PT-2019-12069 · Open Vswitch+1 · Openvswitch+1

Diko Parvanov · Published 2019-04-05 · Updated 2022-05-13 · CVE-2019-10876

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack Neutron versions 11.x before 11.0.7 OpenStack Neutron versions 12.x before 12.0.6 OpenStack Neutron versions 13.x before 13.0.3

Description An issue was discovered in OpenStack Neutron where an authenticated user may prevent Neutron from being able to configure networks on any compute nodes by creating two security groups with separate or overlapping port ranges. This is due to an Open vSwitch (OVS) firewall KeyError. All Neutron deployments utilizing neutron-openvswitch-agent are affected.

Recommendations For OpenStack Neutron versions 11.x before 11.0.7, update to version 11.0.7 or later. For OpenStack Neutron versions 12.x before 12.0.6, update to version 12.0.6 or later. For OpenStack Neutron versions 13.x before 13.0.3, update to version 13.0.3 or later. As a temporary workaround, consider restricting the creation of security groups with overlapping port ranges to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2019-10876

GHSA-JR9M-V5QH-MH2J

PYSEC-2019-189

RHSA-2019:0879

RHSA-2019:0935

SUSE-SU-2019:1862-1

SUSE-SU-2019:2046-1

Affected Products

Openvswitch

Openstack Neutron

References · 135

• https://osv.dev/vulnerability/SUSE-SU-2019:1862-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-10876 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:0935 · Vendor Advisory
• https://review.openstack.org/#/q/topic:bug/1813007 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10876 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:0879 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10876 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:2046-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10876 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-10876 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jr9m-v5qh-mh2j · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-10876 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-10876 · Security Note
• https://osv.dev/vulnerability/PYSEC-2019-189 · Vendor Advisory
• https://github.com/openstack/neutron · Note