VYPR
← All advisories
High severityOSV Advisory· Published Mar 13, 2019· Updated Aug 4, 2024

CVE-2019-9735

CVE-2019-9735

Description

An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By setting a destination port in a security group rule along with a protocol that doesn't support that option (for example, VRRP), an authenticated user may block further application of security group rules for instances from any project/tenant on the compute hosts to which it's applied. (Only deployments using the iptables security group driver are affected.)

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

OpenStack Neutron iptables driver fails to validate protocol/port combinations, allowing authenticated users to block security group rules across tenants.

Vulnerability

An input-validation flaw exists in the iptables firewall module of OpenStack Neutron before version 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3 [1]. The issue occurs when an authenticated user defines a security group rule with a destination port for a protocol that does not support port numbers, such as VRRP [1]. The code path is reachable only in deployments using the iptables security group driver [1].

Exploitation

An attacker with a valid project/user identity in OpenStack can create or update a security group rule specifying a protocol that lacks port semantics (e.g., VRRP) and supply a destination port in the API request [1]. No additional privileges or special network access are required beyond standard authentication for the compute API [1]. The flawed rule causes the iptables driver to fail when generating firewall rules, preventing further security group rules from being applied on any instance from any project/tenant on the affected compute hosts [1].

Impact

Successful exploitation results in a denial of service (DoS): no new security group rules are applied to instances on compute hosts where the driver processes the malicious rule [1]. Existing rules remain in place, but administrators and users cannot modify or add rules for any project's instances on those hosts [1]. The scope is limited to compute nodes that use the iptables security group driver; other drivers are unaffected [1].

Mitigation

Red Hat issued errata RHSA-2019:0879, RHSA-2019:0935, and RHSA-2019:0916 for Red Hat OpenStack Platform 14 (Rocky), 13 (Queens), and 10 (Newton) respectively, updating openstack-neutron to fixed versions 13.0.3, 12.0.6, and 10.0.8 [2][3][4]. For community deployments, upgrade to Neutron 10.0.8, 11.0.7, 12.0.6, or 13.0.3 as appropriate [1]. No workaround is documented for unpatched installations; the only remedy is to apply the fix. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

References
  1. NVD - CVE-2019-9735
  2. https://access.redhat.com/errata/RHSA-2019:0879
  3. https://access.redhat.com/errata/RHSA-2019:0935
  4. https://access.redhat.com/errata/RHSA-2019:0916

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
neutronPyPI
< 10.0.810.0.8
neutronPyPI
>= 11.0.0, < 11.0.711.0.7
neutronPyPI
>= 12.0.0, < 12.0.612.0.6
neutronPyPI
>= 13.0.0, < 13.0.313.0.3

Affected products

265

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

15

News mentions

0

No linked articles in our index yet.