An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By setting a destination port in a security group rule along with a protocol that doesn't support that option (for example, VRRP), an authenticated user may block further application of security group rules for instances from any project/tenant on the compute hosts to which it's applied. (Only deployments using the iptables security group driver are affected.)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:0916 advisory.

    OpenStack Networking (neutron) is a pluggable, scalable, and API-driven system that provisions networking     services to virtual machines. Its main function is to manage connectivity to and from virtual machines.

    The following packages have been upgraded to a later upstream version: openstack-neutron (9.4.1),     openstack-neutron-lbaas (9.2.2), python-networking-bigswitch (9.42.14). (BZ#1684242)

    Security Fix(es):

    * openstack-neutron: incorrect validation of port settings in iptables security group driver     (CVE-2019-9735)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:0879 advisory.

    OpenStack Networking (neutron) is a pluggable, scalable, and API-driven system that provisions networking     services to virtual machines. Its main function is to manage connectivity to and from virtual machines.

    Security Fix(es):

    * openstack-neutron: incorrect validation of port settings in iptables security group driver     (CVE-2019-9735)

    * openstack-neutron: DOS via broken port range merging in security group (CVE-2019-10876)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:0935 advisory.

    OpenStack Networking (neutron) is a pluggable, scalable, and API-driven system that provisions networking     services to virtual machines. Its main function is to manage connectivity to and from virtual machines.

    Security Fix(es):

    * openstack-neutron: incorrect validation of port settings in iptables security group driver     (CVE-2019-9735)

    * openstack-neutron: DOS via broken port range merging in security group (CVE-2019-10876)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4036-1 advisory.

    Erik Olof Gunnar Andersson discovered that OpenStack Neutron incorrectly handled certain security group     rules in the iptables firewall module. An authenticated attacker could possibly use this issue to block     further application of security group rules for other instances.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Erik Olof Gunnar Andersson discovered that incorrect validation of port settings in the iptables security group driver of Neutron, the OpenStack virtual network service, could result in denial of service in a multi tenant setup.

ID	Name	Product	Family	Severity
194169	RHEL 7 : Red Hat Enterprise Linux OpenStack Platform (RHSA-2019:0916)	Nessus	Red Hat Local Security Checks	medium
194145	RHEL 7 : openstack-neutron (RHSA-2019:0879)	Nessus	Red Hat Local Security Checks	medium
194125	RHEL 7 : openstack-neutron (RHSA-2019:0935)	Nessus	Red Hat Local Security Checks	medium
126256	Ubuntu 16.04 LTS : OpenStack Neutron vulnerability (USN-4036-1)	Nessus	Ubuntu Local Security Checks	medium
122957	Debian DSA-4409-1 : neutron - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2019-9735

medium

Tenable Plugins

medium

medium

medium

medium

medium