Source: neutron Version: 2:13.0.2-10 Severity: grave Tags: security upstream Justification: user security hole Forwarded: https://bugs.launchpad.net/neutron/+bug/1818385
Hi, The following vulnerability was published for neutron. CVE-2019-9735[0]: | An issue was discovered in the iptables firewall module in OpenStack | Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x | before 13.0.3. By setting a destination port in a security group rule | along with a protocol that doesn't support that option (for example, | VRRP), an authenticated user may block further application of security | group rules for instances from any project/tenant on the compute hosts | to which it's applied. (Only deployments using the iptables security | group driver are affected.) If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2019-9735 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9735 [1] https://bugs.launchpad.net/neutron/+bug/1818385 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
