Bug 1152702 (CVE-2014-3703)

Summary:	CVE-2014-3703 Red Hat Openstack 4 Neutron: security groups fail to block traffic properly due to packstack configuration
Product:	[Other] Security Response	Reporter:	Kurt Seifried <kseifried>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	abaron, aortega, apevec, ayoung, chazlett, chrisw, dallan, gkotton, gmollett, lhh, lpeer, markmc, mmagr, rbryant, sclewis, security-response-team, yeylon
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	It was discovered that the nova.conf configuration generated by PackStack did not correctly set the libvirt_vif_driver configuration option if the Open vSwitch (OVS) monolithic plug-in was not used. This could result in deployments defaulting to having the firewall disabled unless the nova configuration was manually modified after PackStack was started.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-10-22 20:08:32 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1152703
Bug Blocks:	1152704

Description Kurt Seifried 2014-10-14 18:28:59 UTC

It was discovered that the nova.conf configuration generated by packstack did not correctly set the libvirt_vif_driver correctly if the OVS monolithic plugin was not used. This could result in deployments defaulting to having the firewall disabled unless the nova configuration was manually modified after packstack was run.

Acknowledgements:

This issue was discovered by Yair Fried of Red Hat.

Comment 2 Martin Prpič 2014-10-21 08:35:33 UTC

IssueDescription:

It was discovered that the nova.conf configuration generated by PackStack did not correctly set the libvirt_vif_driver configuration option if the Open vSwitch (OVS) monolithic plug-in was not used. This could result in deployments defaulting to having the firewall disabled unless the nova configuration was manually modified after PackStack was started.

Comment 3 errata-xmlrpc 2014-10-22 17:17:42 UTC

This issue has been addressed in the following products:

  OpenStack 4 for RHEL 6

Via RHSA-2014:1691 https://rhn.redhat.com/errata/RHSA-2014-1691.html