CVE-2019-9735

An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By setting a destination port in a security group rule along with a protocol that doesn't support that option (for example, VRRP), an authenticated user may block further application of security group rules for instances from any project/tenant on the compute hosts to which it's applied. (Only deployments using the iptables security group driver are affected.)

An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By setting a destination port in a security group rule along with a protocol that doesn't support that option (for example, VRRP), an authenticated user may block further application of security group rules for instances from any project/tenant on the compute hosts to which it's applied. (Only deployments using the iptables security group driver are affected.)

An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By setting a destination port in a security group rule along with a protocol that doesn't support that option (for example, VRRP), an authenticated user may block further application of security group rules for instances from any project/tenant on the compute hosts to which it's applied. (Only deployments using the iptables security group driver are affected.)

This update for ardana-ansible, ardana-db, ardana-freezer, ardana-glance, ardana-input-model, ardana-nova, ardana-osconfig, ardana-tempest, caasp-openstack-heat-templates, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, documentation-suse-openstack-cloud, galera-python-clustercheck, openstack-cinder, openstack-glance, openstack-heat, openstack-horizon-plugin-monasca-ui, openstack-horizon-plugin-neutron-fwaas-ui, openstack-ironic, openstack-keystone, openstack-manila, openstack-monasca-agent, openstack-monasca-api, openstack-monasca-persister, openstack-monasca-persister-java, openstack-murano, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, openstack-octavia, python-Beaver, python-oslo.db, python-osprofiler, python-swiftlm, venv-openstack-magnum, venv-openstack-monasca, venv-openstack-monasca-ceilometer, venv-openstack-murano, venv-openstack-neutron fixes the following issues:

• Update to version 8.0+git.1560208949.67048e3:

  • Adds repository list parameter (bsc#1122825)

• Update to version 8.0+git.1564410318.f0cca2c:

  • Don't use 'latest' with 'zypper' (SOC-9997)

• Update to version 8.0+git.1564164977.ef9baeb:

  • Freezer Config file is mixed case (SOC-9700)

• Update to version 8.0+git.1564491709.349d78e:

  • Default glance_default_store to rbd if SES enabled (SOC-8749)

• Update to version 8.0+git.1562848601.c3daff0:

  • Include memcached in the minimal ardana-ci model (SOC-9800)

• Update to version 8.0+git.1565388406.c6abb8d:

  • Make default/rpc_response_timeout configurable (SOC-9285)

• Update to version 8.0+git.1562943864.e04a92f:

  • Resolves nova-novncproxy random status failures (SOC-9574)

• Update to version 8.0+git.1560180700.bd26898:

  • Adding support for qemu-ovmf to ardana (SOC-8985)

• Update to version 8.0+git.1563383198.c7fd9b4:

  • Add an global_filter entry to lvm.conf (bsc#1140512)

• Update to version 8.0+git.1559761021.5605746:

  • Enable FCOE for SUSE platform family (SCRD-8562)

• Update to version 8.0+git.1562849010.73bc517:

  • Fix Keystone only deployment tempest testing (SOC-9800)

• Update to version 8.0+git.1560764545.6c8d2dc:

  • Install manila tempest tests package (SOC-7496)

• Update to version 8.0+git.1560330843.b7d807c:

  • Add configuration for manila-tempest-plugin (SOC-7496)

• Update to version 1.0+git.1560518045.ad7dc6d:

  • Patching node before bootstraping

• Update to version 5.0+git.1565280360.01fed6905:

  • batch: Fix get_proposal_json (SOC-9954)
  • batch: Format crowbar batch error output (SOC-9954)
  • batch: Format crowbar batch error output (SOC-9954)

• Update to version 5.0+git.1564657662.75174c965:

  • travis: Whitelist CVE-2015-3448 (SOC-9911)
  • travis: Use env variable for commit range (SOC-9911)
  • Use proper names for the Travis Tests (SOC-9565)
  • Replace Danger with Gitlint (SOC-9565)
  • Switch from Travis dist from Trusty to Xenial (SOC-9565)

• Update to version 5.0+git.1563983933.03880f1c8:

  • dns: fix migration for designate

• Update to version 5.0+git.1562080799.f2dd7d0dd:

  • network: Don't set datapath-ids on ovs-bridges anymore
  • crowbar: Save sync_mark attributes in databag

• Update to version 5.0+git.1561648142.b6be652e9:

  • dns: forwards dns queries to dns-master when using desingate
  • dns: write admin network in ip/mask notation for bind9
  • dns: skip installing designate-rndc-key on non-master nodes
  • dns: fix designate migration
  • dns: allow using dns-server as designate target
  • bind: Allow new zones configured via rndc
  • bind: Disable listening on IPv6 addresses for now

• Update to version 5.0+git.1561465092.4dc67a7fa:

  • travis: pin sexp_processor to 4.12.0

• Update to version 5.0+git.1561380950.b4e37c0e2:

  • deployer: Use dhcp on crowbar_register only when enable_pxe is set (bsc#1132654)
  • network: Allow locking down the network config for nodes (bsc#1120657)

• Update to version 5.0+git.1562069707.e2de18c:

  • Add timeout multiplier
  • Make default sync_mark timeout…

This update for ardana-ansible, ardana-barbican, ardana-cinder, ardana-cluster, ardana-cobbler, ardana-db, ardana-designate, ardana-extensions-nsx, ardana-glance, ardana-heat, ardana-horizon, ardana-input-model, ardana-installer-ui, ardana-ironic, ardana-keystone, ardana-logging, ardana-magnum, ardana-monasca, ardana-mq, ardana-neutron, ardana-nova, ardana-octavia, ardana-opsconsole, ardana-opsconsole-ui, ardana-osconfig, ardana-service, ardana-ses, ardana-swift, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, java-monasca-common, java-monasca-common-kit, openstack-ceilometer, openstack-cinder, openstack-designate, openstack-heat, openstack-horizon-plugin-neutron-fwaas-ui, openstack-horizon-plugin-neutron-lbaas-ui, openstack-horizon-plugin-neutron-vpnaas-ui, openstack-ironic, openstack-ironic-python-agent, openstack-keystone, openstack-magnum, openstack-manila, openstack-monasca-notification, openstack-monasca-persister, openstack-monasca-persister-java, openstack-monasca-persister-java-kit, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, openstack-octavia, openstack-tempest, python-ardana-configurationprocessor, python-cinder-tempest-plugin, python-ironicclient, python-keystonemiddleware, python-monasca-tempest-plugin, python-openstackclient, python-openstacksdk, python-proliantutils, python-python-engineio, python-swiftlm, python-vmware-nsx, python-vmware-nsxlib, yast2-crowbar fixes the following issues:

• Update to version 9.0+git.1566374020.301191f:

  • Use raw image format when using SES backend on Nova (SOC-9285)

• Update to version 9.0+git.1563375514.31fa9a7:

  • Ensure ardana-update-pkgs works for dist-upgrade (SOC-9857)

• Update to version 9.0+git.1563192450.30e8f16:

  • Ensure Cloud8/SLE-12-SP3 repps still served (SOC-9840)

• Update to version 9.0+git.1566251498.be02ca4:

  • adds ipv6 format to http/https urls (SOC-10063)

• Update to version 9.0+git.1565678764.c3a9b9f:

  • adds ipv6 format to urls (SOC-10063)

• Update to version 9.0+git.1562898832.1731f25:

  • FIX broken symlink for policy.yaml.j2. (SOC-0000)

• Update to version 9.0+git.1559333871.40508f7:

  • Allow system to bind to non local ipv6 addresses (SOC-9330)

• Update to version 9.0+git.1566336494.93967dd:

  • Using python netaddr for ipv6 address comparison (SOC-9940)

• Update to version 9.0+git.1564409964.b7e4fc3:

  • Don't use 'latest' with 'zypper' (SOC-9997)

• Update to version 9.0+git.1562182567.aef23e0:

  • Format curl commands for ipv6 (SOC-9369)

• Update to version 9.0+git.1565680593.df7a432:

  • adds ipv6 format to urls (SOC-10063)

• Update to version 9.0+git.1566213657.69862ab:

  • Add missing service plugin for l2gw (SOC-5837)

• Update to version 9.0+git.1563904379.31ff1e9:

  • Add the NSX-T L2-Gateway Service definition (SOC-5837)

• Switch to new Gerrit Server

• Update to version 9.0+git.1566375806.f0b2333:

  • Configure glance image_direct_url/multiple_locations (SOC-9285)

• Update to version 9.0+git.1565720518.c7fdca2:

  • adds ipv6 format to urls (SOC-10063)

• Update to version 9.0+git.1564491141.602fdf9:

  • Default glance_default_store to rbd if SES enabled (SOC-8749)

• Update to version 9.0+git.1565721273.f44b8d7:

  • adds ipv6 format to urls (SOC-10063)

• Update to version 9.0+git.1565891518.2a545a1:

  • adds ipv6 format to urls (SOC-10063)

• Update to version 9.0+git.1565655129.ab3a58c:

  • Removed None condition from rule (SOC-10003)

• Update to version 9.0+git.1564609155.033a963:

  • Updated heat_policy.json permission to be 664 (SOC-9872)

• Update to version 9.0+git.1562848565.91e75b2:

  • Include memcached in the minimal ardana-ci model (SOC-9800)

• Update to version 9.0+git.1566255088.3443670:

  • Add server state column (SOC-9957)

• Update to version 9.0+git.1565218199.868c5d1:

  • Add ipv6 support (SOC-9677) (#357)

• Update to version 9.0+git.1563912815.7090c20:

  • Only show ses config upload option when ses is not configured (SOC-8555)…

Erik Olof Gunnar Andersson discovered that OpenStack Neutron incorrectly handled certain security group rules in the iptables firewall module. An authenticated attacker could possibly use this issue to block further application of security group rules for other instances.