CVE-2014-0592

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-04-04 · updated 2026-06-17
Weakness: CWE-264

Description

Barclamp (aka barclamp-network) 1.7 for the Crowbar Framework, as used in SUSE Cloud 3, does not enable netfilter on bridges when creating new instances, which allows remote attackers to bypass security group restrictions via unspecified vectors, related to floating IPs.

Affected products

Crowbar Barclamp: 1.7
Novell Suse Cloud: 3.0

References

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00025.html
http://secunia.com/advisories/57509
http://www.securityfocus.com/bid/66519
https://bugzilla.novell.com/show_bug.cgi?id=864183
https://github.com/crowbar/barclamp-network/pull/269
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00025.html
http://secunia.com/advisories/57509
http://www.securityfocus.com/bid/66519
https://bugzilla.novell.com/show_bug.cgi?id=864183
https://github.com/crowbar/barclamp-network/pull/269

Get alerted when CVE-2014-0592 or the next vulnerability affects your stack