Network Configuration Vulnerability in OpenStack Neutron by OpenStack

CVE-2019-10876

Summary

A vulnerability exists in OpenStack Neutron that can be exploited by authenticated users to disrupt network configurations. By creating overlapping security groups with conflicting port ranges, users can trigger a KeyError in the Open vSwitch (OVS) firewall. This prevents Neutron from properly configuring networks on affected compute nodes, thereby impairing network functionality and security. All deployments that utilize the neutron-openvswitch-agent are susceptible, making it essential for administrators to review their security group configurations to mitigate this risk.

References