CVE-2024-53916

Publication date 25 November 2024

Last updated 26 February 2025

Ubuntu priority

Medium

Why this priority?

In OpenStack Neutron before 25.0.1, neutron/extensions/tagging.py can use an incorrect ID during policy enforcement. It does not apply the proper policy check for changing network tags. An unprivileged tenant is able to change (add and clear) tags on network objects that do not belong to the tenant, and this action is not subjected to the proper policy authorization check. This affects 23 before 23.2.1, 24 before 24.0.2, and 25 before 25.0.1.

Read the notes from the security team

Status

Package Ubuntu Release Status
neutron 25.04 plucky
Not affected
24.10 oracular
Vulnerable
24.04 LTS noble
Vulnerable
22.04 LTS jammy
Not affected
20.04 LTS focal
Not affected
18.04 LTS bionic
Not affected
16.04 LTS xenial
Not affected

Notes

mdeslaur

per Debian, introduced with the following commit: https://opendev.org/openstack/neutron/commit/f9b91289a5c2948429e69e1b58098cec846fba99 This is fixed in 2:24.1.0-0ubuntu1 in noble-proposed

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
neutron