CVE-2019-9735: Medium severity Openstack Neutron vulnerability
An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By setting a destination port in a security group rule along with a protocol that doesn't support that option (for example, VRRP), an authenticated user may block further application of security group rules for instances from any project/tenant on the compute hosts to which it's applied. (Only deployments using the iptables security group driver are affected.)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/neutronto a version that resolves this vulnerability.Fixed in 13.0.3 - Upgrade
Upgrade
pip/neutronto a version that resolves this vulnerability.Fixed in 12.0.6 - Upgrade
Upgrade
pip/neutronto a version that resolves this vulnerability.Fixed in 11.0.7 - Upgrade
Upgrade
pip/neutronto a version that resolves this vulnerability.Fixed in 10.0.8 - Upgrade
Upgrade
debian/neutronto a version that resolves this vulnerability.Fixed in 2:17.2.1-0+deb11u1Fixed in 2:21.0.0-7Fixed in 2:26.0.0-9Fixed in 2:27.0.1-5 - Upgrade
Upgrade
OpenStack Neutron iptables firewall moduleto a version that resolves this vulnerability.Fixed in 10.0.8 - Upgrade
Upgrade
OpenStack Neutron iptables firewall moduleto a version that resolves this vulnerability.Fixed in 11.0.7 - Upgrade
Upgrade
OpenStack Neutron iptables firewall moduleto a version that resolves this vulnerability.Fixed in 12.0.6 - Upgrade
Upgrade
OpenStack Neutron iptables firewall moduleto a version that resolves this vulnerability.Fixed in 13.0.3 - Compensating control
Only deploy/operate environments using the iptables security group driver if necessary; the issue affects deployments using the iptables security group driver.
Event History
Frequently Asked Questions
What is CVE-2019-9735?
CVE-2019-9735 is a vulnerability in the iptables firewall module in OpenStack Neutron that allows an authenticated user to set a destination port in a security group rule along with a protocol that doesn't support that option.
What is the severity of CVE-2019-9735?
The severity of CVE-2019-9735 is high, with a CVSS score of 6.5.
How does CVE-2019-9735 impact OpenStack Neutron?
CVE-2019-9735 affects OpenStack Neutron versions before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3.
How can I fix CVE-2019-9735 on Debian?
To fix CVE-2019-9735 on Debian, you can update the neutron package to version 2:13.0.7+git.2021.09.27.bace3d1890-0+deb10u1.
How can I fix CVE-2019-9735 on Ubuntu?
To fix CVE-2019-9735 on Ubuntu, you can update the neutron package to version 2:12.0.6-0ubuntu1.