Bug 1118833 – CVE-2014-3555 openstack-neutron: Denial of Service in Neutron allowed address pair

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1118833 - (CVE-2014-3555) CVE-2014-3555 openstack-neutron: Denial of Service in Neutron allowed address pair

Summary:	CVE-2014-3555 openstack-neutron: Denial of Service in Neutron allowed address...

Status:	CLOSED ERRATA

Aliases:	CVE-2014-3555

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20140721,repor...
Keywords:	Security

Depends On:	1121941 1122428 1125946 1125947 1125948
Blocks:	1118835
	Show dependency tree / graph

Reported:	2014-07-11 11:58 EDT by Vasyl Kaigorodov
Modified:	2016-04-26 14:47 EDT (History)
CC List:	19 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:	A denial of service flaw was found in neutron's handling of allowed address pairs. As there was no enforced quota on the amount of allowed address pairs, a sufficiently authorized user could possibly create a large number of firewall rules, impacting performance or potentially rendering a compute node unusable.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2014-09-02 21:58:54 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
master/juno patch for CVE-2014-3555 (4.24 KB, patch) 2014-07-14 11:58 EDT, Vincent Danen	no flags	Details \| Diff
stable/havana patch for CVE-2014-3555 (4.25 KB, patch) 2014-07-14 11:59 EDT, Vincent Danen	no flags	Details \| Diff
stable/icehouse patch for CVE-2014-3555 (4.25 KB, patch) 2014-07-14 11:59 EDT, Vincent Danen	no flags	Details \| Diff
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2014:1078	normal	SHIPPED_LIVE	Moderate: openstack-neutron security update	2014-08-20 04:44:40 EDT
Red Hat Product Errata	RHSA-2014:1119	normal	SHIPPED_LIVE	Moderate: openstack-neutron security, bug fix, and enhancement update	2014-09-02 17:58:42 EDT
Red Hat Product Errata	RHSA-2014:1120	normal	SHIPPED_LIVE	Moderate: openstack-neutron security, bug fix, and enhancement update	2014-09-02 17:58:36 EDT

Groups: None (edit)

Description Vasyl Kaigorodov 2014-07-11 11:58:00 EDT

The OpenStack project reports:

Title: Denial of Service in Neutron allowed address pair
Reporter: Liping Mao (Cisco)
Products: Neutron
Versions: up to 2013.2.3, and 2014.1 versions up to 2014.1.1

Description:
Liping Mao from Cisco reported a denial of service vulnerability in
Neutron's handling of allowed address pair. By creating a large number
of allowed address pairs, an authenticated user may overwhelm neutron
firewall rules and render compute nodes unusable. All Neutron setups are
affected.

Comment 1 Vasyl Kaigorodov 2014-07-11 11:58:42 EDT

Acknowledgements:

Red Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges Liping Mao from Cisco as the original reporter.

Comment 3 Vincent Danen 2014-07-14 11:58:47 EDT

Created attachment 917901 [details]
master/juno patch for CVE-2014-3555

Comment 4 Vincent Danen 2014-07-14 11:59:14 EDT

Created attachment 917902 [details]
stable/havana patch for CVE-2014-3555

Comment 5 Vincent Danen 2014-07-14 11:59:39 EDT

Created attachment 917904 [details]
stable/icehouse patch for CVE-2014-3555

Comment 6 Murray McAllister 2014-07-22 04:05:04 EDT

This issue is public:

http://seclists.org/oss-sec/2014/q3/200

Comment 8 Garth Mollett 2014-07-23 04:37:49 EDT

Created openstack-neutron tracking bugs for this issue:

Affects: fedora-20 [bug 1122428]

Comment 10 Fedora Update System 2014-08-01 02:04:00 EDT

openstack-neutron-2013.2.3-13.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 Ihar Hrachyshka 2014-08-01 04:49:09 EDT

Any updates on RHOSP trackers?

Comment 13 errata-xmlrpc 2014-08-20 00:44:48 EDT

This issue has been addressed in following products:

  OpenStack 4 for RHEL 6

Via RHSA-2014:1078 https://rhn.redhat.com/errata/RHSA-2014-1078.html

Comment 14 Martin Prpič 2014-08-25 04:53:00 EDT

IssueDescription:

A denial of service flaw was found in neutron's handling of allowed address pairs. As there was no enforced quota on the amount of allowed address pairs, a sufficiently authorized user could possibly create a large number of firewall rules, impacting performance or potentially rendering a compute node unusable.

Comment 15 errata-xmlrpc 2014-09-02 13:59:35 EDT

This issue has been addressed in following products:

  OpenStack 5 for RHEL 6

Via RHSA-2014:1120 https://rhn.redhat.com/errata/RHSA-2014-1120.html

Comment 16 errata-xmlrpc 2014-09-02 13:59:53 EDT

This issue has been addressed in following products:

  OpenStack 5 for RHEL 7

Via RHSA-2014:1119 https://rhn.redhat.com/errata/RHSA-2014-1119.html

Note You need to log in before you can comment on or make changes to this bug.