yahoo-eng-team team mailing list archive

[Jeremy Stanley <fungi@xxxxxxxxxxx>]

** Changed in: ossa
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1818385

Title:
  [OSSA-2019-001] It's possible to add a security group rule for VRRP
  with a dport (CVE-2019-9735)

Status in neutron:
  Fix Released
Status in OpenStack Security Advisory:
  Fix Released

Bug description:
  This command should be invalid, but Neutron (Rocky) allows it to be created.
  > openstack security group rule create xxx --protocol vrrp --ingress --remote-ip <ip> --dst-port 112

  Since iptables does not allow dst-port being passed. It would trigger the following error on the compute and fail to apply any future iptable rules.
  > unknown option "--dport"

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1818385/+subscriptions