Fedora Account System
Red Hat Associate
Red Hat Customer
An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By setting a destination port in a security group rule along with a protocol that doesn't support that option (for example, VRRP), an authenticated user may block further application of security group rules for instances from any project/tenant on the compute hosts to which it's applied. (Only deployments using the iptables security group driver are affected.) Reference: https://bugs.launchpad.net/neutron/+bug/1818385 https://seclists.org/oss-sec/2019/q1/183 Upstream commit: https://git.openstack.org/cgit/openstack/neutron/commit/?id=8c213e45902e21d2fe00639ef7d92b35304bde82 Upstream Patches: https://git.openstack.org/cgit/openstack/neutron/patch/?id=8c213e45902e21d2fe00639ef7d92b35304bde82 https://review.openstack.org/640619 https://review.openstack.org/640790 https://review.openstack.org/640702 https://review.openstack.org/640685 https://review.openstack.org/640619
Created openstack-neutron tracking bugs for this issue: Affects: openstack-rdo [bug 1690746]
External References: https://seclists.org/oss-sec/2019/q1/183
Red Hat OpenStack Platform versions 10, 13, and 14 are affected by this vulnerability.
This issue has been addressed in the following products: Red Hat OpenStack Platform 10.0 (Newton) Via RHSA-2019:0916 https://access.redhat.com/errata/RHSA-2019:0916
This issue has been addressed in the following products: Red Hat OpenStack Platform 13.0 (Queens) Via RHSA-2019:0935 https://access.redhat.com/errata/RHSA-2019:0935
This issue has been addressed in the following products: Red Hat OpenStack Platform 14.0 (Rocky) Via RHSA-2019:0879 https://access.redhat.com/errata/RHSA-2019:0879