Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 533
Alerts This Week
Warning Icon 1 533

Red Hat OpenStack 10.0: RHSA-2018-2715 Moderate: OpenStack-Neutron Bug Fix

red hat
Calendar Grey September 17, 2018
Scroller Redhat Esm H88
Patch release for openstack-neutron aimed at resolving moderate security vulnerabilities and addressing known bugs for Red Hat OpenStack Platform version 10.0.
An update for openstack-neutron is now available for Red Hat OpenStack Platform 10.0 (Newton)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

OpenStack Networking (neutron) is a pluggable, scalable, and API-driven system that provisions networking services to virtual machines. Its main function is to manage connectivity to and from virtual machines.
Security Fix(es):
* openstack-neutron: A router interface out of subnet IP range results in a denial of service (CVE-2018-14635)
For more details about the security issue, including the impact, a CVSS score, and other related information, refer to the CVE page listed in the References section.
Bug Fix(es):
* A new configuration option bridge_mac_table_size has been added for the neutron OVS agent. This value is set on every Open vSwitch bridge managed by the openvswitch-neutron-agent. The value controls the maximum number of MAC addresses that can be learned on a bridge. The default value for this new option is 50,000, which should be enough for most systems. Values outside a reasonable range (10 to 1,000,000) might be overridden by Open vSwitch. (BZ#1589031)
* Previously, when a VM was destroyed, the IPv6 lease was not removed from dnsmasq lease files due to a missing dhcp_release6 binary.
With this update, the dhcp_release6 binary is now provided in an updated dnsmasq-utils package version. (BZ#1545006)

Topics%20covered

Topics Covered

security advisory moderate denial of service Red Hat bug fix networking service openstack-neutron

References

https://access.redhat.com/security/cve/CVE-2018-14635 https://access.redhat.com/security/updates/classification#moderate

Package List

Red Hat OpenStack Platform 10.0:
Source: openstack-neutron-9.4.1-28.el7ost.src.rpm
noarch: openstack-neutron-9.4.1-28.el7ost.noarch.rpm openstack-neutron-common-9.4.1-28.el7ost.noarch.rpm openstack-neutron-linuxbridge-9.4.1-28.el7ost.noarch.rpm openstack-neutron-macvtap-agent-9.4.1-28.el7ost.noarch.rpm openstack-neutron-metering-agent-9.4.1-28.el7ost.noarch.rpm openstack-neutron-ml2-9.4.1-28.el7ost.noarch.rpm openstack-neutron-openvswitch-9.4.1-28.el7ost.noarch.rpm openstack-neutron-rpc-server-9.4.1-28.el7ost.noarch.rpm openstack-neutron-sriov-nic-agent-9.4.1-28.el7ost.noarch.rpm python-neutron-9.4.1-28.el7ost.noarch.rpm python-neutron-tests-9.4.1-28.el7ost.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key


Advisory ID: RHSA-2018:2715-01
Product: Red Hat Enterprise Linux OpenStack Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2018:2715
Issue date: 2018-09-17

Topic

An update for openstack-neutron is now available for Red Hat OpenStackPlatform 10.0 (Newton).Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory moderate denial of service Red Hat bug fix networking service openstack-neutron

Relevant Releases Architectures

Red Hat OpenStack Platform 10.0 - noarch

Bugs Fixed

1404709 - Neutron L3 Agent: AZLeastRoutersScheduler scheduler bug

1511394 - FlushError on IPAllocations when multiple subnets in the same network deleted

1532280 - ovs-vswitchd service hangs with Error too many open files

1545006 - openstack-neutron DHCP agent requires dnsmasq-utils 2.76

1561907 - test_sriov is failing on OSP10

1570908 - Cannot set --no-share on shared network that has floating_ip, gateway AND a tenant port

1575356 - [CI] Issue with addCleanup method causing scenario tests to fail

1576256 - neutron-openvswitch-agent cleans up stale flows months after they were created but it does not recreated correct flows and bridge configuration

1578414 - Sometimes dhcp_release packet isn't reaching dnsmasq process because it's being reloaded

1579400 - Neutron agents attach untagged ports to br-int, which will be trunk port if neutron-openvswitch-agent never handles them

1584845 - Packet loss during standby L3 agent restart

1589031 - The mac table size of neutron bridges (br-tun, br-int, br-*) is too small by default and eventually makes openvswitch explode

1607822 - CVE-2018-14635 openstack-neutron: A router interface out of subnet IP range results in a denial of service

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.