{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35259?format=json","vulnerability_id":"VCID-mcet-nkj3-bug8","summary":"Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor. This brief window could be extended indefinitely if the instance's port is set administratively down prior to live-migration and kept down after the migration is complete. This is possible due to the Open vSwitch integration bridge being connected to the instance during migration. When connected to the integration bridge, all traffic for instances using the same Open vSwitch instance would potentially be visible to the migrated guest, as the required Open vSwitch VLAN filters are only applied post-migration. Versions of openstack-neutron before 13.0.0.0b2, 12.0.3, 11.0.5 are vulnerable.","aliases":[{"alias":"CVE-2018-14636"},{"alias":"GHSA-8q95-jj7p-x93x"},{"alias":"PYSEC-2018-94"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/11967?format=json","purl":"pkg:pypi/neutron@11.0.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1444-3h31-3kdv"},{"vulnerability":"VCID-69mn-brsx-xydy"},{"vulnerability":"VCID-jecq-8kqy-sfg8"},{"vulnerability":"VCID-p5ww-51mu-buf5"},{"vulnerability":"VCID-p6g8-396q-t7ck"},{"vulnerability":"VCID-t5sb-ghkg-zbb6"},{"vulnerability":"VCID-wa91-gzx6-h7gu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/neutron@11.0.5"},{"url":"http://public2.vulnerablecode.io/api/packages/11971?format=json","purl":"pkg:pypi/neutron@12.0.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1444-3h31-3kdv"},{"vulnerability":"VCID-69mn-brsx-xydy"},{"vulnerability":"VCID-jecq-8kqy-sfg8"},{"vulnerability":"VCID-p5ww-51mu-buf5"},{"vulnerability":"VCID-p6g8-396q-t7ck"},{"vulnerability":"VCID-t5sb-ghkg-zbb6"},{"vulnerability":"VCID-wa91-gzx6-h7gu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/neutron@12.0.3"},{"url":"http://public2.vulnerablecode.io/api/packages/22096?format=json","purl":"pkg:pypi/neutron@13.0.0.0b2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1444-3h31-3kdv"},{"vulnerability":"VCID-69mn-brsx-xydy"},{"vulnerability":"VCID-p6g8-396q-t7ck"},{"vulnerability":"VCID-wa91-gzx6-h7gu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/neutron@13.0.0.0b2"}],"affected_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/11962?format=json","purl":"pkg:pypi/neutron@10.0.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1444-3h31-3kdv"},{"vulnerability":"VCID-69mn-brsx-xydy"},{"vulnerability":"VCID-jecq-8kqy-sfg8"},{"vulnerability":"VCID-mcet-nkj3-bug8"},{"vulnerability":"VCID-p5ww-51mu-buf5"},{"vulnerability":"VCID-p6g8-396q-t7ck"},{"vulnerability":"VCID-t5sb-ghkg-zbb6"},{"vulnerability":"VCID-wa91-gzx6-h7gu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/neutron@10.0.5"},{"url":"http://public2.vulnerablecode.io/api/packages/11963?format=json","purl":"pkg:pypi/neutron@10.0.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1444-3h31-3kdv"},{"vulnerability":"VCID-69mn-brsx-xydy"},{"vulnerability":"VCID-jecq-8kqy-sfg8"},{"vulnerability":"VCID-mcet-nkj3-bug8"},{"vulnerability":"VCID-p5ww-51mu-buf5"},{"vulnerability":"VCID-p6g8-396q-t7ck"},{"vulnerability":"VCID-t5sb-ghkg-zbb6"},{"vulnerability":"VCID-wa91-gzx6-h7gu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/neutron@10.0.6"},{"url":"http://public2.vulnerablecode.io/api/packages/11964?format=json","purl":"pkg:pypi/neutron@10.0.7","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1444-3h31-3kdv"},{"vulnerability":"VCID-69mn-brsx-xydy"},{"vulnerability":"VCID-jecq-8kqy-sfg8"},{"vulnerability":"VCID-mcet-nkj3-bug8"},{"vulnerability":"VCID-p5ww-51mu-buf5"},{"vulnerability":"VCID-p6g8-396q-t7ck"},{"vulnerability":"VCID-t5sb-ghkg-zbb6"},{"vulnerability":"VCID-wa91-gzx6-h7gu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/neutron@10.0.7"},{"url":"http://public2.vulnerablecode.io/api/packages/62449?format=json","purl":"pkg:pypi/neutron@11.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-mcet-nkj3-bug8"},{"vulnerability":"VCID-p5ww-51mu-buf5"},{"vulnerability":"VCID-t5sb-ghkg-zbb6"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/neutron@11.0.0"},{"url":"http://public2.vulnerablecode.io/api/packages/11965?format=json","purl":"pkg:pypi/neutron@11.0.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1444-3h31-3kdv"},{"vulnerability":"VCID-69mn-brsx-xydy"},{"vulnerability":"VCID-jecq-8kqy-sfg8"},{"vulnerability":"VCID-mcet-nkj3-bug8"},{"vulnerability":"VCID-p5ww-51mu-buf5"},{"vulnerability":"VCID-p6g8-396q-t7ck"},{"vulnerability":"VCID-t5sb-ghkg-zbb6"},{"vulnerability":"VCID-wa91-gzx6-h7gu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/neutron@11.0.3"},{"url":"http://public2.vulnerablecode.io/api/packages/11966?format=json","purl":"pkg:pypi/neutron@11.0.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1444-3h31-3kdv"},{"vulnerability":"VCID-69mn-brsx-xydy"},{"vulnerability":"VCID-jecq-8kqy-sfg8"},{"vulnerability":"VCID-mcet-nkj3-bug8"},{"vulnerability":"VCID-p5ww-51mu-buf5"},{"vulnerability":"VCID-p6g8-396q-t7ck"},{"vulnerability":"VCID-t5sb-ghkg-zbb6"},{"vulnerability":"VCID-wa91-gzx6-h7gu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/neutron@11.0.4"},{"url":"http://public2.vulnerablecode.io/api/packages/11968?format=json","purl":"pkg:pypi/neutron@12.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1444-3h31-3kdv"},{"vulnerability":"VCID-69mn-brsx-xydy"},{"vulnerability":"VCID-jecq-8kqy-sfg8"},{"vulnerability":"VCID-mcet-nkj3-bug8"},{"vulnerability":"VCID-p5ww-51mu-buf5"},{"vulnerability":"VCID-p6g8-396q-t7ck"},{"vulnerability":"VCID-t5sb-ghkg-zbb6"},{"vulnerability":"VCID-wa91-gzx6-h7gu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/neutron@12.0.0"},{"url":"http://public2.vulnerablecode.io/api/packages/11969?format=json","purl":"pkg:pypi/neutron@12.0.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1444-3h31-3kdv"},{"vulnerability":"VCID-69mn-brsx-xydy"},{"vulnerability":"VCID-jecq-8kqy-sfg8"},{"vulnerability":"VCID-mcet-nkj3-bug8"},{"vulnerability":"VCID-p5ww-51mu-buf5"},{"vulnerability":"VCID-p6g8-396q-t7ck"},{"vulnerability":"VCID-t5sb-ghkg-zbb6"},{"vulnerability":"VCID-wa91-gzx6-h7gu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/neutron@12.0.1"},{"url":"http://public2.vulnerablecode.io/api/packages/11970?format=json","purl":"pkg:pypi/neutron@12.0.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1444-3h31-3kdv"},{"vulnerability":"VCID-69mn-brsx-xydy"},{"vulnerability":"VCID-jecq-8kqy-sfg8"},{"vulnerability":"VCID-mcet-nkj3-bug8"},{"vulnerability":"VCID-p5ww-51mu-buf5"},{"vulnerability":"VCID-p6g8-396q-t7ck"},{"vulnerability":"VCID-t5sb-ghkg-zbb6"},{"vulnerability":"VCID-wa91-gzx6-h7gu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/neutron@12.0.2"},{"url":"http://public2.vulnerablecode.io/api/packages/22095?format=json","purl":"pkg:pypi/neutron@13.0.0.0b1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1444-3h31-3kdv"},{"vulnerability":"VCID-69mn-brsx-xydy"},{"vulnerability":"VCID-jecq-8kqy-sfg8"},{"vulnerability":"VCID-mcet-nkj3-bug8"},{"vulnerability":"VCID-p6g8-396q-t7ck"},{"vulnerability":"VCID-wa91-gzx6-h7gu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/neutron@13.0.0.0b1"}],"references":[{"reference_url":"https://bugs.launchpad.net/neutron/+bug/1734320","reference_id":"","reference_type":"","scores":[],"url":"https://bugs.launchpad.net/neutron/+bug/1734320"},{"reference_url":"https://bugs.launchpad.net/neutron/+bug/1767422","reference_id":"","reference_type":"","scores":[],"url":"https://bugs.launchpad.net/neutron/+bug/1767422"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14636","reference_id":"","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14636"},{"reference_url":"https://github.com/openstack/neutron","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/openstack/neutron"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/neutron/PYSEC-2018-94.yaml","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/neutron/PYSEC-2018-94.yaml"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14636","reference_id":"CVE-2018-14636","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14636"},{"reference_url":"https://github.com/advisories/GHSA-8q95-jj7p-x93x","reference_id":"GHSA-8q95-jj7p-x93x","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-8q95-jj7p-x93x"}],"weaknesses":[{"cwe_id":937,"name":"OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."},{"cwe_id":1035,"name":"OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."}],"exploits":[],"severity_range_score":null,"exploitability":null,"weighted_severity":null,"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-mcet-nkj3-bug8"}