{"id":"CVE-2023-3637","state":"PUBLISHED","title":"Openstack-neutron: unrestricted creation of security groups (fix for cve-2022-3277)","description":"An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.","publishedAt":"2023-07-25T12:47:31.531Z","updatedAt":"2025-11-20T17:39:47.319Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","source":"redhat"},"assigner":"redhat","products":["Red Hat Red Hat OpenStack Platform 16.2","Red Hat Red Hat OpenStack Platform 13 (Queens) Operational Tools","Red Hat Red Hat OpenStack Platform 16.1","Red Hat Red Hat OpenStack Platform 17.0","Red Hat Red Hat OpenStack Platform 17.1","Red Hat Red Hat OpenStack Platform 18.0"],"affected":[{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 16.2","packageName":"openstack-neutron","defaultStatus":"affected","versions":[{"version":"1:15.3.5-2.20230216175503.el8ost","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:16.2::el8"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 13 (Queens) Operational Tools","packageName":"openstack-neutron","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack-optools:13"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 16.1","packageName":"openstack-neutron","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:16.1"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 17.0","packageName":"openstack-neutron","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:17.0"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 17.1","packageName":"openstack-neutron","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:17.1"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 18.0","packageName":"openstack-neutron","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:18.0"]}],"references":["https://access.redhat.com/errata/RHSA-2023:4283","https://access.redhat.com/security/cve/CVE-2023-3637","https://bugzilla.redhat.com/show_bug.cgi?id=2222270"],"weaknesses":["CWE-400"],"ingestedAt":"2026-10-29T20:06:08.715Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/3xxx/CVE-2023-3637.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-3637","state":"PUBLISHED","datePublished":"2023-07-25T12:47:31.531Z","dateUpdated":"2025-11-20T17:39:47.319Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2023-07-12T13:34:14.699Z"},"containers":{"cna":{"title":"Openstack-neutron: unrestricted creation of security groups (fix for cve-2022-3277)","descriptions":[{"lang":"en","value":"An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service."}],"affected":[{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 16.2","packageName":"openstack-neutron","defaultStatus":"affected","versions":[{"version":"1:15.3.5-2.20230216175503.el8ost","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:16.2::el8"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 13 (Queens) Operational Tools","packageName":"openstack-neutron","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack-optools:13"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 16.1","packageName":"openstack-neutron","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:16.1"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 17.0","packageName":"openstack-neutron","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:17.0"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 17.1","packageName":"openstack-neutron","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:17.1"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 18.0","packageName":"openstack-neutron","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:18.0"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2023:4283","name":"RHSA-2023:4283","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-3637","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2222270","name":"RHBZ#2222270","tags":["issue-tracking","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-400","description":"Uncontrolled Resource Consumption","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2025-11-20T17:39:47.319Z"},"datePublic":"2023-07-12T00:00:00.000Z","x_redhatCweChain":"CWE-400: Uncontrolled Resource Consumption","timeline":[{"lang":"en","time":"2023-07-12T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2023-07-12T00:00:00.000Z","value":"Made public."}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2023-3637","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-04-25T18:48:25.414001Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-04T17:17:33.214Z"}},{"title":"CVE Program Container","references":[{"url":"https://access.redhat.com/errata/RHSA-2023:4283","name":"RHSA-2023:4283","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-3637","tags":["vdb-entry","x_refsource_REDHAT","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2222270","name":"RHBZ#2222270","tags":["issue-tracking","x_refsource_REDHAT","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T07:01:57.259Z"}}]}}}