Bug 863751 (CVE-2014-0071) - VUL-0: CVE-2014-0071: openstack-neutron: Security Groups fail to block network traffic
Summary: VUL-0: CVE-2014-0071: openstack-neutron: Security Groups fail to block networ...
Status: RESOLVED UPSTREAM
Alias: CVE-2014-0071
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Nanuk Krinner
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-02-13 10:41 UTC by Alexander Bergmann
Modified: 2016-04-27 19:20 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2014-02-13 10:41:58 UTC 
https://bugzilla.redhat.com/show_bug.cgi?id=1064163

Yair Fried of Red Hat reports:

A regression from Grizzly and Havana exists in Neutron. Specifically when 
default security groups are enabled they are not enforced, allowing 
connectivity to systems that should be blocked by the security groups.

CVE-2014-0071 was assigned to this issue.

References:
https://review.openstack.org/#/c/62702/
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0071
Comment 1 Vincent Untz 2014-02-13 17:34:50 UTC 
So the only relevant info I could find on this is in https://bugs.launchpad.net/devstack/+bug/1252620

And the short story is that with OVS, if the hybrid driver is not used, then this is vulnerable.

We're using libvirt_vif_driver=nova.virt.libvirt.vif.LibvirtHybridOVSBridgeDriver in nova.conf, so I think we're safe.

We'd be hit in Cloud 4 with Icehouse, but I assume that by then, upstream will have fixed the security issue.

Bernhard, can you double-check my analysis?
Comment 2 Swamp Workflow Management 2014-02-13 23:00:30 UTC 
bugbot adjusting priority
Comment 5 SMASH SMASH 2014-02-19 08:55:21 UTC 
Affected packages:

SLE-11-SP3-PRODUCTS: openstack-neutron
Comment 6 Bernhard Wiedemann 2014-04-01 08:26:43 UTC 
Tested with SUSE Cloud 3 GM + update-test
openvswitch and linuxbridge mode
that traffic from outside the cloud to the floating IP
is filtered by security groups
and traffic from another tenant to the nova_fixed IP is filtered, too

Just traffic between instances of the same tenant/project are allowed through
which is likely intended.

So we are not affected by this issue.
Comment 8 Nanuk Krinner 2014-04-28 12:44:36 UTC 
The fix has been merged to Icehouse:
https://bugs.launchpad.net/nova/+bug/1112912/comments/33
Comment 9 Nanuk Krinner 2014-04-28 13:27:22 UTC 
No product is affected and upstream has merged the fix to the Icehouse release, we close as resolved.