[RHSA-2019:0935-01] Important: openstack-neutron security and bug fix update

[Security announcements for all Red Hat products and services.]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: openstack-neutron security and bug fix update
Advisory ID:       RHSA-2019:0935-01
Product:           Red Hat Enterprise Linux OpenStack Platform
Advisory URL:      https://access.redhat.com/errata/RHSA-2019:0935
Issue date:        2019-04-30
CVE Names:         CVE-2019-9735 CVE-2019-10876 
=====================================================================

1. Summary:

An update for openstack-neutron is now available for Red Hat OpenStack
Platform 13.0 (Queens).

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenStack Platform 13.0 - noarch

3. Description:

OpenStack Networking (neutron) is a pluggable, scalable, and API-driven
system that provisions networking services to virtual machines. Its main
function is to manage connectivity to and from virtual machines.

Security Fix(es):

* openstack-neutron: incorrect validation of port settings in iptables
security group driver (CVE-2019-9735)

* openstack-neutron: DOS via broken port range merging in security group
(CVE-2019-10876)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1610468 - floating ip not reachable on vlan with two different networks and multiple VMs
1629465 - Prevent SR-IOV / direct port from being attached to neutron router (DVR or not)
1630167 - [FFWD] Tempest test_dualnet_dhcp6_stateless_from_os failed
1643135 - OSP 13 - OVS/ml2 - ipv6 forwarding is broken in HA neutron routers due to incorrect ipv6 kernel forwarding parameters
1651936 - [RHOSP 13][DVR] Neutron doesn't configure multiple external subnets for one network properly
1654840 - Routers hosted on one of two networker nodes unable to access external network
1685893 - DHCP Agent should not release DHCP lease when client ID is not set on port
1690745 - CVE-2019-9735 openstack-neutron: incorrect validation of port settings in iptables security group driver
1695451 - CVE-2019-10876 openstack-neutron: DOS via broken port range merging in security group [openstack-13-default]
1695883 - CVE-2019-10876 openstack-neutron: DOS via broken port range merging in security group
1696792 - Rebase openstack-neutron to 8b744646264a1fda50f13739a4476cdf32172d0f

6. Package List:

Red Hat OpenStack Platform 13.0:

Source:
openstack-neutron-12.0.5-11.el7ost.src.rpm

noarch:
openstack-neutron-12.0.5-11.el7ost.noarch.rpm
openstack-neutron-common-12.0.5-11.el7ost.noarch.rpm
openstack-neutron-linuxbridge-12.0.5-11.el7ost.noarch.rpm
openstack-neutron-macvtap-agent-12.0.5-11.el7ost.noarch.rpm
openstack-neutron-metering-agent-12.0.5-11.el7ost.noarch.rpm
openstack-neutron-ml2-12.0.5-11.el7ost.noarch.rpm
openstack-neutron-openvswitch-12.0.5-11.el7ost.noarch.rpm
openstack-neutron-rpc-server-12.0.5-11.el7ost.noarch.rpm
openstack-neutron-sriov-nic-agent-12.0.5-11.el7ost.noarch.rpm
python-neutron-12.0.5-11.el7ost.noarch.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2019-9735
https://access.redhat.com/security/cve/CVE-2019-10876
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2019 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXMiHjtzjgjWX9erEAQhMbA/8DbzmHbTwvvsQgMh3+RVtlrnEzKdlQEvA
FVM7PZ5b5ybhatY1ePkSOwDYYZebipKXID1UJapiXqXlh+WHPz/IqLtt+cPX6tdZ
XXeAVeABUU0AZnfXlqY8/QsUt55N1s9zR9QTtsGOR0fY2KuOk15SWQx8GmhLLXBG
gxA1rAO0CaXq/gbaoDSomBupogy+sptBMdtC2dPRHbAmwRXmqwSE0F/aMhTvpP6q
/+HK8+8isxHP+Aj7+Q906LCwlkiEfUn1IiTCTlc1LQEs0x9F3W9S72I3Y/Rcs+r6
w0aAfHJMxnjnZIOv7btERPFnI/U4FcEjRrre+mQrbuIcr5xXWyatPbClv/MY4yne
Yzw1EBDyi2z9mR5f1AxxB3iDRdCs6CAFjyxosMEzcS5OQsG3qhainiK9F3vqFx/W
YhEXDD4ycM11J1nmczfzNyLwrqjaaldZibRKPqInvEQxL7y/wCJhi7wCeHhynoKU
i6MoUi/0NH9VYwAmyiyuCHS8Ghypli57C3bf+NqkUK4Gafpp+xFsKXfpjuovqPvv
Uh5f/x1aQ/fGSZBhtcqmqxwa731yOrsVk3Dzza5LsN5+xixvvoVFy3qZazUgf+Jf
n4yPYsE0NNqJEVinD9ue4EZ34H4u+BdcMFwNZ1Bv3NcgV5qMs4QCJV+HdlCNV7Sw
ZqKJSSkwtmM=
=47Dj
-----END PGP SIGNATURE-----