CVE-2019-9735 OpenStack Neutron's unsupported dport option prevents applying security groups
An authenticated user can cause a denial of service by blocking security group rule applications on compute hosts using specific iptables configurations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-9735?
CVE-2019-9735 is a medium-severity denial of service vulnerability in Debian Debian Linux, published on 13 Mar 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By setting a destination port in a security group rule along with a protocol that doesn't support that option (for example, VRRP), an authenticated user may block further application of security group rules for instances from any project/tenant on the compute hosts to which it's applied. (Only deployments using the iptables security group driver are affected.)
Weakness: CWE-755
Which versions are affected by CVE-2019-9735?
9 open source packages ship an affected version, including neutron. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
neutron PyPI | All versions | 10.0.8 |
neutron PyPI | All versions | 10.0.8 |
neutron PyPI | From 11.0.0 | 11.0.7 |
neutron PyPI | From 11.0.0 | 11.0.7 |
neutron PyPI | From 12.0.0 | 12.0.6, 13.0.3, 11.0.7, 10.0.8 |
neutron PyPI | From 12.0.0 | 12.0.6 |
3 more packages
neutron PyPI | From 12.0.0 | 12.0.6 |
neutron PyPI | From 13.0.0 | 13.0.3 |
neutron PyPI | From 13.0.0 | 13.0.3 |
Linux distribution packages (17)
openstack-neutron Red Hat:openstack:10::el7 | All versions | 1:9.4.1-40.el7ost |
openstack-neutron-bigswitch-agent Red Hat:openstack:10::el7 | All versions | 2:9.42.14-1.el7ost |
openstack-neutron-bigswitch-lldp Red Hat:openstack:10::el7 | All versions | 2:9.42.14-1.el7ost |
openstack-neutron-common Red Hat:openstack:10::el7 | All versions | 1:9.4.1-40.el7ost |
openstack-neutron-lbaas Red Hat:openstack:10::el7 | All versions | 1:9.2.2-8.el7ost |
openstack-neutron-linuxbridge Red Hat:openstack:10::el7 | All versions | 1:9.4.1-40.el7ost |
openstack-neutron-macvtap-agent Red Hat:openstack:10::el7 | All versions | 1:9.4.1-40.el7ost |
openstack-neutron-metering-agent Red Hat:openstack:10::el7 | All versions | 1:9.4.1-40.el7ost |
openstack-neutron-ml2 Red Hat:openstack:10::el7 | All versions | 1:9.4.1-40.el7ost |
openstack-neutron-openvswitch Red Hat:openstack:10::el7 | All versions | 1:9.4.1-40.el7ost |
openstack-neutron-rpc-server Red Hat:openstack:10::el7 | All versions | 1:9.4.1-40.el7ost |
openstack-neutron-sriov-nic-agent Red Hat:openstack:10::el7 | All versions | 1:9.4.1-40.el7ost |
python-networking-bigswitch Red Hat:openstack:10::el7 | All versions | 2:9.42.14-1.el7ost |
python-neutron Red Hat:openstack:10::el7 | All versions | 1:9.4.1-40.el7ost |
python-neutron-lbaas Red Hat:openstack:10::el7 | All versions | 1:9.2.2-8.el7ost |
python-neutron-lbaas-tests Red Hat:openstack:10::el7 | All versions | 1:9.2.2-8.el7ost |
python-neutron-tests Red Hat:openstack:10::el7 | All versions | 1:9.4.1-40.el7ost |
Products include Debian Debian Linux, Openstack Neutron, Redhat Openstack.
How do I fix CVE-2019-9735?
Upgrade neutron to a fixed version for your release line: 10.0.8, 11.0.7, 12.0.6 or 13.0.3.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-9735 being exploited?
There is no known exploitation of CVE-2019-9735 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2019-9735, DSA-4409-1, GHSA-9773-3fqg-8w25, PYSEC-2019-190, RHSA-2019:0916, UBUNTU-CVE-2019-9735 and 1 more.