VDB
CVE-2019-10876
CVE-2019-10876
PUBLISHED
CVSS 6.5 MEDIUM
An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated user may prevent Neutron from being able to configure networks on any compute nodes where those security groups are present, because of an Open vSwitch (OVS) firewall KeyError. All Neutron deployments utilizing neutron-openvswitch-agent are affected.
EPSS 1.72% · 75.3th percentile
Risk Scores
CVSS 3.0
6.5
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score
1.72%
75.3th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| redhat | openstack | 13, 14 |
| openstack | neutron | 11.0.0, 12.0.0, 13.0.0 |
| PyPI | neutron | 13.0.0, 11.0.0, 12.0.0 |
Timeline
- Apr 5, 2019 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 24, 2021 EPSS Score
- Dec 27, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Feb 28, 2022 EPSS Score
- May 2, 2022 EPSS Score
- Jul 3, 2022 EPSS Score
- Sep 5, 2022 EPSS Score
- Nov 6, 2022 EPSS Score
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-10876 advisory
- https://access.redhat.com/errata/RHSA-2019:0879 url
- https://github.com/openstack/neutron package
- https://github.com/pypa/advisory-database/tree/main/vulns/neutron/PYSEC-2019-189.yaml url
- https://review.openstack.org/#/q/topic:bug/1813007 advisory
- http://www.openwall.com/lists/oss-security/2019/04/09/2 mailing_list
- https://access.redhat.com/errata/RHSA-2019:0935 advisory
- https://bugs.launchpad.net/ossa/+bug/1813007 issue
- https://security.openstack.org/ossa/OSSA-2019-002.html advisory