Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1qcjltLXY1cWgtbWgyas3uSA
OpenStack Neutron overlapping security group rules prevents compute node network configuration
An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated user may prevent Neutron from being able to configure networks on any compute nodes where those security groups are present, because of an Open vSwitch (OVS) firewall KeyError. All Neutron deployments utilizing neutron-openvswitch-agent are affected.
Permalink: https://github.com/advisories/GHSA-jr9m-v5qh-mh2jJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qcjltLXY1cWgtbWgyas3uSA
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: 26 days ago
CVSS Score: 6.5
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Identifiers: GHSA-jr9m-v5qh-mh2j, CVE-2019-10876
References:
- https://nvd.nist.gov/vuln/detail/CVE-2019-10876
- https://access.redhat.com/errata/RHSA-2019:0879
- https://access.redhat.com/errata/RHSA-2019:0935
- https://bugs.launchpad.net/ossa/+bug/1813007
- https://review.openstack.org/#/q/topic:bug/1813007
- https://security.openstack.org/ossa/OSSA-2019-002.html
- http://www.openwall.com/lists/oss-security/2019/04/09/2
- https://github.com/advisories/GHSA-jr9m-v5qh-mh2j
Affected Packages
pypi:neutron
Dependent packages: 24Dependent repositories: 134
Downloads: 24,480 last month
Affected Version Ranges: >= 13.0.0, < 13.0.3, >= 12.0.0, < 12.0.6, >= 11.0.0, < 11.0.7
Fixed in: 13.0.3, 12.0.6, 11.0.7
All affected versions: 11.0.3, 11.0.4, 11.0.5, 11.0.6, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, 12.0.5, 13.0.0, 13.0.1, 13.0.2
All unaffected versions: 10.0.5, 10.0.6, 10.0.7, 11.0.7, 11.0.8, 12.0.6, 12.1.0, 12.1.1, 13.0.3, 13.0.4, 13.0.5, 13.0.6, 13.0.7, 14.0.0, 14.0.1, 14.0.2, 14.0.3, 14.0.4, 14.1.0, 14.2.0, 14.3.0, 14.3.1, 14.4.0, 14.4.1, 14.4.2, 15.0.0, 15.0.1, 15.0.2, 15.1.0, 15.2.0, 15.3.0, 15.3.1, 15.3.2, 15.3.3, 15.3.4, 16.0.0, 16.1.0, 16.2.0, 16.3.0, 16.3.1, 16.3.2, 16.4.0, 16.4.1, 16.4.2, 17.0.0, 17.1.0, 17.1.1, 17.1.2, 17.2.0, 17.2.1, 17.3.0, 17.4.0, 17.4.1, 18.0.0, 18.1.0, 18.1.1, 18.2.0, 18.3.0, 18.4.0, 18.5.0, 18.6.0, 19.0.0, 19.1.0, 19.2.0, 19.3.0, 19.4.0, 19.5.0, 19.6.0, 19.7.0, 20.0.0, 20.1.0, 20.2.0, 20.3.0, 20.3.1, 20.4.0, 20.5.0, 21.0.0, 21.1.0, 21.1.1, 21.1.2, 21.2.0, 21.2.1, 22.0.0, 22.0.1, 22.0.2, 22.1.0, 23.0.0, 23.1.0, 24.0.0