CVE-2019-9735 : What You Need to Know

A vulnerability was found in the iptables firewall module in OpenStack Neutron versions before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. This issue can lead to the blocking of security group rules for instances on compute hosts.

Understanding CVE-2019-9735

This CVE involves a vulnerability in OpenStack Neutron that affects specific versions and can impact the application of security group rules.

What is CVE-2019-9735?

CVE-2019-9735 is a security vulnerability in the iptables firewall module of OpenStack Neutron. It occurs when a user sets a destination port in a security group rule with an unsupported protocol, potentially blocking further security group rule applications.

The Impact of CVE-2019-9735

The vulnerability can result in the blocking of security group rules for instances belonging to any project or tenant on affected compute hosts. It specifically affects deployments using the iptables security group driver.

Technical Details of CVE-2019-9735

This section provides more in-depth technical details about the vulnerability.

Vulnerability Description

The issue arises when a user with proper authentication sets a destination port in a security group rule along with a protocol that does not support that option, leading to the blocking of further application of security group rules.

Affected Systems and Versions

OpenStack Neutron versions before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3

Exploitation Mechanism

The vulnerability is exploited when a user configures a security group rule with an unsupported protocol, causing the blocking of subsequent security group rule applications.

Mitigation and Prevention

To address CVE-2019-9735, follow these mitigation and prevention strategies:

Immediate Steps to Take

Update to OpenStack Neutron versions 10.0.8, 11.0.7, 12.0.6, or 13.0.3 to eliminate the vulnerability.
Review and adjust security group rules to ensure compatibility with protocols.

Long-Term Security Practices

Regularly monitor and update security configurations to prevent similar vulnerabilities.
Educate users on proper security group rule configurations to avoid future issues.

Patching and Updates

Apply patches provided by OpenStack to fix the vulnerability and enhance security measures.