REDHAT-BUG-1949188: Medium severity ovn Kubernetes vulnerability

Published Apr 13, 2021

Updated

It was found that Egress Firewall in OVN-Kubernetes does not reliably apply firewall rules when there is multiple dns rules. When adding EgressFirewalls with 5 or so dnsNames it is probable that a deadlock will occur. It could lead to the situation that effective firewall rules are different than it could be expected.

Affected Software

1 affected component

ovn Kubernetes

Event History

Apr 13, 2021

Data Sourced

via Red Hat·04:59 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1949188?

The severity of REDHAT-BUG-1949188 is considered high due to the risk of deadlocks affecting Egress Firewall rule applications.

How do I fix REDHAT-BUG-1949188?

To fix REDHAT-BUG-1949188, you should avoid configuring multiple DNS names in Egress Firewall rules until an official patch is released.

Which versions of OVN Kubernetes are affected by REDHAT-BUG-1949188?

REDHAT-BUG-1949188 affects all existing versions of OVN Kubernetes that utilize the Egress Firewall feature.

What issues can arise from REDHAT-BUG-1949188?

Issues from REDHAT-BUG-1949188 can lead to inconsistent firewall rules and potential security vulnerabilities.

Are there workarounds for REDHAT-BUG-1949188?

Yes, a potential workaround for REDHAT-BUG-1949188 is to limit the number of DNS names specified in Egress Firewall policies.