A race-condition flaw was discovered in openstack-neutron before 7.2.0-12.1, 8.x before 8.3.0-11.1, 9.x before 9.3.1-2.1, and 10.x before 10.0.2-1.1, where, following a minor overcloud update, neutron security groups were disabled. Specifically, the following were reset to 0: net.bridge.bridge-nf-call-ip6tables and net.bridge.bridge-nf-call-iptables. The race was only triggered by an update, at which point an attacker could access exposed tenant VMs and network resources.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:2451 advisory.

    OpenStack Networking (neutron) is a pluggable, scalable, and API-driven system that provisions networking     services to virtual machines. Its main function is to manage connectivity to and from virtual machines.

    Security Fix(es):

    * A race-condition flaw was discovered in openstack-neutron where, following a minor overcloud update,     neutron security groups were disabled. Specifically, the following were reset to 0: net.bridge.bridge-nf-     call-ip6tables and net.bridge.bridge-nf-call-iptables. The race was only triggered by an update, at which     point an attacker could access exposed tenant VMs and network resources. (CVE-2017-7543)

    This issue was discovered by Paul Needle (Red Hat).

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:2452 advisory.

    OpenStack Networking (neutron) is a pluggable, scalable, and API-driven system that provisions networking     services to virtual machines. Its main function is to manage connectivity to and from virtual machines.

    Security Fix(es):

    * A race-condition flaw was discovered in openstack-neutron where, following a minor overcloud update,     neutron security groups were disabled. Specifically, the following were reset to 0: net.bridge.bridge-nf-     call-ip6tables and net.bridge.bridge-nf-call-iptables. The race was only triggered by an update, at which     point an attacker could access exposed tenant VMs and network resources. (CVE-2017-7543)

    This issue was discovered by Paul Needle (Red Hat).

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:2447 advisory.

    OpenStack Networking (neutron) is a pluggable, scalable, and API-driven system that provisions networking     services to virtual machines. Its main function is to manage connectivity to and from virtual machines.

    Security Fix(es):

    * A race-condition flaw was discovered in openstack-neutron where, following a minor overcloud update,     neutron security groups were disabled. Specifically, the following were reset to 0: net.bridge.bridge-nf-     call-arptables, net.bridge.bridge-nf-call-ip6tables, and net.bridge.bridge-nf-call-iptables. The race was     only triggered by an update, at which point an attacker could access exposed tenant VMs and network     resources. (CVE-2017-7543)

    This issue was discovered by Paul Needle (Red Hat).

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:2449 advisory.

    OpenStack Networking (neutron) is a pluggable, scalable, and API-driven system that provisions networking     services to virtual machines. Its main function is to manage connectivity to and from virtual machines.

    Security Fix(es):

    * A race-condition flaw was discovered in openstack-neutron where, following a minor overcloud update,     neutron security groups were disabled. Specifically, the following were reset to 0: net.bridge.bridge-nf-     call-ip6tables and net.bridge.bridge-nf-call-iptables. The race was only triggered by an update, at which     point an attacker could access exposed tenant VMs and network resources. (CVE-2017-7543)

    This issue was discovered by Paul Needle (Red Hat).

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
234429	RHEL 7 : openstack-neutron (RHSA-2017:2451)	Nessus	Red Hat Local Security Checks	medium
210276	RHEL 7 : openstack-neutron (RHSA-2017:2452)	Nessus	Red Hat Local Security Checks	medium
210275	RHEL 7 : openstack-neutron (RHSA-2017:2447)	Nessus	Red Hat Local Security Checks	medium
210263	RHEL 7 : openstack-neutron (RHSA-2017:2449)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2017-7543

medium

Tenable Plugins

medium

medium

medium

medium