CVE-2019-10876 OpenStack Neutron overlapping security group rules prevents compute node network configuration
An authenticated user can cause a denial of service in OpenStack Neutron by creating conflicting security groups, preventing network configuration on compute nodes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-10876?
CVE-2019-10876 is a medium-severity denial of service vulnerability in Redhat Openstack, published on 5 Apr 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated user may prevent Neutron from being able to configure networks on any compute nodes where those security groups are present, because of an Open vSwitch (OVS) firewall KeyError. All Neutron deployments utilizing neutron-openvswitch-agent are affected.
Which versions are affected by CVE-2019-10876?
7 open source packages ship an affected version, including neutron. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
neutron PyPI | From 11.0.0 | 11.0.7 |
neutron PyPI | From 11.0.0 | 11.0.7 |
neutron PyPI | From 12.0.0 | 12.0.6, 11.0.7, 13.0.3 |
neutron PyPI | From 12.0.0 | 12.0.6 |
neutron PyPI | From 12.0.0 | 12.0.6 |
neutron PyPI | From 13.0.0 | 13.0.3 |
1 more packages
neutron PyPI | From 13.0.0 | 13.0.3 |
Products include Openstack Neutron, Redhat Openstack.
How do I fix CVE-2019-10876?
Upgrade neutron to a fixed version for your release line: 11.0.7, 12.0.6 or 13.0.3.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-10876 being exploited?
There is no known exploitation of CVE-2019-10876 in the wild and no public exploit code.
Other vulnerabilities in Redhat Openstack
- CVE-2021-38598 OpenStack Neutron vulnerable to hardware address impersonation
- CVE-2015-8914 OpenStack Neutron allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism
- CVE-2016-5362 OpenStack Neutron allows remote attackers to bypass an intended DHCP-spoofing protection mechanism
- CVE-2016-5363 OpenStack Neutron Intended MAC-spoofing protection mechanism bypass
- CVE-2014-3632 Privilege escalation in n/a
Sources
Also known as DEBIAN-CVE-2019-10876, GHSA-jr9m-v5qh-mh2j, PYSEC-2019-189, UBUNTU-CVE-2019-10876.