REDHAT-BUG-1690745
First published: Wed Mar 20 2019(Updated: )
An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By setting a destination port in a security group rule along with a protocol that doesn't support that option (for example, VRRP), an authenticated user may block further application of security group rules for instances from any project/tenant on the compute hosts to which it's applied. (Only deployments using the iptables security group driver are affected.) Reference: <a href="https://bugs.launchpad.net/neutron/+bug/1818385">https://bugs.launchpad.net/neutron/+bug/1818385</a> <a href="https://seclists.org/oss-sec/2019/q1/183">https://seclists.org/oss-sec/2019/q1/183</a> Upstream commit: <a href="https://git.openstack.org/cgit/openstack/neutron/commit/?id=8c213e45902e21d2fe00639ef7d92b35304bde82">https://git.openstack.org/cgit/openstack/neutron/commit/?id=8c213e45902e21d2fe00639ef7d92b35304bde82</a> Upstream Patches: <a href="https://git.openstack.org/cgit/openstack/neutron/patch/?id=8c213e45902e21d2fe00639ef7d92b35304bde82">https://git.openstack.org/cgit/openstack/neutron/patch/?id=8c213e45902e21d2fe00639ef7d92b35304bde82</a> <a href="https://review.openstack.org/640619">https://review.openstack.org/640619</a> <a href="https://review.openstack.org/640790">https://review.openstack.org/640790</a> <a href="https://review.openstack.org/640702">https://review.openstack.org/640702</a> <a href="https://review.openstack.org/640685">https://review.openstack.org/640685</a> <a href="https://review.openstack.org/640619">https://review.openstack.org/640619</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Neutron | <10.0.8<11.0.7<12.0.6<13.0.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugs.launchpad.net/neutron/+bug/1818385
- https://seclists.org/oss-sec/2019/q1/183
- https://git.openstack.org/cgit/openstack/neutron/commit/?id=8c213e45902e21d2fe00639ef7d92b35304bde82
- https://git.openstack.org/cgit/openstack/neutron/patch/?id=8c213e45902e21d2fe00639ef7d92b35304bde82
- https://review.openstack.org/640619
- https://review.openstack.org/640790
- https://review.openstack.org/640702
- https://review.openstack.org/640685
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1690746
- https://access.redhat.com/errata/RHSA-2019:0916
- https://access.redhat.com/errata/RHSA-2019:0935
- https://access.redhat.com/errata/RHSA-2019:0879
- https://bugzilla.redhat.com/show_bug.cgi?id=1690745
Frequently Asked Questions
What is the severity of REDHAT-BUG-1690745?
The severity of REDHAT-BUG-1690745 ranges from moderate to high due to potential unauthorized access via misconfigured firewall rules.
How do I fix REDHAT-BUG-1690745?
To fix REDHAT-BUG-1690745, upgrade OpenStack Neutron to versions 10.0.8, 11.0.7, 12.0.6, or 13.0.3 or later.
What systems are affected by REDHAT-BUG-1690745?
REDHAT-BUG-1690745 affects OpenStack Neutron versions prior to 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3.
What is the nature of the vulnerability in REDHAT-BUG-1690745?
The nature of the vulnerability in REDHAT-BUG-1690745 stems from the improper handling of security group rules for unsupported protocols, which could lead to security misconfigurations.
How can I verify if my system is vulnerable to REDHAT-BUG-1690745?
You can verify if your system is vulnerable to REDHAT-BUG-1690745 by checking the version of your OpenStack Neutron installation and assessing your firewall rules.
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-9735
- agent/severity
- agent/references
- agent/description
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/openstack
- canonical/neutron