An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated user may prevent Neutron from being able to configure networks on any compute nodes where those security groups are present, because of an Open vSwitch (OVS) firewall KeyError. All Neutron deployments utilizing neutron-openvswitch-agent are affected.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before
    13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated user may
    prevent Neutron from being able to configure networks on any compute nodes where those security groups are
    present, because of an Open vSwitch (OVS) firewall KeyError. All Neutron deployments utilizing neutron-
    openvswitch-agent are affected. (CVE-2019-10876)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:0879 advisory.

    OpenStack Networking (neutron) is a pluggable, scalable, and API-driven system that provisions networking     services to virtual machines. Its main function is to manage connectivity to and from virtual machines.

    Security Fix(es):

    * openstack-neutron: incorrect validation of port settings in iptables security group driver     (CVE-2019-9735)

    * openstack-neutron: DOS via broken port range merging in security group (CVE-2019-10876)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:0935 advisory.

    OpenStack Networking (neutron) is a pluggable, scalable, and API-driven system that provisions networking     services to virtual machines. Its main function is to manage connectivity to and from virtual machines.

    Security Fix(es):

    * openstack-neutron: incorrect validation of port settings in iptables security group driver     (CVE-2019-9735)

    * openstack-neutron: DOS via broken port range merging in security group (CVE-2019-10876)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
437113	SCA: security update for neutron (GHSA-jr9m-v5qh-mh2j)	Tenable Cloud Security	SCA Checks	high
437113	SCA: security update for neutron (GHSA-jr9m-v5qh-mh2j)	Tenable Self-Hosted Container Security	SCA Checks	high
194145	RHEL 7 : openstack-neutron (RHSA-2019:0879)	Nessus	Red Hat Local Security Checks	medium
194125	RHEL 7 : openstack-neutron (RHSA-2019:0935)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2019-10876

high

Tenable Plugins

high

high

medium

medium