CVE-2019-9735

Published: 12 March 2019

An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By setting a destination port in a security group rule along with a protocol that doesn't support that option (for example, VRRP), an authenticated user may block further application of security group rules for instances from any project/tenant on the compute hosts to which it's applied. (Only deployments using the iptables security group driver are affected.)

Priority

Medium

CVSS 3 base score: 6.5

Status

Package Release Status
neutron
Launchpad, Ubuntu, Debian
Upstream
Released (2:13.0.2-13)
Ubuntu 18.04 LTS (Bionic Beaver)
Released (2:12.0.6-0ubuntu1)
Ubuntu 16.04 ESM (Xenial Xerus)
Released (2:8.4.0-0ubuntu7.4)
Ubuntu 14.04 ESM (Trusty Tahr) Does not exist
(trusty was needs-triage)
Patches:
Upstream: https://review.openstack.org/640685 (rocky, 13.0.x)
Upstream: https://review.openstack.org/640702 (queens, 12.0.x)
Upstream: https://review.openstack.org/640790 (pike, 11.0.x)
Upstream: https://review.openstack.org/640791 (ocata, 10.0.x)