CVE-2022-3277

Name	CVE-2022-3277
Description	An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1027150

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
neutron (PTS)	bullseye (security), bullseye	2:17.2.1-0+deb11u1	vulnerable
	bookworm	2:21.0.0-7	fixed
	trixie	2:26.0.0-9	fixed
	forky, sid	2:27.0.1-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
neutron	source	(unstable)	2:21.0.0~rc1-3			1027150

Notes

[bullseye] - neutron <no-dsa> (Minor issue)
[buster] - neutron <no-dsa> (Minor issue)
https://bugzilla.redhat.com/show_bug.cgi?id=2129193
When fixing this issue this might open CVE-2023-3637 if fixed incompletely.
https://review.opendev.org/q/Ieef7011f48cd2188d4254ff16d90a6465bbabfe3
https://opendev.org/openstack/neutron/commit/01fc2b9195f999df4d810df4ee63f77ecbc81f7e