5

vulnerability	VCID-p6g8-396q-t7ck

vulnerability	VCID-t5sb-ghkg-zbb6

vulnerability	VCID-wa91-gzx6-h7gu

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/neutron@11.0.3

url pkg:pypi/neutron@11.0.4

purl pkg:pypi/neutron@11.0.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1444-3h31-3kdv

vulnerability	VCID-69mn-brsx-xydy

vulnerability	VCID-jecq-8kqy-sfg8

vulnerability	VCID-mcet-nkj3-bug8

vulnerability	VCID-p5ww-51mu-buf5

vulnerability	VCID-p6g8-396q-t7ck

vulnerability	VCID-t5sb-ghkg-zbb6

vulnerability	VCID-wa91-gzx6-h7gu

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/neutron@11.0.4

url pkg:pypi/neutron@12.0.0

purl pkg:pypi/neutron@12.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1444-3h31-3kdv

vulnerability	VCID-69mn-brsx-xydy

vulnerability	VCID-jecq-8kqy-sfg8

vulnerability	VCID-mcet-nkj3-bug8

vulnerability	VCID-p5ww-51mu-buf5

vulnerability	VCID-p6g8-396q-t7ck

vulnerability	VCID-t5sb-ghkg-zbb6

vulnerability	VCID-wa91-gzx6-h7gu

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/neutron@12.0.0

url pkg:pypi/neutron@12.0.1

purl pkg:pypi/neutron@12.0.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1444-3h31-3kdv

vulnerability	VCID-69mn-brsx-xydy

vulnerability	VCID-jecq-8kqy-sfg8

vulnerability	VCID-mcet-nkj3-bug8

vulnerability	VCID-p5ww-51mu-buf5

vulnerability	VCID-p6g8-396q-t7ck

vulnerability	VCID-t5sb-ghkg-zbb6

vulnerability	VCID-wa91-gzx6-h7gu

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/neutron@12.0.1

url pkg:pypi/neutron@12.0.2

purl pkg:pypi/neutron@12.0.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1444-3h31-3kdv

vulnerability	VCID-69mn-brsx-xydy

vulnerability	VCID-jecq-8kqy-sfg8

vulnerability	VCID-mcet-nkj3-bug8

vulnerability	VCID-p5ww-51mu-buf5

vulnerability	VCID-p6g8-396q-t7ck

vulnerability	VCID-t5sb-ghkg-zbb6

vulnerability	VCID-wa91-gzx6-h7gu

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/neutron@12.0.2

url pkg:pypi/neutron@13.0.0.0b1

purl pkg:pypi/neutron@13.0.0.0b1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1444-3h31-3kdv

vulnerability	VCID-69mn-brsx-xydy

vulnerability	VCID-jecq-8kqy-sfg8

vulnerability	VCID-mcet-nkj3-bug8

vulnerability	VCID-p6g8-396q-t7ck

vulnerability	VCID-wa91-gzx6-h7gu

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/neutron@13.0.0.0b1

References

reference_url	https://bugs.launchpad.net/neutron/+bug/1734320
reference_id
reference_type
scores
url	https://bugs.launchpad.net/neutron/+bug/1734320

reference_url	https://bugs.launchpad.net/neutron/+bug/1767422
reference_id
reference_type
scores
url	https://bugs.launchpad.net/neutron/+bug/1767422

reference_url	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14636
reference_id
reference_type
scores
url	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14636

reference_url	https://github.com/openstack/neutron
reference_id
reference_type
scores
url	https://github.com/openstack/neutron

reference_url	https://github.com/pypa/advisory-database/tree/main/vulns/neutron/PYSEC-2018-94.yaml
reference_id
reference_type
scores
url	https://github.com/pypa/advisory-database/tree/main/vulns/neutron/PYSEC-2018-94.yaml

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2018-14636
reference_id	CVE-2018-14636
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2018-14636

reference_url	https://github.com/advisories/GHSA-8q95-jj7p-x93x
reference_id	GHSA-8q95-jj7p-x93x
reference_type
scores
url	https://github.com/advisories/GHSA-8q95-jj7p-x93x

Weaknesses

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

Exploits

Severity_range_score null

Exploitability null

Weighted_severity null

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-mcet-nkj3-bug8

Vulnerability Instance