This bug was fixed in the package neutron - 2:11.0.6-0ubuntu1~cloud2.1
---------------
neutron (2:11.0.6-0ubuntu1~cloud2.1) xenial; urgency=medium
.
* d/p/bug1823038.patch: Cherry pick fix to ensure that None is not
passed as an argument when spawning the neutron-keepalived-state-change
agent (LP: #1823038).
.
neutron (2:11.0.6-0ubuntu1~cloud2) xenial-pike; urgency=medium
.
* d/p/fix-KeyError-in-OVS-firewall.patch: Cherry-picked from upstream
to prevent neutron ovs agent from crashing due to creation of two
security groups that both use the same remote security group, where
the first group's port range is a subset of the second (LP: #1813007).
* d/p/set-initial-ha-router-state-in-neutron-keepalived-st.patch:
Cherry-picked from upstream stable/rocky branch to ensure proper
detection of MASTER HA router by neutron-keepalived-state-change
(LP: #1818614).
** Changed in: cloud-archive/pike
Status: Fix Committed => Fix Released
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1813007
Title:
[SRU] [OSSA-2019-002] Unable to install new flows on compute nodes
when having broken security group rules (CVE-2019-10876)
Status in Ubuntu Cloud Archive:
Fix Released
Status in Ubuntu Cloud Archive pike series:
Fix Released
Status in Ubuntu Cloud Archive queens series:
Fix Committed
Status in Ubuntu Cloud Archive rocky series:
Fix Committed
Status in Ubuntu Cloud Archive stein series:
Fix Released
Status in neutron:
Fix Released
Status in OpenStack Security Advisory:
Fix Released
Status in neutron package in Ubuntu:
Fix Released
Status in neutron source package in Bionic:
Fix Released
Status in neutron source package in Cosmic:
Fix Released
Status in neutron source package in Disco:
Fix Released
Bug description:
It appears that we have found that neutron-openvswitch-agent appears to have
a bug where two security group rules that have two different port ranges that
overlap tied to the same parent security group will cause neutron to not be
able to configure networks on the compute nodes where those security groups are
present.
Those are the broken security rules:
https://pastebin.canonical.com/p/wSy8RSXt85/
Here is the log when we discovered the issue:
https://pastebin.canonical.com/p/wvFKjNWydr/
Ubuntu SRU Details
------------------
[Impact]
Neutron openvswitch agent crashes due to creation of two security groups that
both use the same remote security group, where the first group doesn't define a
port range and the second one does (one is a subset of the other; specifying no
port range is the same as a full port range).
[Test case]
See comment #18 below.
[Regression Potential]
The fix is fairly minimal and has landed upstream in master branch. It has
therefore passed all unit and function tests that get run in the upstream gate
and has been reviewed by upstream neutron core reviewers. This all helps to
minimize the regression potential.
To manage notifications about this bug go to:
https://bugs.launchpad.net/cloud-archive/+bug/1813007/+subscriptions
--
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help : https://help.launchpad.net/ListHelp
