neutron

  1. Bug #1300785
  2. Comment #11

Comment 11 for bug 1300785

Revision history for this message
Tristan Cacqueray (tristan-cacqueray) wrote : Re: neutron allows security group rules with invalid cidrs, resulting in broken iptables rules (breaking iptables-restore)

Thanks for your comments!

Impact description draft #2:

Title: Neutron security groups bypass through invalid CIDR
Reporters: Stephen Ma (HP) and Christoph Thiel (Deutsche Telekom)
Products: Neutron
Versions: 2013.1 to 2013.2.3, and 2014.1

Description:
Stephen Ma from Hewlett Packard and Christoph Thiel from Deutsche Telekom reported a vulnerability in Neutron security groups. By creating a security group rule with an invalid CIDR, an authenticated user may break openvswitch-agent process, preventing further rules from being applied on the host. Note: removal of the faulty rule is not enough, the openvswitch-agent must be restarted. All Neutron setups using Open vSwitch are affected.