Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1qcjltLXY1cWgtbWgyas3uSA

OpenStack Neutron overlapping security group rules prevents compute node network configuration

An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated user may prevent Neutron from being able to configure networks on any compute nodes where those security groups are present, because of an Open vSwitch (OVS) firewall KeyError. All Neutron deployments utilizing neutron-openvswitch-agent are affected.

Permalink: https://github.com/advisories/GHSA-jr9m-v5qh-mh2j
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qcjltLXY1cWgtbWgyas3uSA
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: about 1 month ago


CVSS Score: 6.5
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Identifiers: GHSA-jr9m-v5qh-mh2j, CVE-2019-10876
References: Blast Radius: 13.8

Affected Packages

pypi:neutron
Dependent packages: 24
Dependent repositories: 134
Downloads: 34,263 last month
Affected Version Ranges: >= 13.0.0, < 13.0.3, >= 12.0.0, < 12.0.6, >= 11.0.0, < 11.0.7
Fixed in: 13.0.3, 12.0.6, 11.0.7
All affected versions: 11.0.3, 11.0.4, 11.0.5, 11.0.6, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, 12.0.5, 13.0.0, 13.0.1, 13.0.2
All unaffected versions: 10.0.5, 10.0.6, 10.0.7, 11.0.7, 11.0.8, 12.0.6, 12.1.0, 12.1.1, 13.0.3, 13.0.4, 13.0.5, 13.0.6, 13.0.7, 14.0.0, 14.0.1, 14.0.2, 14.0.3, 14.0.4, 14.1.0, 14.2.0, 14.3.0, 14.3.1, 14.4.0, 14.4.1, 14.4.2, 15.0.0, 15.0.1, 15.0.2, 15.1.0, 15.2.0, 15.3.0, 15.3.1, 15.3.2, 15.3.3, 15.3.4, 16.0.0, 16.1.0, 16.2.0, 16.3.0, 16.3.1, 16.3.2, 16.4.0, 16.4.1, 16.4.2, 17.0.0, 17.1.0, 17.1.1, 17.1.2, 17.2.0, 17.2.1, 17.3.0, 17.4.0, 17.4.1, 18.0.0, 18.1.0, 18.1.1, 18.2.0, 18.3.0, 18.4.0, 18.5.0, 18.6.0, 19.0.0, 19.1.0, 19.2.0, 19.3.0, 19.4.0, 19.5.0, 19.6.0, 19.7.0, 20.0.0, 20.1.0, 20.2.0, 20.3.0, 20.3.1, 20.4.0, 20.5.0, 21.0.0, 21.1.0, 21.1.1, 21.1.2, 21.2.0, 21.2.1, 22.0.0, 22.0.1, 22.0.2, 22.1.0, 22.2.0, 22.2.1, 23.0.0, 23.1.0, 23.2.0, 24.0.0, 24.0.1, 25.0.0