OpenStack Nova-LXD before 13.1.1 uses the wrong name for the veth pairs when applying Neutron security group rules for instances, which allows remote attackers to bypass intended security restrictions.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenStack Nova-LXD before 13.1.1 uses the wrong name for the veth pairs when applying Neutron security
    group rules for instances, which allows remote attackers to bypass intended security restrictions.
    (CVE-2017-5936)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3195-1 advisory.

    James Page discovered that Nova-LXD incorrectly set up virtual network devices when creating LXD     instances. This could result in an unintended firewall configuration.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
432364	SCA: security update for nova-lxd (GHSA-6xc7-4cx8-j3xc)	Tenable Cloud Security	SCA Checks	Local	high
432364	SCA: security update for nova-lxd (GHSA-6xc7-4cx8-j3xc)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
432232	SCA: security update for nova-lxd (GHSA-6xc7-4cx8-j3xc)	Tenable Cloud Security	SCA Checks	Local	high
432232	SCA: security update for nova-lxd (GHSA-6xc7-4cx8-j3xc)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
97099	Ubuntu 16.04 LTS : Nova-LXD vulnerability (USN-3195-1)	Nessus	Ubuntu Local Security Checks	Local	high

Detections

Analytics

CVE-2017-5936

high

Tenable Plugins

high

high

high

high

high