CVE-2019-10876
CVE-2019-10876 is a medium-severity vulnerability in Openstack Neutron with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: Medium (CVSS 3.x base score 6.5)
- CVSS v2: 4.0
- EPSS exploit prediction: 2% (75th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Openstack Neutron
- Published:
- Last modified:
Description
An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated user may prevent Neutron from being able to configure networks on any compute nodes where those security groups are present, because of an Open vSwitch (OVS) firewall KeyError. All Neutron deployments utilizing neutron-openvswitch-agent are affected.
Frequently asked questions
- What is CVE-2019-10876?
- An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated user may prevent Neutron from being able to configure networks on any compute nodes where those security groups are present, because of an Open vSwitch (OVS) firewall KeyError. All Neutron deployments utilizing neutron-openvswitch-agent are affected.
- How severe is CVE-2019-10876?
- CVE-2019-10876 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
- Is CVE-2019-10876 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (75th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2019-10876?
- CVE-2019-10876 primarily affects Openstack Neutron. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2019-10876?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2019-10876 published?
- CVE-2019-10876 was published on 2019-04-05 and last updated on 2026-06-17.
References
- http://www.openwall.com/lists/oss-security/2019/04/09/2
- https://access.redhat.com/errata/RHSA-2019:0879
- https://access.redhat.com/errata/RHSA-2019:0935
- https://bugs.launchpad.net/ossa/+bug/1813007
- https://review.openstack.org/#/q/topic:bug/1813007
- https://security.openstack.org/ossa/OSSA-2019-002.html
Affected products (3)
- cpe:2.3:a:openstack:neutron:*:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:openstack:14:*:*:*:*:*:*:*
More vulnerabilities in Openstack Neutron
- CVE-2021-38598 — Critical (CVSS 9.1): OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the…
- CVE-2015-8914 — Critical (CVSS 9.1): The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an…
- CVE-2014-0187 — Critical (CVSS 9.0): The openvswitch-agent process in OpenStack Neutron 2013.1 before 2013.2.4 and 2014.1 before 2014.1.1 allows remote…
- CVE-2016-5363 — High (CVSS 8.2): The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an…
- CVE-2016-5362 — High (CVSS 8.2): The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an…
- CVE-2014-3632 — High (CVSS 7.6): The default configuration in a sudoers file in the Red Hat openstack-neutron package before 2014.1.2-4, as used in Red…