CVE-2016-5362
OpenStack Neutron allows remote attackers to bypass an intended DHCP-spoofing protection mechanism
CVE-2016-5362 is a high vulnerability (CVSS 8.2) in Openstack Neutron, published June 17, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.44%, the 89th percentile. Fixed in neutron 7.0.5.
- Severity
- 8.2 HighCVSS 3.0, NVD
- Exploit chance
- 3.44%EPSS, 89th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
7.0.5neutron +77 more
Description
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended DHCP-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a crafted DHCP discovery message.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
neutronPyPI | before 7.0.5 | 7.0.5 |
neutronPyPI | 8.0.0 up to 8.1.1 | 8.1.1 |
neutronDebian:12 | before 2:8.1.2-1 | 2:8.1.2-1 |
neutronDebian:13 | before 2:8.1.2-1 | 2:8.1.2-1 |
neutronDebian:14 | before 2:8.1.2-1 | 2:8.1.2-1 |
neutronPyPI | before 7.0.5, plus listed versions 0.0 | 7.0.5 |
neutronPyPI | before 7.0.5, 8.0.0 up to 8.1.1, plus listed versions 0.0 | 7.0.58.1.1 |
openstack-neutronRed Hat:openstack:8::el7 From an advisory covering 3 CVEs | before 1:7.0.4-11.el7ost | 1:7.0.4-11.el7ost |
openstack-neutron-bigswitchRed Hat:openstack:8::el7 From an advisory covering 3 CVEs | before 1:7.0.4-11.el7ost | 1:7.0.4-11.el7ost |
openstack-neutron-brocadeRed Hat:openstack:8::el7 From an advisory covering 3 CVEs | before 1:7.0.4-11.el7ost | 1:7.0.4-11.el7ost |
Show 68 moreShow less
| Package | Affected | Fixed |
|---|---|---|
openstack-neutron-ciscoRed Hat:openstack:8::el7 From an advisory covering 3 CVEs | before 1:7.0.4-11.el7ost | 1:7.0.4-11.el7ost |
openstack-neutron-commonRed Hat:openstack:8::el7 From an advisory covering 3 CVEs | before 1:7.0.4-11.el7ost | 1:7.0.4-11.el7ost |
openstack-neutron-dev-serverRed Hat:openstack:8::el7 From an advisory covering 3 CVEs | before 1:7.0.4-11.el7ost | 1:7.0.4-11.el7ost |
openstack-neutron-embraneRed Hat:openstack:8::el7 From an advisory covering 3 CVEs | before 1:7.0.4-11.el7ost | 1:7.0.4-11.el7ost |
openstack-neutron-linuxbridgeRed Hat:openstack:8::el7 From an advisory covering 3 CVEs | before 1:7.0.4-11.el7ost | 1:7.0.4-11.el7ost |
openstack-neutron-mellanoxRed Hat:openstack:8::el7 From an advisory covering 3 CVEs | before 1:7.0.4-11.el7ost | 1:7.0.4-11.el7ost |
openstack-neutron-metering-agentRed Hat:openstack:8::el7 From an advisory covering 3 CVEs | before 1:7.0.4-11.el7ost | 1:7.0.4-11.el7ost |
openstack-neutron-midonetRed Hat:openstack:8::el7 From an advisory covering 3 CVEs | before 1:7.0.4-11.el7ost | 1:7.0.4-11.el7ost |
openstack-neutron-ml2Red Hat:openstack:8::el7 From an advisory covering 3 CVEs | before 1:7.0.4-11.el7ost | 1:7.0.4-11.el7ost |
openstack-neutron-nuageRed Hat:openstack:8::el7 From an advisory covering 3 CVEs | before 1:7.0.4-11.el7ost | 1:7.0.4-11.el7ost |
openstack-neutron-ofagentRed Hat:openstack:8::el7 From an advisory covering 3 CVEs | before 1:7.0.4-11.el7ost | 1:7.0.4-11.el7ost |
openstack-neutron-oneconvergence-nvsdRed Hat:openstack:8::el7 From an advisory covering 3 CVEs | before 1:7.0.4-11.el7ost | 1:7.0.4-11.el7ost |
openstack-neutron-opencontrailRed Hat:openstack:8::el7 From an advisory covering 3 CVEs | before 1:7.0.4-11.el7ost | 1:7.0.4-11.el7ost |
openstack-neutron-openvswitchRed Hat:openstack:8::el7 From an advisory covering 3 CVEs | before 1:7.0.4-11.el7ost | 1:7.0.4-11.el7ost |
openstack-neutron-ovsvappRed Hat:openstack:8::el7 From an advisory covering 3 CVEs | before 1:7.0.4-11.el7ost | 1:7.0.4-11.el7ost |
openstack-neutron-rpc-serverRed Hat:openstack:8::el7 From an advisory covering 3 CVEs | before 1:7.0.4-11.el7ost | 1:7.0.4-11.el7ost |
openstack-neutron-sriov-nic-agentRed Hat:openstack:8::el7 From an advisory covering 3 CVEs | before 1:7.0.4-11.el7ost | 1:7.0.4-11.el7ost |
python-neutronRed Hat:openstack:8::el7 From an advisory covering 3 CVEs | before 1:7.0.4-11.el7ost | 1:7.0.4-11.el7ost |
python-neutron-testsRed Hat:openstack:8::el7 From an advisory covering 3 CVEs | before 1:7.0.4-11.el7ost | 1:7.0.4-11.el7ost |
openstack-neutronRed Hat:openstack:7::el7 From an advisory covering 3 CVEs | before 0:2015.1.4-2.el7ost | 0:2015.1.4-2.el7ost |
openstack-neutron-bigswitchRed Hat:openstack:7::el7 From an advisory covering 3 CVEs | before 0:2015.1.4-2.el7ost | 0:2015.1.4-2.el7ost |
openstack-neutron-brocadeRed Hat:openstack:7::el7 From an advisory covering 3 CVEs | before 0:2015.1.4-2.el7ost | 0:2015.1.4-2.el7ost |
openstack-neutron-ciscoRed Hat:openstack:7::el7 From an advisory covering 3 CVEs | before 0:2015.1.4-2.el7ost | 0:2015.1.4-2.el7ost |
openstack-neutron-commonRed Hat:openstack:7::el7 From an advisory covering 3 CVEs | before 0:2015.1.4-2.el7ost | 0:2015.1.4-2.el7ost |
openstack-neutron-embraneRed Hat:openstack:7::el7 From an advisory covering 3 CVEs | before 0:2015.1.4-2.el7ost | 0:2015.1.4-2.el7ost |
openstack-neutron-ibmRed Hat:openstack:7::el7 From an advisory covering 3 CVEs | before 0:2015.1.4-2.el7ost | 0:2015.1.4-2.el7ost |
openstack-neutron-linuxbridgeRed Hat:openstack:7::el7 From an advisory covering 3 CVEs | before 0:2015.1.4-2.el7ost | 0:2015.1.4-2.el7ost |
openstack-neutron-mellanoxRed Hat:openstack:7::el7 From an advisory covering 3 CVEs | before 0:2015.1.4-2.el7ost | 0:2015.1.4-2.el7ost |
openstack-neutron-metapluginRed Hat:openstack:7::el7 From an advisory covering 3 CVEs | before 0:2015.1.4-2.el7ost | 0:2015.1.4-2.el7ost |
openstack-neutron-metering-agentRed Hat:openstack:7::el7 From an advisory covering 3 CVEs | before 0:2015.1.4-2.el7ost | 0:2015.1.4-2.el7ost |
openstack-neutron-midonetRed Hat:openstack:7::el7 From an advisory covering 3 CVEs | before 0:2015.1.4-2.el7ost | 0:2015.1.4-2.el7ost |
openstack-neutron-ml2Red Hat:openstack:7::el7 From an advisory covering 3 CVEs | before 0:2015.1.4-2.el7ost | 0:2015.1.4-2.el7ost |
openstack-neutron-necRed Hat:openstack:7::el7 From an advisory covering 3 CVEs | before 0:2015.1.4-2.el7ost | 0:2015.1.4-2.el7ost |
openstack-neutron-nuageRed Hat:openstack:7::el7 From an advisory covering 3 CVEs | before 0:2015.1.4-2.el7ost | 0:2015.1.4-2.el7ost |
openstack-neutron-ofagentRed Hat:openstack:7::el7 From an advisory covering 3 CVEs | before 0:2015.1.4-2.el7ost | 0:2015.1.4-2.el7ost |
openstack-neutron-oneconvergence-nvsdRed Hat:openstack:7::el7 From an advisory covering 3 CVEs | before 0:2015.1.4-2.el7ost | 0:2015.1.4-2.el7ost |
openstack-neutron-opencontrailRed Hat:openstack:7::el7 From an advisory covering 3 CVEs | before 0:2015.1.4-2.el7ost | 0:2015.1.4-2.el7ost |
openstack-neutron-openvswitchRed Hat:openstack:7::el7 From an advisory covering 3 CVEs | before 0:2015.1.4-2.el7ost | 0:2015.1.4-2.el7ost |
openstack-neutron-ovsvappRed Hat:openstack:7::el7 From an advisory covering 3 CVEs | before 0:2015.1.4-2.el7ost | 0:2015.1.4-2.el7ost |
openstack-neutron-plumgridRed Hat:openstack:7::el7 From an advisory covering 3 CVEs | before 0:2015.1.4-2.el7ost | 0:2015.1.4-2.el7ost |
openstack-neutron-sriov-nic-agentRed Hat:openstack:7::el7 From an advisory covering 3 CVEs | before 0:2015.1.4-2.el7ost | 0:2015.1.4-2.el7ost |
openstack-neutron-vmwareRed Hat:openstack:7::el7 From an advisory covering 3 CVEs | before 0:2015.1.4-2.el7ost | 0:2015.1.4-2.el7ost |
python-neutronRed Hat:openstack:7::el7 From an advisory covering 3 CVEs | before 0:2015.1.4-2.el7ost | 0:2015.1.4-2.el7ost |
python-neutron-testsRed Hat:openstack:7::el7 From an advisory covering 3 CVEs | before 0:2015.1.4-2.el7ost | 0:2015.1.4-2.el7ost |
openstack-ceilometerSUSE:OpenStack Cloud 6 From an advisory covering 4 CVEs | before 5.0.4~a0~dev6-6.1 | 5.0.4~a0~dev6-6.1 |
openstack-ceilometer-docSUSE:OpenStack Cloud 6 From an advisory covering 4 CVEs | before 5.0.4~a0~dev6-6.2 | 5.0.4~a0~dev6-6.2 |
openstack-cinderSUSE:OpenStack Cloud 6 From an advisory covering 4 CVEs | before 7.0.3~a0~dev2-7.1 | 7.0.3~a0~dev2-7.1 |
openstack-cinder-docSUSE:OpenStack Cloud 6 From an advisory covering 4 CVEs | before 7.0.3~a0~dev2-7.1 | 7.0.3~a0~dev2-7.1 |
openstack-dashboardSUSE:OpenStack Cloud 6 From an advisory covering 4 CVEs | before 8.0.2~a0~dev34-8.1 | 8.0.2~a0~dev34-8.1 |
openstack-glanceSUSE:OpenStack Cloud 6 From an advisory covering 4 CVEs | before 11.0.2~a0~dev13-7.1 | 11.0.2~a0~dev13-7.1 |
openstack-glance-docSUSE:OpenStack Cloud 6 From an advisory covering 4 CVEs | before 11.0.2~a0~dev13-7.1 | 11.0.2~a0~dev13-7.1 |
openstack-heatSUSE:OpenStack Cloud 6 From an advisory covering 4 CVEs | before 5.0.2~a0~dev93-9.1 | 5.0.2~a0~dev93-9.1 |
openstack-heat-docSUSE:OpenStack Cloud 6 From an advisory covering 4 CVEs | before 5.0.2~a0~dev93-9.3 | 5.0.2~a0~dev93-9.3 |
openstack-keystoneSUSE:OpenStack Cloud 6 From an advisory covering 4 CVEs | before 8.1.1~a0~dev13-3.1 | 8.1.1~a0~dev13-3.1 |
openstack-keystone-docSUSE:OpenStack Cloud 6 From an advisory covering 4 CVEs | before 8.1.1~a0~dev13-3.2 | 8.1.1~a0~dev13-3.2 |
openstack-manilaSUSE:OpenStack Cloud 6 From an advisory covering 4 CVEs | before 1.0.2~a0~dev11-9.1 | 1.0.2~a0~dev11-9.1 |
openstack-manila-docSUSE:OpenStack Cloud 6 From an advisory covering 4 CVEs | before 1.0.2~a0~dev11-9.2 | 1.0.2~a0~dev11-9.2 |
openstack-neutronSUSE:OpenStack Cloud 6 From an advisory covering 4 CVEs | before 7.1.2~a0~dev29-10.1 | 7.1.2~a0~dev29-10.1 |
openstack-neutron-docSUSE:OpenStack Cloud 6 From an advisory covering 4 CVEs | before 7.1.2~a0~dev29-10.1 | 7.1.2~a0~dev29-10.1 |
openstack-neutron-fwaasSUSE:OpenStack Cloud 6 From an advisory covering 4 CVEs | before 7.1.2~a0~dev1-6.1 | 7.1.2~a0~dev1-6.1 |
openstack-neutron-fwaas-docSUSE:OpenStack Cloud 6 From an advisory covering 4 CVEs | before 7.1.2~a0~dev1-6.1 | 7.1.2~a0~dev1-6.1 |
openstack-neutron-lbaasSUSE:OpenStack Cloud 6 From an advisory covering 4 CVEs | before 7.1.2~a0~dev1-6.1 | 7.1.2~a0~dev1-6.1 |
openstack-neutron-lbaas-docSUSE:OpenStack Cloud 6 From an advisory covering 4 CVEs | before 7.1.2~a0~dev1-6.1 | 7.1.2~a0~dev1-6.1 |
openstack-novaSUSE:OpenStack Cloud 6 From an advisory covering 4 CVEs | before 12.0.5~a0~dev2-7.1 | 12.0.5~a0~dev2-7.1 |
openstack-nova-docSUSE:OpenStack Cloud 6 From an advisory covering 4 CVEs | before 12.0.5~a0~dev2-7.1 | 12.0.5~a0~dev2-7.1 |
openstack-resource-agentsSUSE:OpenStack Cloud 6 From an advisory covering 4 CVEs | before 1.0+git.1467079370.4f2c49d-7.1 | 1.0+git.1467079370.4f2c49d-7.1 |
python-networking-ciscoSUSE:OpenStack Cloud 6 From an advisory covering 4 CVEs | before 2.1.1-6.1 | 2.1.1-6.1 |
python-openstackclientSUSE:OpenStack Cloud 6 From an advisory covering 4 CVEs | before 1.7.2-4.1 | 1.7.2-4.1 |
What each source reports
NVD Score used
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended DHCP-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a crafted DHCP discovery message.
- Record
CVE-2016-5362- CVSS 3.0
- 8.2 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H - CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:P - Weakness
- CWE-254
- Updated
- 2026-11-02
CVE ListNo score
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended DHCP-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a crafted DHCP discovery message.
- Record
CVE-2016-5362- Updated
- 2026-11-02
EUVDEUVD-2016-6313No score
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended DHCP-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a crafted DHCP discovery message.
- Record
EUVD-2016-6313- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qpwc-p365-pqrr
OpenStack Neutron allows remote attackers to bypass an intended DHCP-spoofing protection mechanism
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended DHCP-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a crafted DHCP discovery message.
- Record
GHSA-qpwc-p365-pqrr- CVSS 3.0
- 8.2 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H - Weakness
- CWE-923
- Updated
- 2026-11-02
OSV
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended DHCP-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a crafted DHCP discovery message.
- Record
CVE-2016-5362- CVSS 3.0
- 8.2 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-5362
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended DHCP-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a crafted DHCP discovery message.
- Record
DEBIAN-CVE-2016-5362- CVSS 3.0
- 8.2 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-qpwc-p365-pqrr
OpenStack Neutron allows remote attackers to bypass an intended DHCP-spoofing protection mechanism
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended DHCP-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a crafted DHCP discovery message.
- Record
GHSA-qpwc-p365-pqrr- CVSS 3.0
- 8.2 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H - Weakness
- CWE-923
- Updated
- 2026-11-02
OSVPYSEC-2026-854
OpenStack Neutron allows remote attackers to bypass an intended DHCP-spoofing protection mechanism
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended DHCP-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a crafted DHCP discovery message.
- Record
PYSEC-2026-854- CVSS 3.0
- 8.2 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2016:1473
Red Hat Security Advisory: openstack-neutron security and bug fix update
- Record
RHSA-2016:1473- CVSS 3.0
- 6.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRHSA-2016:1474
Red Hat Security Advisory: openstack-neutron security, bug fix, and enhancement update
- Record
RHSA-2016:1474- CVSS 3.0
- 6.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-5362
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended DHCP-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a crafted DHCP discovery message.
- Record
UBUNTU-CVE-2016-5362- CVSS 3.0
- 8.2 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
OSVSUSE-SU-2016:2143-1No score
Security update for several openstack-components
This update provides the latest code from OpenStack Liberty for openstack-ceilometer, -cinder, -dashboard, -glance, -heat, -keystone, -manila, -neutron, -neutron-fwaas, -neutron-lbaas,-nova, -resource-agents, python-networking-cisco and python-openstackclient.
Additionally some security-issues have been fixed:
openstack-nova:
- Always copy or recreate disk.info during a migration. (bsc#970258, CVE-2016-2140)
openstack-dashboard:
- Escape anularjs templating in unsafe HTML. (bsc#983807, CVE-2016-4428)
openstack-neutron:
- Fix bypassing of anti-spoof protection. (bsc#984443, CVE-2016-5363, bsc#984442, CVE-2016-5362)
For a detailed description of all fixes and improvements, please refer to the changelog.
- Record
SUSE-SU-2016:2143-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
access.redhat.com/errata/RHSA-2016:1473
openwall.com/lists/oss-security/2016/06/10/5
security.openstack.org/ossa/OSSA-2016-009.html
bugs.launchpad.net/neutron/+bug/1558658
review.openstack.org
Show 37 moreShow less
nvd.nist.gov/vuln/detail/CVE-2016-5362
github.com/advisories/GHSA-qpwc-p365-pqrr
security-tracker.debian.org/tracker/CVE-2016-5362
pypi.org/project/neutron
bugzilla.redhat.com/show_bug.cgi?id=1330778
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1473.json
cve.org/CVERecord?id=CVE-2015-8914
suse.com/support/update/announcement/2016/suse-su-20162143-1
bugzilla.suse.com/970258
ubuntu.com/security/CVE-2016-5362
seclists.org/oss-sec/2016/q2/519