Vulnerability CVE-2019-9735

Vulnerability Name:

CVE-2019-9735 (CCN-158139)

Assigned:

2019-03-03

Published:

2019-03-03

Updated:

2021-08-04

Summary:

An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By setting a destination port in a security group rule along with a protocol that doesn't support that option (for example, VRRP), an authenticated user may block further application of security group rules for instances from any project/tenant on the compute hosts to which it's applied. (Only deployments using the iptables security group driver are affected.)

CVSS v3 Severity:

6.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
5.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

6.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
5.7 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): High Availibility (A): None

CVSS v2 Severity:

4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:C/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): Complete Availibility (A): None

Vulnerability Type:

CWE-755

Vulnerability Consequences:

Bypass Security

References:

Source: MITRE
Type: CNA
CVE-2019-9735

Source: MLIST
Type: Mailing List, Third Party Advisory
[oss-security] 20190318 [OSSA-2019-001] Unsupported dport option prevents applying security groups in OpenStack Neutron (CVE-2019-9735)

Source: BID
Type: Third Party Advisory, VDB Entry
107390

Source: REDHAT
Type: Third Party Advisory
RHSA-2019:0879

Source: REDHAT
Type: Third Party Advisory
RHSA-2019:0916

Source: REDHAT
Type: Third Party Advisory
RHSA-2019:0935

Source: CCN
Type: Launchpad Bug #1818385
It's possible to add a security group rule for VRRP with a dport (CVE-2019-9735)

Source: XF
Type: UNKNOWN
openstack-neutron-cve20199735-sec-bypass(158139)

Source: MISC
Type: Exploit, Issue Tracking, Patch, Third Party Advisory
https://launchpad.net/bugs/1818385

Source: BUGTRAQ
Type: Mailing List, Third Party Advisory
20190319 [SECURITY] [DSA 4409-1] neutron security update

Source: CONFIRM
Type: Vendor Advisory, Patch
https://security.openstack.org/ossa/OSSA-2019-001.html

Source: UBUNTU
Type: UNKNOWN
USN-4036-1

Source: CCN
Type: OpenStack Neutron Web site
OpenStack Neutron

Source: DEBIAN
Type: Third Party Advisory
DSA-4409

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2019-9735

Vulnerable Configuration:

Configuration 1:

cpe:/a:openstack:neutron:*:*:*:*:*:*:*:* (Version >= 12.0.0 and < 12.0.6)

OR cpe:/a:openstack:neutron:*:*:*:*:*:*:*:* (Version >= 13.0.0 and < 13.0.3)

OR cpe:/a:openstack:neutron:*:*:*:*:*:*:*:* (Version >= 11.0.0 and < 11.0.7)

OR cpe:/a:openstack:neutron:*:*:*:*:*:*:*:* (Version < 10.0.8)

Configuration 2:

cpe:/a:redhat:openstack:10:*:*:*:*:*:*:*

OR cpe:/a:redhat:openstack:14:*:*:*:*:*:*:*

OR cpe:/a:redhat:openstack:13:*:*:*:*:*:*:*

Configuration 3:

cpe:/o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:openstack:neutron:10.0.7:*:*:*:*:*:*:*

OR cpe:/a:openstack:neutron:11.0.6:*:*:*:*:*:*:*

OR cpe:/a:openstack:neutron:12.0.5:*:*:*:*:*:*:*

OR cpe:/a:openstack:neutron:13.0.2:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:20199735	V	CVE-2019-9735	2022-05-22
oval:org.opensuse.security:def:60502	P	Security update for python36-pip (Moderate)	2022-01-12
oval:org.opensuse.security:def:59571	P	Security update for clamav (Moderate)	2021-12-01
oval:org.opensuse.security:def:60423	P	Security update for openexr (Moderate)	2021-12-01
oval:org.opensuse.security:def:59816	P	Security update for tomcat (Important)	2021-11-03
oval:org.opensuse.security:def:60382	P	Security update for squid (Moderate)	2021-10-11
oval:org.opensuse.security:def:61593	P	libxcb-composite0-1.13-3.3.1 on GA media (Moderate)	2021-09-21
oval:org.opensuse.security:def:61594	P	libxerces-c-3_1-3.1.4-3.3.25 on GA media (Moderate)	2021-09-21
oval:org.opensuse.security:def:61617	P	pam_ssh-2.1-2.27 on GA media (Moderate)	2021-09-21
oval:org.opensuse.security:def:61677	P	xdg-utils-20170508-3.2 on GA media (Moderate)	2021-09-21
oval:org.opensuse.security:def:63238	P	skopeo-0.1.32-4.5.1 on GA media (Moderate)	2021-09-21
oval:org.opensuse.security:def:61678	P	xen-libs-4.12.0_12-1.1 on GA media (Moderate)	2021-09-21
oval:org.opensuse.security:def:63243	P	sysstat-isag-12.0.2-3.6.12 on GA media (Moderate)	2021-09-21
oval:org.opensuse.security:def:63515	P	python2-ovs-2.11.5-3.15.3 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:63481	P	libSDL2-2_0-0-32bit-2.0.8-9.63 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:63327	P	freeradius-server-3.0.21-3.6.1 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:63377	P	squid-4.13-5.23.1 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:63339	P	libfpm_pb0-1.1.1-2.29 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:63431	P	libgstreamer-1_0-0-32bit-1.16.2-1.53 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:63378	P	stunnel-5.57-3.11.1 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:62342	P	umoci-0.4.6-3.9.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:63042	P	python39-tools-3.9.4-2.9 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:63009	P	go1.14-1.14.15-1.35.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:62059	P	dbus-1-1.12.2-8.3.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:62253	P	libzip-devel-1.5.1-1.9 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:62383	P	containerd-1.3.9-5.29.3 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:62146	P	libcryptopp-devel-5.6.5-1.3.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:60286	P	Security update for libjpeg-turbo (Moderate)	2021-06-11
oval:org.opensuse.security:def:59871	P	Security update for MozillaFirefox (Important)	2021-03-31
oval:org.opensuse.security:def:60464	P	Security update for open-iscsi (Important)	2021-03-01
oval:org.opensuse.security:def:62593	P	perl-CGI-4.38-1.17 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:62912	P	openldap2-devel-32bit-2.4.46-9.3.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:62474	P	libthai-devel-0.1.27-1.16 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:62688	P	libopenjpeg1-1.5.2-2.28 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:63144	P	bind-9.11.2-10.4 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:61786	P	libX11-6-1.6.5-3.3.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:63140	P	apache2-mod_apparmor-2.12-5.9 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:63276	P	libmariadb-devel-3.1.8-3.18.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:61701	P	autoyast2-4.2.37-1.6 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:63410	P	nodejs8-8.17.0-8.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:61872	P	libpython3_6m1_0-3.6.10-3.53.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:59138	P	Security update for mailman (Important)	2020-12-01
oval:org.opensuse.security:def:59200	P	Security update for the Linux Kernel (Live Patch 28 for SLE 12 SP2) (Important)	2020-12-01
oval:org.opensuse.security:def:60541	P	socat on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:59390	P	Security update for libX11 (Moderate)	2020-12-01
oval:org.opensuse.security:def:59222	P	Security update for the Linux Kernel (Live Patch 30 for SLE 12 SP2) (Important)	2020-12-01
oval:org.opensuse.security:def:60638	P	Security update for mariadb (Moderate)	2020-12-01
oval:org.opensuse.security:def:60619	P	Security update for ardana-ansible, ardana-db, ardana-freezer, ardana-glance, ardana-input-model, ardana-nova, ardana-osconfig, ardana-tempest, caasp-openstack-heat-templates, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, documentation-suse-openstack-cloud, galera-python-clustercheck, openstack-cinder, openstack-glance, openstack-heat, openstack-horizon-plugin-monasca-ui, openstack-horizon-plugin-neutron-fwaas-ui, openstack-ironic, openstack-keystone, openstack-manila, openstack-monasca-agent, openstack-monasca-api, openstack-monasca-persister, openstack-monasca-persister-java, openstack-murano, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, openstack-octavia, python-Beaver, python-oslo.db, python-osprofiler, python-swiftlm, venv-openstack-magnum, venv-openstack-monasca, venv-openstack-monasca-ceilometer, venv-openstack-murano, venv-openstack-neutron (Moderate)	2020-12-01
oval:org.opensuse.security:def:60591	P	Security update for python-cryptography (Moderate)	2020-12-01
oval:org.opensuse.security:def:59380	P	Security update for the Linux Kernel (Live Patch 31 for SLE 12 SP2) (Important)	2020-12-01
oval:org.opensuse.security:def:60722	P	Security update for mozilla-nspr, mozilla-nss (Important)	2020-12-01
oval:org.opensuse.security:def:59686	P	Security update for xen (Important)	2020-12-01
oval:org.opensuse.security:def:60801	P	Security update for the Linux Kernel (Important)	2020-12-01
oval:org.opensuse.security:def:59633	P	Security update for virglrenderer (Important)	2020-12-01
oval:org.opensuse.security:def:60760	P	Security update for the Linux Kernel (Important)	2020-12-01
oval:org.opensuse.security:def:60880	P	Security update for ardana-ansible, ardana-db, ardana-freezer, ardana-glance, ardana-input-model, ardana-nova, ardana-osconfig, ardana-tempest, caasp-openstack-heat-templates, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, documentation-suse-openstack-cloud, galera-python-clustercheck, openstack-cinder, openstack-glance, openstack-heat, openstack-horizon-plugin-monasca-ui, openstack-horizon-plugin-neutron-fwaas-ui, openstack-ironic, openstack-keystone, openstack-manila, openstack-monasca-agent, openstack-monasca-api, openstack-monasca-persister, openstack-monasca-persister-java, openstack-murano, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, openstack-octavia, python-Beaver, python-oslo.db, python-osprofiler, python-swiftlm, venv-openstack-magnum, venv-openstack-monasca, venv-openstack-monasca-ceilometer, venv-openstack-murano, venv-openstack-neutron (Moderate)	2020-12-01
oval:org.opensuse.security:def:60851	P	Security update for nodejs6 (Moderate)	2020-12-01
oval:org.opensuse.security:def:58959	P	Security update for openssl (Moderate)	2020-12-01
oval:org.opensuse.security:def:60170	P	Security update for the Linux Kernel (Live Patch 36 for SLE 12 SP2) (Important)	2020-12-01
oval:org.opensuse.security:def:59934	P	Security update for qemu (Important)	2020-12-01
oval:org.opensuse.security:def:58960	P	Security update for postgresql94 (Moderate)	2020-12-01
oval:org.opensuse.security:def:60123	P	Security update for LibVNCServer (Important)	2020-12-01
oval:org.opensuse.security:def:58982	P	Security update for the Linux Kernel (Live Patch 20 for SLE 12 SP2) (Important)	2020-12-01
oval:org.opensuse.security:def:59199	P	Security update for xen (Important)	2020-12-01
oval:org.opensuse.security:def:88286	P	Security update for ardana-ansible, ardana-barbican, ardana-cinder, ardana-cluster, ardana-cobbler, ardana-db, ardana-designate, ardana-extensions-nsx, ardana-glance, ardana-heat, ardana-horizon, ardana-input-model, ardana-installer-ui, ardana-ironic, ardana-keystone, ardana-logging, ardana-magnum, ardana-monasca, ardana-mq, ardana-neutron, ardana-nova, ardana-octavia, ardana-opsconsole, ardana-opsconsole-ui, ardana-osconfig, ardana-service, ardana-ses, ardana-swift, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, java-monasca-common, java-monasca-common-kit, openstack-ceilometer, openstack-cinder, openstack-designate, openstack-heat, openstack-horizon-plugin-neutron-fwaas-ui, openstack-horizon-plugin-neutron-lbaas-ui, openstack-horizon-plugin-neutron-vpnaas-ui, openstack-ironic, openstack-ironic-python-agent, openstack-keystone, openstack-magnum, openstack-manila, openstack-monasca-notification, openstack-monasca-persister, openstack-monasca-persister-java, openstack-monasca-persister-java-kit, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, openstack-octavia, openstack-tempest, python-ardana-configurationprocessor, python-cinder-tempest-plugin, python-ironicclient, python-keystonemiddleware, python-monasca-tempest-plugin, python-openstackclient, python-openstacksdk, python-proliantutils, python-python-engineio, python-swiftlm, python-vmware-nsx, python-vmware-nsxlib, yast2-crowbar (Moderate)	2019-09-18
oval:org.opensuse.security:def:87983	P	Security update for ardana-ansible, ardana-barbican, ardana-cinder, ardana-cluster, ardana-cobbler, ardana-db, ardana-designate, ardana-extensions-nsx, ardana-glance, ardana-heat, ardana-horizon, ardana-input-model, ardana-installer-ui, ardana-ironic, ardana-keystone, ardana-logging, ardana-magnum, ardana-monasca, ardana-mq, ardana-neutron, ardana-nova, ardana-octavia, ardana-opsconsole, ardana-opsconsole-ui, ardana-osconfig, ardana-service, ardana-ses, ardana-swift, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, java-monasca-common, java-monasca-common-kit, openstack-ceilometer, openstack-cinder, openstack-designate, openstack-heat, openstack-horizon-plugin-neutron-fwaas-ui, openstack-horizon-plugin-neutron-lbaas-ui, openstack-horizon-plugin-neutron-vpnaas-ui, openstack-ironic, openstack-ironic-python-agent, openstack-keystone, openstack-magnum, openstack-manila, openstack-monasca-notification, openstack-monasca-persister, openstack-monasca-persister-java, openstack-monasca-persister-java-kit, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, openstack-octavia, openstack-tempest, python-ardana-configurationprocessor, python-cinder-tempest-plugin, python-ironicclient, python-keystonemiddleware, python-monasca-tempest-plugin, python-openstackclient, python-openstacksdk, python-proliantutils, python-python-engineio, python-swiftlm, python-vmware-nsx, python-vmware-nsxlib, yast2-crowbar (Moderate)	2019-09-18
oval:org.opensuse.security:def:83885	P	Security update for ardana-ansible, ardana-db, ardana-freezer, ardana-glance, ardana-input-model, ardana-nova, ardana-osconfig, ardana-tempest, caasp-openstack-heat-templates, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, documentation-suse-openstack-cloud, galera-python-clustercheck, openstack-cinder, openstack-glance, openstack-heat, openstack-horizon-plugin-monasca-ui, openstack-horizon-plugin-neutron-fwaas-ui, openstack-ironic, openstack-keystone, openstack-manila, openstack-monasca-agent, openstack-monasca-api, openstack-monasca-persister, openstack-monasca-persister-java, openstack-murano, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, openstack-octavia, python-Beaver, python-oslo.db, python-osprofiler, python-swiftlm, venv-openstack-magnum, venv-openstack-monasca, venv-openstack-monasca-ceilometer, venv-openstack-murano, venv-openstack-neutron (Moderate)	2019-08-26
oval:org.opensuse.security:def:84333	P	Security update for ardana-ansible, ardana-db, ardana-freezer, ardana-glance, ardana-input-model, ardana-nova, ardana-osconfig, ardana-tempest, caasp-openstack-heat-templates, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, documentation-suse-openstack-cloud, galera-python-clustercheck, openstack-cinder, openstack-glance, openstack-heat, openstack-horizon-plugin-monasca-ui, openstack-horizon-plugin-neutron-fwaas-ui, openstack-ironic, openstack-keystone, openstack-manila, openstack-monasca-agent, openstack-monasca-api, openstack-monasca-persister, openstack-monasca-persister-java, openstack-murano, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, openstack-octavia, python-Beaver, python-oslo.db, python-osprofiler, python-swiftlm, venv-openstack-magnum, venv-openstack-monasca, venv-openstack-monasca-ceilometer, venv-openstack-murano, venv-openstack-neutron (Moderate)	2019-08-26
oval:com.ubuntu.disco:def:201997350000000	V	CVE-2019-9735 on Ubuntu 19.04 (disco) - medium.	2019-03-13
oval:com.ubuntu.bionic:def:201997350000000	V	CVE-2019-9735 on Ubuntu 18.04 LTS (bionic) - medium.	2019-03-13
oval:com.ubuntu.xenial:def:201997350000000	V	CVE-2019-9735 on Ubuntu 16.04 LTS (xenial) - medium.	2019-03-13
oval:com.ubuntu.bionic:def:20199735000	V	CVE-2019-9735 on Ubuntu 18.04 LTS (bionic) - medium.	2019-03-12
oval:com.ubuntu.cosmic:def:201997350000000	V	CVE-2019-9735 on Ubuntu 18.10 (cosmic) - medium.	2019-03-12
oval:com.ubuntu.cosmic:def:20199735000	V	CVE-2019-9735 on Ubuntu 18.10 (cosmic) - medium.	2019-03-12
oval:com.ubuntu.trusty:def:20199735000	V	CVE-2019-9735 on Ubuntu 14.04 LTS (trusty) - medium.	2019-03-12
oval:com.ubuntu.xenial:def:20199735000	V	CVE-2019-9735 on Ubuntu 16.04 LTS (xenial) - medium.	2019-03-12

BACK