ha_vrrp_auth_type defaults to PASS which is insecure
Bug #1666959 reported by
Adam Spiers
This bug affects 1 person
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
OpenStack Security Advisory |
Won't Fix
|
Undecided
|
Unassigned | ||
neutron |
Won't Fix
|
Undecided
|
Unassigned |
Bug Description
With l3_ha enabled, ha_vrrp_auth_type defaults to PASS authentication:
which according to http://
I'm not sure if this is currently a serious issue, since if the VRRP network is untrusted, maybe there are already bigger problems. But I thought it was worth reporting, at least.
Changed in neutron: | |
status: | New → Won't Fix |
To post a comment you must log in.
Looks like this was introduced in https:/ /review. openstack. org/70700 back in 2014.4 so affects all currently supported branches.