Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.3774
Moderate: openstack-neutron security update
6 December 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: openstack-neutron
Publisher: Red Hat
Operating System: Red Hat Enterprise Linux Server 7
Impact/Access: Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2018-14635
Reference: ESB-2018.2768
Original Bulletin:
https://access.redhat.com/errata/RHSA-2018:3792
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: openstack-neutron security update
Advisory ID: RHSA-2018:3792-01
Product: Red Hat Enterprise Linux OpenStack Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2018:3792
Issue date: 2018-12-05
CVE Names: CVE-2018-14635
=====================================================================
1. Summary:
An update for openstack-neutron is now available for Red Hat OpenStack
Platform 12.0 (Pike).
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat OpenStack Platform 12.0 - noarch
3. Description:
OpenStack Networking (neutron) is a pluggable, scalable, and API-driven
system that provisions networking services to virtual machines. Its main
function is to manage connectivity to and from virtual machines.
Security Fix(es):
* openstack-neutron: A router interface out of subnet IP range results in a
denial of service (CVE-2018-14635)
For more details about the security issues, including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
pages listed in the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1530131 - test_create_update_port_with_dns_domain failed with KeyError: 'dns_domain'
1539638 - neutron tempest scenario "test_from_legacy_to_ha" fails
1607822 - CVE-2018-14635 openstack-neutron: A router interface out of subnet IP range results in a denial of service
6. Package List:
Red Hat OpenStack Platform 12.0:
Source:
openstack-neutron-11.0.4-6.el7ost.src.rpm
noarch:
openstack-neutron-11.0.4-6.el7ost.noarch.rpm
openstack-neutron-common-11.0.4-6.el7ost.noarch.rpm
openstack-neutron-linuxbridge-11.0.4-6.el7ost.noarch.rpm
openstack-neutron-macvtap-agent-11.0.4-6.el7ost.noarch.rpm
openstack-neutron-metering-agent-11.0.4-6.el7ost.noarch.rpm
openstack-neutron-ml2-11.0.4-6.el7ost.noarch.rpm
openstack-neutron-openvswitch-11.0.4-6.el7ost.noarch.rpm
openstack-neutron-rpc-server-11.0.4-6.el7ost.noarch.rpm
openstack-neutron-sriov-nic-agent-11.0.4-6.el7ost.noarch.rpm
python-neutron-11.0.4-6.el7ost.noarch.rpm
python-neutron-tests-11.0.4-6.el7ost.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2018-14635
https://access.redhat.com/security/updates/classification/#moderate
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBXAgeWNzjgjWX9erEAQhwfA/7BzYP7BlH4YjPL8OJwlHCQ9I/1BHIMdEs
pSdh4ufbSLUgG8IA2scGWXRee4NzGdhU+IwjyCDihVrglNizMEZpb6FVNuzMvhLI
U2767OyZFKIllS6GEjgncbsabsVZTPh3rxH3KuJx/+hJLZGRdDAPxxahOEaP63AP
cnW2U0QVkhXdU1yUlSJnAmTolLI0UPYEEVXt/mbGYV8WT0zuq01yrSmYG3CaJEl1
KU2J5sYInTQ9918eGuJ40+xFogDkpTiEeRyu4ruVxGmF/jTr4y4dXFXsJ5nRhktu
MalK+uO5RINKlWnOXyfky+1kNAkMKcgvyD5pYqjwSQQGb51Lyj1/cQWiU41O8fBq
AoWrttfhORrfwgdyWwwluhaL94DMHZuOGyFxc+sCM0FHfpvOIw1C5blDgp9v5mnG
4Hc4ObCnNsznDI9OSsfOWxTfcVnkccaEmYypgBeYFsQ1Kf2as2dHnAPDtmZ7e/U1
T1HxkxUjIkXwP0KlvY3l42t5d1ctMvGG87+lec7AnVxSLwitDIewnCQT2ytY9MRM
ZN/0Hh54w2MUBq4hEZaDz9UTf7qL5SINHCf5Dirpbiaz06gfSBrL2glTKL2oeGE5
P4YgvQK7I0kNsYMlusrSbXle6HOXRz8fawbZhBvBCzMlTzVSxAsN3lAf/ZRRWZU/
Q1zKbI4dK0U=
=8xKl
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXAhv2GaOgq3Tt24GAQgScBAAktoe71ypTPh7TLUOZNhpIgbh5wWCbAiV
oiwNIJrlH1VIqW3KSzAilkVHWf97vo8ea4nKo6knjRlMge2LQtxp7wAQoXzwOJJd
WOVGhM/pLo37bPd24LfDYMQaL26Mw76jfxmiNMvxcLd2KLEhQCEy+S4YvoannE7B
w34mjWdCR60faDSWtQW8a6GeXnj7xKEgi1mVBjUuJ9vxC6A+mdhCepMsm+ljVbsa
8TIq7eiPFao9OMNKj5YTDH4OQS4UbrDletIK9ThwkLcK2l3fMBVrKeO1p86qKqMM
J2VNUuohHXj1rDcYBsZZcCyQczMoL4i7QRC+ulmZOYPjNSi3+AiY+WKOVXgS19id
Cfjam/qcNOs5fBh4AOJ604NhAPnpdZErPLkPalfEvPrqEycNSgkugfI+mnmcDeIz
mhD52tL0m1Gl00GcidfZD+L2AOmJ+PXTnVka+nz+PrRurXlBlWX/5qk4G4h/Yxa/
wOJky3m8DJqFFQPy1mSF6BtGGCG9K06FStruPiH548gSznWI0a1gU6FKJZx3bdnS
dBkrPypkjKrQLIVd80K50aTU3zyTxQWSULa6+fSBOYNZbBmLdR7YJWYuwDW9yPaJ
Mx4NkDBymfbDW1uQpaGEnjzWVZUAvx1R7Bj8KhO/p+y3Hk96PkPgMgG1ELzrQYS4
qp7TC2pfKq0=
=BGnn
-----END PGP SIGNATURE-----