Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor. This brief window could be extended indefinitely if the instance's port is set administratively down prior to live-migration and kept down after the migration is complete. This is possible due to the Open vSwitch integration bridge being connected to the instance during migration. When connected to the integration bridge, all traffic for instances using the same Open vSwitch instance would potentially be visible to the migrated guest, as the required Open vSwitch VLAN filters are only applied post-migration. Versions of openstack-neutron before 13.0.0.0b2, 12.0.3, 11.0.5 are vulnerable.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor.
    This brief window could be extended indefinitely if the instance's port is set administratively down prior     to live-migration and kept down after the migration is complete. This is possible due to the Open vSwitch     integration bridge being connected to the instance during migration. When connected to the integration     bridge, all traffic for instances using the same Open vSwitch instance would potentially be visible to the     migrated guest, as the required Open vSwitch VLAN filters are only applied post-migration. Versions of     openstack-neutron before 13.0.0.0b2, 12.0.3, 11.0.5 are vulnerable. (CVE-2018-14636)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor.
    This brief window could be extended indefinitely if the instance's port is set administratively down prior
    to live-migration and kept down after the migration is complete. This is possible due to the Open vSwitch
    integration bridge being connected to the instance during migration. When connected to the integration
    bridge, all traffic for instances using the same Open vSwitch instance would potentially be visible to the
    migrated guest, as the required Open vSwitch VLAN filters are only applied post-migration. Versions of
    openstack-neutron before 13.0.0.0b2, 12.0.3, 11.0.5 are vulnerable. (CVE-2018-14636)

ID	Name	Product	Family	Severity
254491	Linux Distros Unpatched Vulnerability : CVE-2018-14636	Nessus	Misc.	medium
432352	SCA: security update for neutron (GHSA-8q95-jj7p-x93x)	Tenable Cloud Security	SCA Checks	medium
432352	SCA: security update for neutron (GHSA-8q95-jj7p-x93x)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2018-14636

medium

Tenable Plugins

medium

medium

medium