Skip to content
Fencer Intel
medium 4.0

CVE-2015-3221 json

OpenStack Neutron Improper Input Validation vulnerability

published 2015-08-26 11 y ago modified 2026-08-07 3 mo ago also GHSA-wf44-4mgj-rwvx , PYSEC-2026-856 , EUVD-2022-5559

cvss
4.0
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
11.4%
EPSS 11.4% chance of exploitation in 30 days, percentile 96%
public exploits
1
Exploit-DB

Summary

OpenStack Neutron before 2014.2.4 (juno) and 2015.1.x before 2015.1.1 (kilo), when using the IPTables firewall driver, allows remote authenticated users to cause a denial of service (L2 agent crash) by adding an address pair that is rejected by the ipset tool.

Patch / fix

  • pypi neutron 2014.2.4, 2015.1.1
  • openstack neutron 2014.2.4, 2015.1.1
  • neutron Debian 14, Debian 13, Debian 12 2015.1.0+2015.06.24.git61.bdf194a0e1-1

debian advisories DEBIAN-CVE-2015-3221

  • openstack-neutron openstack 6 2014.2.3-9.el7ost
  • python-neutron openstack 6 2014.2.3-9.el7ost
  • openstack-neutron-ibm openstack 6 2014.2.3-9.el7ost
  • openstack-neutron-ml2 openstack 6 2014.2.3-9.el7ost
  • openstack-neutron-nec openstack 6 2014.2.3-9.el7ost
  • openstack-neutron-ryu openstack 6 2014.2.3-9.el7ost
  • openstack-neutron-cisco openstack 6 2014.2.3-9.el7ost
  • openstack-neutron-nuage openstack 6 2014.2.3-9.el7ost

red hat advisories RHSA-2015:1680

  • openstack-nova Cloud Compute Node for SUSE Linux Enterprise 12 5 2014.2.4~a0~dev80-14.1
  • openstack-neutron Cloud Compute Node for SUSE Linux Enterprise 12 5 2014.2.4~a0~dev103-10.3
  • python-python-memcached Cloud Compute Node for SUSE Linux Enterprise 12 5 1.54-2.1
  • openstack-neutron OpenStack Cloud 5 2014.2.4~a0~dev103-16.2
  • crowbar-barclamp-neutron OpenStack Cloud 5 1.9+git.1443859419.95e948a-12.2

suse advisories SUSE-SU-2015:2220-1SUSE-SU-2015:1890-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2015-3221 updated cvss 4.0

openstack-neutron: L2 agent DoS through incorrect allowed address pairs

  • Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 python-neutron 2014.2.3-9.el7ost, openstack-neutron 2014.2.3-9.el7ost, openstack-neutron-ibm 2014.2.3-9.el7ost, openstack-neutron-ml2 2014.2.3-9.el7ost, openstack-neutron-nec 2014.2.3-9.el7ost, openstack-neutron-ryu 2014.2.3-9.el7ost, +20 more
    fixed: vendor fix RHSA-2015:1680
  • Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse) openstack-neutron Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) python-neutron, openstack-neutron, python-neutron-tests, openstack-neutron-ibm, openstack-neutron-ml2, openstack-neutron-nec, +19 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (EDB-37360)
  2. Published

Exploit prediction

11.43% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • EDB-37360 GeniXCMS 0.0.3 - Cross-Site Scripting webapps, 2015-06-24

CVSS scores

assigned by version score vector
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:N/I:N/A:P

Affected packages

ecosystem package affected fixed in
pypi neutron
>=2000, <2014.2.4
>=2015.1.0, <2015.1.1
<2014.2.4
2014.2.4
2015.1.1

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.