Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-cwwz-4a6e-tugg

Summary

OpenStack Neutron allows remote attackers to bypass an intended DHCP-spoofing protection mechanism
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended DHCP-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a crafted DHCP discovery message.

Aliases

alias	CVE-2016-5362

alias	GHSA-qpwc-p365-pqrr

Fixed_packages

url	pkg:pypi/neutron@7.0.5
purl	pkg:pypi/neutron@7.0.5
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/neutron@7.0.5

url	pkg:pypi/neutron@8.1.1
purl	pkg:pypi/neutron@8.1.1
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/neutron@8.1.1

Affected_packages

url pkg:pypi/neutron@8.0.0

purl pkg:pypi/neutron@8.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6mxz-st39-zyh3

vulnerability	VCID-737y-rfry-dqed

vulnerability	VCID-cwwz-4a6e-tugg

vulnerability	VCID-m7vh-gw28-wbas

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/neutron@8.0.0

References

reference_url	https://access.redhat.com/errata/RHSA-2016:1473
reference_id
reference_type
scores
url	https://access.redhat.com/errata/RHSA-2016:1473

reference_url	https://access.redhat.com/errata/RHSA-2016:1474
reference_id
reference_type
scores
url	https://access.redhat.com/errata/RHSA-2016:1474

reference_url	https://bugs.launchpad.net/neutron/+bug/1558658
reference_id
reference_type
scores
url	https://bugs.launchpad.net/neutron/+bug/1558658

reference_url	https://github.com/openstack/neutron
reference_id
reference_type
scores
url	https://github.com/openstack/neutron

reference_url	https://review.openstack.org/#/c/300202
reference_id
reference_type
scores
url	https://review.openstack.org/#/c/300202

reference_url	https://review.openstack.org/#/c/303563
reference_id
reference_type
scores
url	https://review.openstack.org/#/c/303563

reference_url	https://review.openstack.org/#/c/303572
reference_id
reference_type
scores
url	https://review.openstack.org/#/c/303572

reference_url	https://security.openstack.org/ossa/OSSA-2016-009.html
reference_id
reference_type
scores
url	https://security.openstack.org/ossa/OSSA-2016-009.html

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2016-5362
reference_id	CVE-2016-5362
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2016-5362

reference_url	https://github.com/advisories/GHSA-qpwc-p365-pqrr
reference_id	GHSA-qpwc-p365-pqrr
reference_type
scores
url	https://github.com/advisories/GHSA-qpwc-p365-pqrr

Weaknesses

cwe_id	923
name	Improper Restriction of Communication Channel to Intended Endpoints
description	The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

Exploits

Severity_range_score null

Exploitability null

Weighted_severity null

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-cwwz-4a6e-tugg

Vulnerability Instance