Vulnerability CVE-2019-10876
Published: 2019-04-05

Description:
An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated user may prevent Neutron from being able to configure networks on any compute nodes where those security groups are present, because of an Open vSwitch (OVS) firewall KeyError. All Neutron deployments utilizing neutron-openvswitch-agent are affected.

Type:

CWE-254

 (Security Features)

CVSS2 => (AV:N/AC:L/Au:S/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4/10
2.9/10
8/10
Exploit range
Attack complexity
Authentication
Remote
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None
Affected software
Redhat -> Openstack 
Openstack -> Neutron 

 References:
http://www.openwall.com/lists/oss-security/2019/04/09/2
https://access.redhat.com/errata/RHSA-2019:0879
https://access.redhat.com/errata/RHSA-2019:0935
https://bugs.launchpad.net/ossa/+bug/1813007
https://review.openstack.org/#/q/topic:bug/1813007
https://security.openstack.org/ossa/OSSA-2019-002.html
Copyright 2024, cxsecurity.com

 

Back to Top