Medium severity · published Apr 5, 2019
CVE-2019-10876
An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3
6.5
CVSS
1.7%
EPSS
No
On KEV
Description
An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated user may prevent Neutron from being able to configure networks on any compute nodes where those security groups are present, because of an Open vSwitch (OVS) firewall KeyError. All Neutron deployments utilizing neutron-openvswitch-agent are affected.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
Neutron · Openstack
11.0.0 before 11.0.7; 12.0.0 before 12.0.6; 13.0.0 before 13.0.3 · source: NVD
OP
Openstack · Redhat
13; 14 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-10876
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-10876
Mailing List
http://www.openwall.com/lists/oss-security/2019/04/09/2
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0879
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0935
Issue Tracking
https://bugs.launchpad.net/ossa/+bug/1813007
Vendor Advisory
https://review.openstack.org/#/q/topic:bug/1813007
Third Party Advisory
https://security.openstack.org/ossa/OSSA-2019-002.html
More from Neutron
9.1
CVE-2021-38598
OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based…
9.1
CVE-2015-8914
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism and consequently…
8.2
CVE-2016-5363
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended MAC-spoofing protection mechanism and consequently…
8.2
CVE-2016-5362
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended DHCP-spoofing protection mechanism and consequently…
7.1
CVE-2026-55707
In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets