CVE-2019-9735
Summary
| CVE | CVE-2019-9735 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2019-03-13 02:29:00 UTC |
|---|
| Updated | 2021-08-04 17:15:00 UTC |
|---|
| Description | An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By setting a destination port in a security group rule along with a protocol that doesn't support that option (for example, VRRP), an authenticated user may block further application of security group rules for instances from any project/tenant on the compute hosts to which it's applied. (Only deployments using the iptables security group driver are affected.) |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Red Hat Customer Portal |
REDHAT |
access.redhat.com |
Third Party Advisory |
| Bug #1818385 “[OSSA-2019-001] It's possible to add a security gr...” : Bugs : neutron |
MISC |
launchpad.net |
Exploit, Issue Tracking, Patch, Third Party Advisory |
| Red Hat Customer Portal |
REDHAT |
access.redhat.com |
Third Party Advisory |
| OpenStack Neutron CVE-2019-9735 Denial of Service Vulnerability |
BID |
www.securityfocus.com |
Third Party Advisory, VDB Entry |
| oss-security - [OSSA-2019-001] Unsupported dport option prevents applying security
groups in OpenStack Neutron (CVE-2019-9735) |
MLIST |
www.openwall.com |
Mailing List, Third Party Advisory |
| Bugtraq: [SECURITY] [DSA 4409-1] neutron security update |
BUGTRAQ |
seclists.org |
Mailing List, Third Party Advisory |
| USN-4036-1: OpenStack Neutron vulnerability | Ubuntu security notices | Ubuntu |
UBUNTU |
usn.ubuntu.com |
|
| Red Hat Customer Portal |
REDHAT |
access.redhat.com |
Third Party Advisory |
| Debian -- Security Information -- DSA-4409-1 neutron |
DEBIAN |
www.debian.org |
Third Party Advisory |
| OpenStack Docs: OSSA-2019-001: Unsupported dport option prevents applying security groups |
CONFIRM |
security.openstack.org |
Patch, Vendor Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 998087 Python (Pip) Security Update for neutron (GHSA-9773-3fqg-8w25)
