CVE catalog

CVE-2022-3277

neutron: CVE-2022-3277

[CVE catalog]

Severity
Medium · CVSS 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
1.06% · Oct 25, 2026

An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianneutronsid2:29.0.0-9fixed
Debianneutronforky2:28.0.1-2fixed
Debianneutrontrixie2:26.0.3-0+deb13u3fixed
Debianneutrontrixie-security2:26.0.3-0+deb13u3fixed
Debianneutronbookworm2:21.0.0-7fixed
Debianneutronbookworm-security2:21.0.0-7+deb12u1fixed
Ubuntuneutron16.042:7.0.0-0ubuntu1vulnerable
Ubuntuneutron16.042:8.0.0~b1-0ubuntu2vulnerable
Ubuntuneutron16.042:8.0.0~b2-0ubuntu4vulnerable
Ubuntuneutron16.042:8.0.0~b2-0ubuntu5vulnerable
Ubuntuneutron16.042:8.0.0~b2-0ubuntu7vulnerable
Ubuntuneutron16.042:8.0.0~b3-0ubuntu1vulnerable
Ubuntuneutron16.042:8.0.0~rc1-0ubuntu1vulnerable
Ubuntuneutron16.042:8.0.0-0ubuntu1vulnerable
Ubuntuneutron16.042:8.1.0-0ubuntu0.16.04.2vulnerable
Ubuntuneutron16.042:8.1.2-0ubuntu1vulnerable
Ubuntuneutron16.042:8.2.0-0ubuntu1vulnerable
Ubuntuneutron16.042:8.3.0-0ubuntu1vulnerable
Ubuntuneutron16.042:8.3.0-0ubuntu1.1vulnerable
Ubuntuneutron16.042:8.3.0-0ubuntu1.2vulnerable
Ubuntuneutron16.042:8.4.0-0ubuntu1vulnerable
Ubuntuneutron16.042:8.4.0-0ubuntu2vulnerable
Ubuntuneutron16.042:8.4.0-0ubuntu3vulnerable
Ubuntuneutron16.042:8.4.0-0ubuntu4vulnerable
Ubuntuneutron16.042:8.4.0-0ubuntu5vulnerable
Ubuntuneutron16.042:8.4.0-0ubuntu6vulnerable
Ubuntuneutron16.042:8.4.0-0ubuntu7.1vulnerable
Ubuntuneutron16.042:8.4.0-0ubuntu7.2vulnerable
Ubuntuneutron16.042:8.4.0-0ubuntu7.3vulnerable
Ubuntuneutron16.042:8.4.0-0ubuntu7.4vulnerable
Ubuntuneutron16.042:8.4.0-0ubuntu7.5vulnerable
Ubuntuneutron18.042:11.0.1-0ubuntu1vulnerable
Ubuntuneutron18.042:12.0.0~b1-0ubuntu1vulnerable
Ubuntuneutron18.042:12.0.0~b1-0ubuntu2vulnerable
Ubuntuneutron18.042:12.0.0~b2-0ubuntu1vulnerable
Ubuntuneutron18.042:12.0.0~b3-0ubuntu1vulnerable
Ubuntuneutron18.042:12.0.0~rc1-0ubuntu1vulnerable
Ubuntuneutron18.042:12.0.0~rc2-0ubuntu1vulnerable
Ubuntuneutron18.042:12.0.0-0ubuntu1vulnerable
Ubuntuneutron18.042:12.0.0-0ubuntu1.1vulnerable
Ubuntuneutron18.042:12.0.0-0ubuntu1.2vulnerable
Ubuntuneutron18.042:12.0.0-0ubuntu1.3vulnerable
Ubuntuneutron18.042:12.0.0-0ubuntu1.4vulnerable
Ubuntuneutron18.042:12.0.0-0ubuntu2vulnerable
Ubuntuneutron18.042:12.0.0-0ubuntu3vulnerable
Ubuntuneutron18.042:12.0.1-0ubuntu1vulnerable
Ubuntuneutron18.042:12.0.1-0ubuntu1.1vulnerable
Ubuntuneutron18.042:12.0.2-0ubuntu1vulnerable
Ubuntuneutron18.042:12.0.3-0ubuntu1vulnerable
Ubuntuneutron18.042:12.0.5-0ubuntu1vulnerable
Ubuntuneutron18.042:12.0.5-0ubuntu4vulnerable
Ubuntuneutron18.042:12.0.5-0ubuntu5vulnerable
Ubuntuneutron18.042:12.0.6-0ubuntu1vulnerable
Ubuntuneutron18.042:12.0.6-0ubuntu2vulnerable
Ubuntuneutron18.042:12.0.6-0ubuntu3vulnerable
Ubuntuneutron18.042:12.1.0-0ubuntu1vulnerable
Ubuntuneutron18.042:12.1.1-0ubuntu1vulnerable
Ubuntuneutron18.042:12.1.1-0ubuntu2vulnerable
Ubuntuneutron18.042:12.1.1-0ubuntu3vulnerable
Ubuntuneutron18.042:12.1.1-0ubuntu4vulnerable
Ubuntuneutron18.042:12.1.1-0ubuntu7vulnerable
Ubuntuneutron18.042:12.1.1-0ubuntu8vulnerable
Ubuntuneutron18.042:12.1.1-0ubuntu8.1fixed
Ubuntuneutron20.042:15.0.0-0ubuntu1vulnerable
Ubuntuneutron20.042:16.0.0~b1~git2019121613.3e8abb9a8f-0ubuntu1vulnerable
Ubuntuneutron20.042:16.0.0~b2~git2020020712.d5b33ffc77-0ubuntu1vulnerable
Ubuntuneutron20.042:16.0.0~b2~git2020020712.d5b33ffc77-0ubuntu3vulnerable
Ubuntuneutron20.042:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu1vulnerable
Ubuntuneutron20.042:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu2vulnerable
Ubuntuneutron20.042:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu3vulnerable
Ubuntuneutron20.042:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu4vulnerable
Ubuntuneutron20.042:16.0.0~b3~git2020041013.e74c8f8c88-0ubuntu1vulnerable
Ubuntuneutron20.042:16.0.0~b3~git2020041516.5f42488a9a-0ubuntu1vulnerable
Ubuntuneutron20.042:16.0.0~b3~git2020041516.5f42488a9a-0ubuntu2vulnerable
Ubuntuneutron20.042:16.0.0-0ubuntu0.20.04.1vulnerable
Ubuntuneutron20.042:16.0.0-0ubuntu0.20.04.2vulnerable
Ubuntuneutron20.042:16.1.0-0ubuntu1vulnerable
Ubuntuneutron20.042:16.1.0-0ubuntu2vulnerable
Ubuntuneutron20.042:16.2.0-0ubuntu1vulnerable
Ubuntuneutron20.042:16.2.0-0ubuntu2vulnerable
Ubuntuneutron20.042:16.2.0-0ubuntu3vulnerable
Ubuntuneutron20.042:16.3.0-0ubuntu3vulnerable
Ubuntuneutron20.042:16.3.1-0ubuntu1vulnerable
Ubuntuneutron20.042:16.3.1-0ubuntu1.1vulnerable
Ubuntuneutron20.042:16.3.2-0ubuntu2vulnerable
Ubuntuneutron20.042:16.3.2-0ubuntu3vulnerable
Ubuntuneutron20.042:16.4.0-0ubuntu2vulnerable
Ubuntuneutron20.042:16.4.0-0ubuntu3vulnerable
Ubuntuneutron20.042:16.4.1-0ubuntu2vulnerable
Ubuntuneutron20.042:16.4.2-0ubuntu1vulnerable
Ubuntuneutron20.042:16.4.2-0ubuntu2vulnerable
Ubuntuneutron20.042:16.4.2-0ubuntu3vulnerable
Ubuntuneutron20.042:16.4.2-0ubuntu4vulnerable
Ubuntuneutron20.042:16.4.2-0ubuntu5vulnerable
Ubuntuneutron20.042:16.4.2-0ubuntu6vulnerable
Ubuntuneutron20.042:16.4.2-0ubuntu6.1vulnerable
Ubuntuneutron20.042:16.4.2-0ubuntu6.2fixed
Ubuntuneutron22.042:19.0.0-0ubuntu1vulnerable
Ubuntuneutron22.042:19.1.0+git2022030313.b072cbf05f-0ubuntu1vulnerable
Ubuntuneutron22.042:20.0.0-0ubuntu1vulnerable
Ubuntuneutron22.042:20.0.0-0ubuntu2vulnerable
Ubuntuneutron22.042:20.0.0-0ubuntu3vulnerable
Ubuntuneutron22.042:20.1.0-0ubuntu2vulnerable
Ubuntuneutron22.042:20.2.0-0ubuntu1vulnerable
Ubuntuneutron22.042:20.3.0-0ubuntu1vulnerable
Ubuntuneutron22.042:20.3.0-0ubuntu1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianneutronsourcesid2:21.0.0~rc1-3not yet assignedNot reported[1027150]
Debianneutronsourceforky2:21.0.0~rc1-3not yet assignedNot reported[1027150]
Debianneutronsourcetrixie2:21.0.0~rc1-3not yet assignedNot reported[1027150]
Debianneutronsourcebookworm2:21.0.0~rc1-3not yet assignedNot reported[1027150]
Ubuntuneutrondeb18.042:12.1.1-0ubuntu8.1Not reportedUBUNTU-CVE-2022-3277Not reported
Ubuntuneutrondeb20.042:16.4.2-0ubuntu6.2Not reportedUBUNTU-CVE-2022-3277Not reported
Ubuntuneutrondeb22.042:20.3.0-0ubuntu1.1Not reportedUBUNTU-CVE-2022-3277Not reported

[Debian bug #1027150]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [neutron-api]Unknown

    Source package: [neutron]

    Details (4)

    • 2:21.0.0-7 · all · bookworm

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7 · all · bookworm

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

  • [neutron-common]Unknown

    Source package: [neutron]

    Details (4)

    • 2:21.0.0-7 · all · bookworm

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7 · all · bookworm

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

  • [neutron-dhcp-agent]Unknown

    Source package: [neutron]

    Details (4)

    • 2:21.0.0-7 · all · bookworm

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7 · all · bookworm

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

  • [neutron-doc]Unknown

    Source package: [neutron]

    Details (4)

    • 2:21.0.0-7 · all · bookworm

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7 · all · bookworm

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

  • [neutron-l3-agent]Unknown

    Source package: [neutron]

    Details (4)

    • 2:21.0.0-7 · all · bookworm

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7 · all · bookworm

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

  • [neutron-linuxbridge-agent]Unknown

    Source package: [neutron]

    Details (4)

    • 2:21.0.0-7 · all · bookworm

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7 · all · bookworm

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

  • [neutron-macvtap-agent]Unknown

    Source package: [neutron]

    Details (4)

    • 2:21.0.0-7 · all · bookworm

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7 · all · bookworm

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

  • [neutron-metadata-agent]Unknown

    Source package: [neutron]

    Details (4)

    • 2:21.0.0-7 · all · bookworm

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7 · all · bookworm

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

  • [neutron-metering-agent]Unknown

    Source package: [neutron]

    Details (4)

    • 2:21.0.0-7 · all · bookworm

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7 · all · bookworm

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

  • [neutron-openvswitch-agent]Unknown

    Source package: [neutron]

    Details (4)

    • 2:21.0.0-7 · all · bookworm

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7 · all · bookworm

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

  • [neutron-ovn-metadata-agent]Unknown

    Source package: [neutron]

    Details (4)

    • 2:21.0.0-7 · all · bookworm

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7 · all · bookworm

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

  • [neutron-plugin-nec-agent]Unknown

    Source package: [neutron]

    Details (4)

    • 2:21.0.0-7 · all · bookworm

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7 · all · bookworm

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

  • [neutron-rpc-server]Unknown

    Source package: [neutron]

    Details (4)

    • 2:21.0.0-7 · all · bookworm

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7 · all · bookworm

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

  • [neutron-server]Unknown

    Source package: [neutron]

    Details (4)

    • 2:21.0.0-7 · all · bookworm

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7 · all · bookworm

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

  • [neutron-sriov-agent]Unknown

    Source package: [neutron]

    Details (4)

    • 2:21.0.0-7 · all · bookworm

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7 · all · bookworm

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

  • [python3-neutron]Unknown

    Source package: [neutron]

    Details (4)

    • 2:21.0.0-7 · all · bookworm

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7 · all · bookworm

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

    • 2:21.0.0-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2:21.0.0~rc1-3

      dsa · neutron · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]