{"id":"CVE-2023-6110","aliases":["DEBIAN-CVE-2023-6110","EUVD-2024-3179","GHSA-2ppf-2m6f-6v6f","PYSEC-2026-1853","RHSA-2024:2737","RHSA-2024:2769","UBUNTU-CVE-2023-6110","USN-6668-1"],"status":"published","title":"Openstack: deleting a non existing access rule deletes another existing access rule in it's scope","description":"A flaw was found in OpenStack. When a user tries to delete a non-existing access rule in it's scope, it deletes other existing access rules which are not associated with any application credentials.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00523,"percentile":0.44721,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-237"],"published":"2024-02-14T00:00:00Z","modified":"2026-10-26T18:02:56Z","fixes":[{"ecosystem":"PyPI","package":"python-openstackclient","fixed_in":["6.3.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:13","package":"python-openstackclient","fixed_in":["6.3.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-openstackclient","fixed_in":["6.3.0-2"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"python-openstackclient","fixed_in":["0:5.5.2-17.1.20230829210830.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"python-openstackclient-lang","fixed_in":["0:5.5.2-17.1.20230829210830.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"python3-openstackclient","fixed_in":["0:5.5.2-17.1.20230829210830.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el8","package":"python-openstackclient","fixed_in":["0:5.5.2-17.1.20230829213816.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el8","package":"python-openstackclient-lang","fixed_in":["0:5.5.2-17.1.20230829213816.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el8","package":"python3-openstackclient","fixed_in":["0:5.5.2-17.1.20230829213816.el8ost"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"python-openstackclient","fixed_in":["5.2.0-0ubuntu1.20.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"python-openstackclient","fixed_in":["5.8.0-0ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"python-openstackclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-openstackclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.2.1-1","10.3.0-1","10.3.0-2","10.3.0-3","10.3.0-4","10.3.0-5","6.0.0-4","6.1.0-1","6.2.0-1","6.2.0-2","6.2.0-3","6.2.0-4","6.3.0-1","6.3.0-2","6.3.0-3","6.5.0-1","6.5.0-2","6.6.0-1","6.6.0-2","6.6.0-3","6.6.0-4","6.6.0-5","6.6.0-6","7.0.0-1","7.1.0-1","7.1.1-1","7.1.1-2","7.4.0-1","7.4.0-3","8.2.0-1","8.2.0-2","8.2.0-3","8.2.0-4","8.2.0-5","8.2.0-6","8.2.0-7","8.2.0-8","8.2.0-9","9.0.0-1","9.0.0-2","9.0.0-3","9.0.0-4"]},{"source":"osv","ecosystem":"Debian:13","package":"python-openstackclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.0-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-openstackclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.0-2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"python-openstackclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.0"}]}],"versions":["0.1.51","0.2.0","0.2.1","0.2.2","0.3.0","0.3.1","0.4.0","0.4.1","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.1.0","1.2.0","1.3.0","1.4.0","1.5.0","1.6.0","1.7.0","1.7.1","1.7.2","1.8.0","1.9.0","2.0.0","2.1.0","2.2.0","2.3.0","2.3.1","2.4.0","2.5.0","2.6.0","3.0.0","3.0.1","3.1.0","3.10.0","3.11.0","3.12.0","3.12.1","3.12.2","3.13.0","3.14.0","3.14.1","3.14.2","3.14.3","3.15.0","3.16.0","3.16.1","3.16.2","3.16.3","3.17.0","3.18.0","3.18.1","3.19.0","3.2.0","3.2.1","3.3.0","3.4.0","3.4.1","3.5.0","3.6.0","3.7.0","3.8.0","3.8.1","3.8.2","3.9.0","4.0.0","4.0.1","4.0.2","5.0.0","5.1.0","5.2.0","5.2.1","5.2.2","5.3.0","5.3.1","5.4.0","5.5.0","5.5.1","5.6.0","5.6.1","5.6.2","5.7.0","5.8.0","5.8.1","6.0.0","6.0.1","6.1.0","6.2.0","6.2.1"]},{"source":"osv","ecosystem":"PyPI","package":"python-openstackclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.0"}]}],"versions":["0.1.51","0.2.0","0.2.1","0.2.2","0.3.0","0.3.1","0.4.0","0.4.1","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.1.0","1.2.0","1.3.0","1.4.0","1.5.0","1.6.0","1.7.0","1.7.1","1.7.2","1.8.0","1.9.0","2.0.0","2.1.0","2.2.0","2.3.0","2.3.1","2.4.0","2.5.0","2.6.0","3.0.0","3.0.1","3.1.0","3.10.0","3.11.0","3.12.0","3.12.1","3.12.2","3.13.0","3.14.0","3.14.1","3.14.2","3.14.3","3.15.0","3.16.0","3.16.1","3.16.2","3.16.3","3.17.0","3.18.0","3.18.1","3.19.0","3.2.0","3.2.1","3.3.0","3.4.0","3.4.1","3.5.0","3.6.0","3.7.0","3.8.0","3.8.1","3.8.2","3.9.0","4.0.0","4.0.1","4.0.2","5.0.0","5.1.0","5.2.0","5.2.1","5.2.2","5.3.0","5.3.1","5.4.0","5.5.0","5.5.1","5.6.0","5.6.1","5.6.2","5.7.0","5.8.0","5.8.1","6.0.0","6.0.1","6.1.0","6.2.0","6.2.1"]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"python-openstackclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.2-17.1.20230829210830.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"python-openstackclient-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.2-17.1.20230829210830.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"python3-openstackclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.2-17.1.20230829210830.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el8","package":"python-openstackclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.2-17.1.20230829213816.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el8","package":"python-openstackclient-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.2-17.1.20230829213816.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el8","package":"python3-openstackclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.2-17.1.20230829213816.el8ost"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python-openstackclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.0-1","1.7.1-1","2.0.0-3","2.1.0-0ubuntu2","2.2.0-0ubuntu1","2.3.0-2","2.3.1-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-openstackclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.12.0-0ubuntu2","3.13.0-0ubuntu1","3.14.0-0ubuntu1","3.14.2-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"python-openstackclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-0ubuntu1.20.04.2"}]}],"versions":["4.0.0-0ubuntu1","4.0.0-0ubuntu2","5.2.0-0ubuntu1","5.2.0-0ubuntu1.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-openstackclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.0-0ubuntu1.1"}]}],"versions":["5.6.0-0ubuntu1","5.6.0-0ubuntu2","5.7.0-0ubuntu1","5.8.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"python-openstackclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-0ubuntu1.20.04.2"}]}],"versions":["4.0.0-0ubuntu1","4.0.0-0ubuntu2","5.2.0-0ubuntu1","5.2.0-0ubuntu1.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-openstackclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.0-0ubuntu1.1"}]}],"versions":["5.6.0-0ubuntu1","5.6.0-0ubuntu2","5.7.0-0ubuntu1","5.8.0-0ubuntu1"]}],"products":[{"vendor":"red hat","product":"red hat openstack platform 16.1"},{"vendor":"red hat","product":"red hat openstack platform 16.2"},{"vendor":"red hat","product":"red hat openstack platform 17.0"},{"vendor":"red hat","product":"red hat openstack platform 17.1 for rhel 8"},{"vendor":"red hat","product":"red hat openstack platform 17.1 for rhel 9"},{"vendor":"red hat","product":"red hat openstack platform 18.0"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:2737","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:2769","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-6110","tags":["vdb-entry","x_refsource_REDHAT","web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2212960","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://code.engineering.redhat.com/gerrit/gitweb?p=python-openstackclient.git;a=commit;h=7a7c364bdd7b2cd2b56e73724110710a68d58abf","tags":["web","article"]},{"url":"https://review.opendev.org/c/openstack/python-openstackclient/+/888697","tags":["web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6110","tags":["advisory"]},{"url":"https://github.com/openstack/python-openstackclient/commit/bc60e3bb908a7f10c87993d791184bfe46784d6c","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2ppf-2m6f-6v6f","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-6110","tags":["advisory"]},{"url":"https://github.com/openstack/python-openstackclient","tags":["package"]},{"url":"https://pypi.org/project/python-openstackclient","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2209607","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2737.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-6110","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2279562","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2769.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-6110","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6668-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-6110","title":"Openstack: deleting a non existing access rule deletes another existing access rule in it's scope","description":"A flaw was found in OpenStack. When a user tries to delete a non-existing access rule in it's scope, it deletes other existing access rules which are not associated with any application credentials.","status":"published","published":"2024-11-17T10:22:34.776Z","modified":"2024-12-05T20:30:27.043Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-237"],"updated_at":"2026-11-02T14:35:25.469654Z"}],"euvd":[{"id":"EUVD-2024-3179","description":"A flaw was found in OpenStack. When a user tries to delete a non-existing access rule in it's scope, it deletes other existing access rules which are not associated with any application credentials.","status":"published","published":"2024-11-17T10:22:34Z","modified":"2024-12-05T20:30:27Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:04:39.661841Z"}],"ghsa":[{"id":"GHSA-2ppf-2m6f-6v6f","title":" OpenStack improperly deletes access rules","description":"A flaw was found in OpenStack. When a user tries to delete a non-existing access rule in it's scope, it deletes other existing access rules which are not associated with any application credentials.","status":"published","published":"2024-11-17T12:30:29Z","modified":"2024-12-05T22:17:58Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-237"],"updated_at":"2026-11-02T14:38:24.542211Z"}],"nvd":[{"id":"CVE-2023-6110","description":"A flaw was found in OpenStack. When a user tries to delete a non-existing access rule in it's scope, it deletes other existing access rules which are not associated with any application credentials.","status":"published","published":"2024-11-17T11:15:06.097Z","modified":"2026-06-17T06:50:03.047Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-237"],"updated_at":"2026-11-02T14:09:19.052418Z"}],"osv":[{"id":"DEBIAN-CVE-2023-6110","description":"A flaw was found in OpenStack. When a user tries to delete a non-existing access rule in it's scope, it deletes other existing access rules which are not associated with any application credentials.","status":"published","published":"2024-11-17T11:15:06.097Z","modified":"2026-10-26T18:02:56.977364056Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:41.533064Z"},{"id":"GHSA-2ppf-2m6f-6v6f","title":" OpenStack improperly deletes access rules","description":"A flaw was found in OpenStack. When a user tries to delete a non-existing access rule in it's scope, it deletes other existing access rules which are not associated with any application credentials.","status":"published","published":"2024-11-17T12:30:29Z","modified":"2026-07-07T17:56:20.517694498Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-237"],"updated_at":"2026-11-02T15:46:34.700741Z"},{"id":"PYSEC-2026-1853","title":" OpenStack improperly deletes access rules","description":"A flaw was found in OpenStack. When a user tries to delete a non-existing access rule in it's scope, it deletes other existing access rules which are not associated with any application credentials.","status":"published","published":"2026-07-07T14:34:44.818046Z","modified":"2026-07-07T17:48:07.573872159Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:55.06457Z"},{"id":"RHSA-2024:2737","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (python-openstackclient) security update","status":"published","published":"2024-09-16T18:30:42Z","modified":"2026-08-01T10:04:19Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:2769","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (python-openstackclient) security update","status":"published","published":"2024-09-16T18:30:50Z","modified":"2026-08-01T10:04:20Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"UBUNTU-CVE-2023-6110","description":"A flaw was found in OpenStack. When a user tries to delete a non-existing access rule in it's scope, it deletes other existing access rules which are not associated with any application credentials.","status":"published","published":"2024-02-14T00:00:00Z","modified":"2026-02-04T04:15:09.858352Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:54:41.555387Z"},{"id":"CVE-2023-6110","description":"A flaw was found in OpenStack. When a user tries to delete a non-existing access rule in it's scope, it deletes other existing access rules which are not associated with any application credentials.","status":"published","published":"2024-11-17T11:15:06Z","modified":"2026-07-07T17:56:20.517694498Z","updated_at":"2026-11-02T15:44:36.851042Z"},{"id":"USN-6668-1","title":"python-openstackclient vulnerability","description":"It was discovered that when python-openstackclient attempted to delete a\nnon-existing access rule, it would delete another existing access rule\ninstead, contrary to expectations.\n","status":"published","published":"2024-02-28T13:35:43Z","modified":"2026-04-27T17:06:21.05696Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}