Your submission was sent successfully! Close

CVE-2019-9735

Published: 12 March 2019

An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By setting a destination port in a security group rule along with a protocol that doesn't support that option (for example, VRRP), an authenticated user may block further application of security group rules for instances from any project/tenant on the compute hosts to which it's applied. (Only deployments using the iptables security group driver are affected.)

Priority

Medium

CVSS 3 base score: 6.5

Status

Package Release Status
neutron
Launchpad, Ubuntu, Debian
bionic
Released (2:12.0.6-0ubuntu1)
cosmic
Released (2:13.0.2-0ubuntu3.4)
disco Not vulnerable
(2:14.0.0~b1~git2018120609.2e720b158b-0ubuntu2)
precise Does not exist

trusty Does not exist
(trusty was needs-triage)
upstream
Released (2:13.0.2-13)
xenial
Released (2:8.4.0-0ubuntu7.4)
Patches:
upstream: https://review.openstack.org/640685 (rocky, 13.0.x)
upstream: https://review.openstack.org/640702 (queens, 12.0.x)
upstream: https://review.openstack.org/640790 (pike, 11.0.x)
upstream: https://review.openstack.org/640791 (ocata, 10.0.x)