In OpenStack Neutron before 25.0.1, neutron/extensions/tagging.py can use an incorrect ID during policy enforcement. It does not apply the proper policy check for changing network tags. An unprivileged tenant is able to change (add and clear) tags on network objects that do not belong to the tenant, and this action is not subjected to the proper policy authorization check. This affects 23 before 23.2.1, 24 before 24.0.2, and 25 before 25.0.1.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:1052 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-53916:
    In OpenStack Neutron through 25.0.0, neutron/extensions/tagging.py can use an incorrect ID during policy     enforcement. NOTE: 935883 has the Work in Progress status as of 2024-11-24.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In OpenStack Neutron before 25.0.1, neutron/extensions/tagging.py can use an incorrect ID during policy
    enforcement. It does not apply the proper policy check for changing network tags. An unprivileged tenant
    is able to change (add and clear) tags on network objects that do not belong to the tenant, and this
    action is not subjected to the proper policy authorization check. This affects 23 before 23.2.1, 24 before
    24.0.2, and 25 before 25.0.1. (CVE-2024-53916)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In OpenStack Neutron before 25.0.1, neutron/extensions/tagging.py can use an incorrect ID during policy     enforcement. It does not apply the proper policy check for changing network tags. An unprivileged tenant     is able to change (add and clear) tags on network objects that do not belong to the tenant, and this     action is not subjected to the proper policy authorization check. This affects 23 before 23.2.1, 24 before     24.0.2, and 25 before 25.0.1. (CVE-2024-53916)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
238725	TencentOS Server 4: openstack-neutron (TSSA-2024:1052)	Nessus	Tencent Local Security Checks	medium
421295	SCA: security update for neutron (GHSA-f27h-g923-68hw)	Tenable Cloud Security	SCA Checks	medium
421295	SCA: security update for neutron (GHSA-f27h-g923-68hw)	Tenable Self-Hosted Container Security	SCA Checks	medium
231159	Linux Distros Unpatched Vulnerability : CVE-2024-53916	Nessus	Misc.	high

Detections

Analytics

CVE-2024-53916

medium

Tenable Plugins

medium

medium

medium

high