VYPR
← All advisories
High severityOSV Advisory· Published Apr 5, 2019· Updated Aug 4, 2024

CVE-2019-10876

CVE-2019-10876

Description

An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated user may prevent Neutron from being able to configure networks on any compute nodes where those security groups are present, because of an Open vSwitch (OVS) firewall KeyError. All Neutron deployments utilizing neutron-openvswitch-agent are affected.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In OpenStack Neutron, an authenticated user can cause a denial of service by creating security groups with overlapping port ranges, triggering an OVS firewall KeyError.

Vulnerability

Description

CVE-2019-10876 is a denial-of-service vulnerability in OpenStack Neutron, the networking component of OpenStack. The issue arises from incorrect handling of security group rules with overlapping port ranges in the Open vSwitch (OVS) firewall driver. When two security groups with separate or overlapping port ranges are created, the Neutron openvswitch agent encounters a KeyError while merging port ranges, which prevents it from installing new flows on compute nodes [1][4].

Exploitation

An authenticated user with the ability to create security groups can exploit this vulnerability by deliberately crafting two security groups with overlapping port ranges. This action triggers the KeyError in the OVS firewall, causing the neutron-openvswitch-agent to fail to configure network flows on any compute node where those security groups are applied. No additional privileges or network position are required beyond standard user permissions [1].

Impact

Successful exploitation leads to a denial of service: Neutron becomes unable to configure networks on affected compute nodes, disrupting connectivity for virtual machines and other network services. The vulnerability affects all Neutron deployments using the neutron-openvswitch-agent, including Red Hat OpenStack Platform versions 13 (Queens) and 14 (Rocky) [2][3].

Mitigation

The vulnerability is fixed in Neutron versions 11.0.7, 12.0.6, and 13.0.3. Red Hat provided security updates via RHSA-2019:0879 and RHSA-2019:0935 for affected platforms [2][3]. Users should upgrade to the patched versions or apply the recommended updates. No workarounds are documented [4].

References
  1. NVD - CVE-2019-10876
  2. https://access.redhat.com/errata/RHSA-2019:0879
  3. https://access.redhat.com/errata/RHSA-2019:0935
  4. Bug #1813007 “[SRU] [OSSA-2019-002] Unable to install new flows ...” : Bugs : OpenStack Security Advisory

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
neutronPyPI
>= 11.0.0, < 11.0.711.0.7
neutronPyPI
>= 12.0.0, < 12.0.612.0.6
neutronPyPI
>= 13.0.0, < 13.0.313.0.3

Affected products

483

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

9

News mentions

0

No linked articles in our index yet.