CVE-2014-3555: Denial of Service in Neutron allowed address pair

Debian Bug report logs - #755134
CVE-2014-3555: Denial of Service in Neutron allowed address pair

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Thomas Goirand <zigo@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2014-3555: Denial of Service in Neutron allowed address pair

Date: Fri, 18 Jul 2014 10:30:45 +0800

Package: neutron
Version: 2014.1.1-2
Severity: normal
Tags: security patch

pre-OSS announce below before my upload including upstream fix.

Title: Denial of Service in Neutron allowed address pair
Reporter: Liping Mao (Cisco)
Products: Neutron
Versions: up to 2013.2.3, and 2014.1 versions up to 2014.1.1

Description:
Liping Mao from Cisco reported a denial of service vulnerability in
Neutron's handling of allowed address pair. By creating a large number
of allowed address pairs, an authenticated user may overwhelm neutron
firewall rules and render compute nodes unusable. All Neutron setups are
affected.

Proposed patch:
See attached patches. Unless a flaw is discovered in them, these patches
will be merged to stable/havana, stable/icehouse and master (Juno
development branch) on the public disclosure date.

CVE: CVE-2014-3555

Proposed public disclosure date/time:
2014-07-17, 1500UTC
Please do not make the issue public (or release public patches) before
this coordinated embargo date.

Regards,

Tristan Cacqueray
OpenStack Vulnerability Management Team

Message #10 received at 755134-close@bugs.debian.org (full text, mbox, reply):

From: Thomas Goirand <zigo@debian.org>

To: 755134-close@bugs.debian.org

Subject: Bug#755134: fixed in neutron 2014.1.1-3

Date: Fri, 18 Jul 2014 04:19:52 +0000

Source: neutron
Source-Version: 2014.1.1-3

We believe that the bug you reported is fixed in the latest version of
neutron, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 755134@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Thomas Goirand <zigo@debian.org> (supplier of updated neutron package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Fri, 18 Jul 2014 10:33:05 +0800
Source: neutron
Binary: python-neutron neutron-server neutron-common neutron-plugin-nec-agent neutron-l3-agent neutron-dhcp-agent neutron-metadata-agent neutron-metering-agent neutron-vpn-agent neutron-lbaas-agent neutron-plugin-openvswitch-agent neutron-plugin-linuxbridge-agent python-quantum quantum-server quantum-common quantum-plugin-cisco quantum-plugin-nec quantum-plugin-nec-agent quantum-plugin-bigswitch quantum-plugin-hyperv quantum-plugin-brocade quantum-plugin-plumgrid quantum-plugin-metaplugin quantum-plugin-nicira quantum-l3-agent quantum-dhcp-agent quantum-metadata-agent quantum-lbaas-agent quantum-plugin-openvswitch quantum-plugin-openvswitch-agent quantum-plugin-linuxbridge quantum-plugin-linuxbridge-agent
Architecture: source all
Version: 2014.1.1-3
Distribution: unstable
Urgency: high
Maintainer: PKG OpenStack <openstack-devel@lists.alioth.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Description:
 neutron-common - OpenStack virtual network service - common files
 neutron-dhcp-agent - OpenStack virtual network service - DHCP agent
 neutron-l3-agent - OpenStack virtual network service - l3 agent
 neutron-lbaas-agent - OpenStack virtual network service - LBaaS agent
 neutron-metadata-agent - OpenStack virtual network service - metadata agent
 neutron-metering-agent - OpenStack virtual network service - metering agent
 neutron-plugin-linuxbridge-agent - OpenStack virtual network service - Linux bridge agent
 neutron-plugin-nec-agent - OpenStack virtual network service - NEC agent
 neutron-plugin-openvswitch-agent - OpenStack virtual network service - Open vSwitch agent
 neutron-server - OpenStack virtual network service - server
 neutron-vpn-agent - OpenStack virtual network service - VPN agent
 python-neutron - OpenStack virtual network service - Python library
 python-quantum - transitional dummy package for switching to python-neutron
 quantum-common - transitional dummy package for switching to neutron-common
 quantum-dhcp-agent - transitional dummy package for upgrading quantum-dhcp-agent
 quantum-l3-agent - transitional dummy package for upgrading quantum-l3-agent
 quantum-lbaas-agent - transitional dummy package for upgrading quantum-lbaas-agent
 quantum-metadata-agent - transitional dummy package for upgrading quantum-metadata-agent
 quantum-plugin-bigswitch - transitional dummy package for upgrading quantum-plugin-bigswitch
 quantum-plugin-brocade - transitional dummy package for upgrading quantum-plugin-brocade
 quantum-plugin-cisco - transitional dummy package for upgrading quantum-plugin-cisco
 quantum-plugin-hyperv - transitional dummy package for upgrading quantum-plugin-hyperv
 quantum-plugin-linuxbridge - transitional dummy package for upgrading quantum-plugin-linuxbrid
 quantum-plugin-linuxbridge-agent - transitional dummy package for upgrading quantum-plugin-linuxbrid
 quantum-plugin-metaplugin - transitional dummy package for upgrading quantum-plugin-metaplugi
 quantum-plugin-nec - transitional dummy package for upgrading quantum-plugin-nec
 quantum-plugin-nec-agent - transitional dummy package for upgrading quantum-plugin-nec-agent
 quantum-plugin-nicira - transitional dummy package for upgrading quantum-plugin-nicira
 quantum-plugin-openvswitch - transitional dummy package for upgrading quantum-plugin-openvswit
 quantum-plugin-openvswitch-agent - transitional dummy package for upgrading quantum-plugin-openvswit
 quantum-plugin-plumgrid - transitional dummy package for upgrading quantum-plugin-plumgrid
 quantum-server - transitional dummy package for switching to neutron-server
Closes: 755134
Changes:
 neutron (2014.1.1-3) unstable; urgency=high
 .
   * CVE-2014-3555: Denial of Service in Neutron allowed address pair. Applied
     upstream patch (Closes: #755134).
Checksums-Sha1:
 ad4e2408db122c7e1b17f8559ba1f8f189b13c03 5537 neutron_2014.1.1-3.dsc
 bc2988bd6de45c12355c87684e6a6e625c433b56 45248 neutron_2014.1.1-3.debian.tar.xz
 254ef0dd23feade8b5743fd1cc6f7a9c8403338e 1123354 python-neutron_2014.1.1-3_all.deb
 b3d5464643a1ce304d9bf86fce4edc092f4388c4 22018 neutron-server_2014.1.1-3_all.deb
 7f6f3afdde07c37d4c5c19265b67e139d4d46633 61270 neutron-common_2014.1.1-3_all.deb
 f369ffd881c8e0b851b33f8d01f251736fcd0090 5776 neutron-plugin-nec-agent_2014.1.1-3_all.deb
 cdf304afd19a5bf383d7817215d7a6663e62853d 8326 neutron-l3-agent_2014.1.1-3_all.deb
 2ed47e230dd231412e86dff22c4cf5460be50a39 16488 neutron-dhcp-agent_2014.1.1-3_all.deb
 dca8fa512e0259a465398944c245e4a1bba7a179 19130 neutron-metadata-agent_2014.1.1-3_all.deb
 28ac724f704b82c92fc2da7370f722dd73f1739f 7094 neutron-metering-agent_2014.1.1-3_all.deb
 c98ea4e42897e441af5597c9c949623b3564f96a 7150 neutron-vpn-agent_2014.1.1-3_all.deb
 c4585817a3c9ceecdbb741d0df0ce655f61ec54d 7640 neutron-lbaas-agent_2014.1.1-3_all.deb
 7e8e529ae92761f21e921478bfff34e88698c994 7696 neutron-plugin-openvswitch-agent_2014.1.1-3_all.deb
 74eca5f34cf81ec793aa8c485e6961739fe0fb88 7168 neutron-plugin-linuxbridge-agent_2014.1.1-3_all.deb
 05d908adc018d0c3c67d1cdfac9f198f92fed6e9 5192 python-quantum_2014.1.1-3_all.deb
 d7320fefacb9e90e7cb8034425b43031979fcf97 5190 quantum-server_2014.1.1-3_all.deb
 d083444f7664ac388cade3302f6fdc7c6366b794 5194 quantum-common_2014.1.1-3_all.deb
 8dbc336703fd678c2a94a77a5f6f022b99d66f27 5202 quantum-plugin-cisco_2014.1.1-3_all.deb
 cde4780ee349135ed40e05cc845c1a1971c1e847 5198 quantum-plugin-nec_2014.1.1-3_all.deb
 3ad0e14a7d77df39b889846309bb93300cb657c8 5210 quantum-plugin-nec-agent_2014.1.1-3_all.deb
 f67082b469b48ecef326f099443c373a9aed4c4f 5208 quantum-plugin-bigswitch_2014.1.1-3_all.deb
 f2596c8c465a98f2fa4ac877726c2a27a473c784 5206 quantum-plugin-hyperv_2014.1.1-3_all.deb
 dac9ff5bd363916dad16383c105ba9d0b3c22567 5208 quantum-plugin-brocade_2014.1.1-3_all.deb
 c15b50252e9850b1ca7b0dff85750a94f2f42a2d 5204 quantum-plugin-plumgrid_2014.1.1-3_all.deb
 59de6197e3226c05eea6c33689c8027a8cc9c648 5206 quantum-plugin-metaplugin_2014.1.1-3_all.deb
 de0aaa58c64e2124117bb9b6fbf058c17901b131 5204 quantum-plugin-nicira_2014.1.1-3_all.deb
 83e8f5a9421e97398fc331351a784d5f4a948b64 5194 quantum-l3-agent_2014.1.1-3_all.deb
 d072a35d7c7c04a919d96b95421a7e5b5e3fc772 5196 quantum-dhcp-agent_2014.1.1-3_all.deb
 2e04632996be12aff51783d8ec670a04d08d25f1 5212 quantum-metadata-agent_2014.1.1-3_all.deb
 6c74707a1baa09d5331e0ad273db17448e71da57 5212 quantum-lbaas-agent_2014.1.1-3_all.deb
 80269171fa95ab19362570f07393031542b9f691 5212 quantum-plugin-openvswitch_2014.1.1-3_all.deb
 5443a0ac8a9828ddb2dc257a2c387a7985486c9b 5224 quantum-plugin-openvswitch-agent_2014.1.1-3_all.deb
 7242655b99534d2c8cb36594316d8ebd0c28023a 5214 quantum-plugin-linuxbridge_2014.1.1-3_all.deb
 6221f1d0ff438635854a0d3589fd2d5fd72da6bd 5222 quantum-plugin-linuxbridge-agent_2014.1.1-3_all.deb
Checksums-Sha256:
 4267dfc30fbe9d46dd1be1e69626ee0f3aaf991989089e3c41b1fe9d7c701348 5537 neutron_2014.1.1-3.dsc
 9404391d80d8a46eaf4928c96b23a6d1fef8dbcd0a242425945875321bb6b794 45248 neutron_2014.1.1-3.debian.tar.xz
 2b58bf031127a77826bf93df4c9507eea96269d7ff52ef42e35d43ff874b3016 1123354 python-neutron_2014.1.1-3_all.deb
 1ce716539dbe241b5e7bb179242cfa74b270bea9f7f87cf638fbc0888fa0b893 22018 neutron-server_2014.1.1-3_all.deb
 08d6c0b96730d8f16f02b0b70bdfafd7a49692f4aa8c5e06efe8b86e8ee9df4f 61270 neutron-common_2014.1.1-3_all.deb
 45990bd45311e33891d423615654fcbb41665721374be361b8af3fa9b875bd20 5776 neutron-plugin-nec-agent_2014.1.1-3_all.deb
 bf8d1cdcdea7ca764e7df43125f7faf04df98b6229bc031185cc16447a0c5ee4 8326 neutron-l3-agent_2014.1.1-3_all.deb
 88c6f2e246552a8ca599fec64dfce4e1fa7565a8a346bca8829881a3f90f4e2b 16488 neutron-dhcp-agent_2014.1.1-3_all.deb
 dbc2aff24b7533765336c7585a825b502f0760aa2712e0a86e8f0b2a68bf19c7 19130 neutron-metadata-agent_2014.1.1-3_all.deb
 7b6668d6192160cbd281d6011e5f8f96e8c8f46459d259f2e7caf0d76757e9bb 7094 neutron-metering-agent_2014.1.1-3_all.deb
 fe19e2f105f017b981b2d754f6af35af99a58aa3df69df6823d04d01bf0cce02 7150 neutron-vpn-agent_2014.1.1-3_all.deb
 b5d3a13a4b87e41a4b1d6d982518caf49eb3a9a5237a756372b5d92707dc0efd 7640 neutron-lbaas-agent_2014.1.1-3_all.deb
 666da75ea09c08d156ddc466a23777fc610b4458f5a424de238139ee4a4a9d08 7696 neutron-plugin-openvswitch-agent_2014.1.1-3_all.deb
 5e38290934fdbcc7596934db490a69b66d63cfae8df2bedf2cc1caf577deaf34 7168 neutron-plugin-linuxbridge-agent_2014.1.1-3_all.deb
 5c53fa492888303b3159e6887799d76c2e2dbbf68ac6368cf9d1076e86eb213a 5192 python-quantum_2014.1.1-3_all.deb
 fede67910ce399bc0d80c6c10a5e219e450322c59966caf88346723e622b5927 5190 quantum-server_2014.1.1-3_all.deb
 e5e6fc8e7a6d3386bdceb13cb84ae9657d7b193a68da1bee0d4f01064b229b9c 5194 quantum-common_2014.1.1-3_all.deb
 ffb0d20420dadae07b28075733b2868401ae85c4b3aa300e4bb3cd8d5b6acf9d 5202 quantum-plugin-cisco_2014.1.1-3_all.deb
 0e4bcbb3ac91a447415d3cea73a023137327061ab9662853951d8950a0c75711 5198 quantum-plugin-nec_2014.1.1-3_all.deb
 3c0675b8ac12885177997993efe4d2ad304601157a23c7082db9b43a8a138d11 5210 quantum-plugin-nec-agent_2014.1.1-3_all.deb
 8d48d30c4474043db3985412262320880f3cc61bf971aeb6b00955f6ebb8d97d 5208 quantum-plugin-bigswitch_2014.1.1-3_all.deb
 7b4742aef76031711e023de5f6af873c44d4206ac387081933c6d25bbfe332cf 5206 quantum-plugin-hyperv_2014.1.1-3_all.deb
 642ce63ad2f6c57cc3f880c977c73a02da16d468d6d1464c32979e47e50b4077 5208 quantum-plugin-brocade_2014.1.1-3_all.deb
 485e3cce6e5a45391122f482903ef05fedadc3f2aa60db2e2924ed96e5d3c635 5204 quantum-plugin-plumgrid_2014.1.1-3_all.deb
 df4708cb6a414d2696342dfbf44916dc6bb6d476a85862c1b336e301a9c798be 5206 quantum-plugin-metaplugin_2014.1.1-3_all.deb
 7c357d28d7c89f5a3c22d4c33579972b73e72ece8080b8cd8c65f142175ab831 5204 quantum-plugin-nicira_2014.1.1-3_all.deb
 0376580cfbc11b40cda72ecefb60321d99f1bf115eec6756d76c9af49a609c96 5194 quantum-l3-agent_2014.1.1-3_all.deb
 9e8b0cbde936b4622cf0369a661c80763bdd9280ad339a84e9345f0614c838fe 5196 quantum-dhcp-agent_2014.1.1-3_all.deb
 3fdf4c431b85b06f06e83617ec6b4c8265c7ad53287c60302ea1b91fe84a892f 5212 quantum-metadata-agent_2014.1.1-3_all.deb
 2e105e335d7623c550b47100d1de5db97f25ebc75811d9fc45e57fea9ee45c54 5212 quantum-lbaas-agent_2014.1.1-3_all.deb
 93998b55422ca1998a1ee05f1f08c3f410576914686449f14ef606534759e83b 5212 quantum-plugin-openvswitch_2014.1.1-3_all.deb
 ac6a5021383f955d29844a5ed853705150a8ccb2bdb4c2036a7b8466972a72b4 5224 quantum-plugin-openvswitch-agent_2014.1.1-3_all.deb
 287557bdc713218671e4d8e1ba2dc02ede7d881e5e3b687ad987aa97ff2e1f3c 5214 quantum-plugin-linuxbridge_2014.1.1-3_all.deb
 d72719a3e84fbdb697b5015542bc649977609261e07fed6405cf17fb0e820954 5222 quantum-plugin-linuxbridge-agent_2014.1.1-3_all.deb
Files:
 6b19a6dbf87a95b3b24ce6a4f7c6f57c 1123354 python optional python-neutron_2014.1.1-3_all.deb
 cd037ffaee2202d094127849428e41f7 22018 net optional neutron-server_2014.1.1-3_all.deb
 a5f37ff3418c18d4995f657fb4510423 61270 net optional neutron-common_2014.1.1-3_all.deb
 b8edb5f32e040a8d6c9154d8bc272b6c 5776 net optional neutron-plugin-nec-agent_2014.1.1-3_all.deb
 a41b06887c6452ec1c1399dc7aa62563 8326 net optional neutron-l3-agent_2014.1.1-3_all.deb
 fe2964f06212b3c27febf3bd50f3a3a1 16488 net optional neutron-dhcp-agent_2014.1.1-3_all.deb
 3a46b009741eaff7524df70c453e2129 19130 net optional neutron-metadata-agent_2014.1.1-3_all.deb
 57808a3a5d62d7746c4ba53627e11322 7094 net optional neutron-metering-agent_2014.1.1-3_all.deb
 2310b463c65866a4b747c697ad960442 7150 net optional neutron-vpn-agent_2014.1.1-3_all.deb
 aebcab5bba5c87adfbd63c8ab12213e8 7640 net optional neutron-lbaas-agent_2014.1.1-3_all.deb
 e28382af3d8851273168f934453ed5db 7696 net optional neutron-plugin-openvswitch-agent_2014.1.1-3_all.deb
 78c90a79a3203ed22cbc8c229c949dab 7168 net optional neutron-plugin-linuxbridge-agent_2014.1.1-3_all.deb
 5b1ab8f1d095cf65ae321c89fe371360 5192 oldlibs optional python-quantum_2014.1.1-3_all.deb
 75e0e1ba179ac6ab408308bc6df73194 5190 oldlibs optional quantum-server_2014.1.1-3_all.deb
 73f120d7f1f355aa407e2d96e686ade3 5194 oldlibs optional quantum-common_2014.1.1-3_all.deb
 a17118c8b691ecd5210b0abea227e6ba 5202 oldlibs optional quantum-plugin-cisco_2014.1.1-3_all.deb
 f1f5a1a44d05225aff1d5c22cfa3b55b 5198 oldlibs optional quantum-plugin-nec_2014.1.1-3_all.deb
 03c832f1cdc69a738f42b7f74f622857 5210 oldlibs optional quantum-plugin-nec-agent_2014.1.1-3_all.deb
 8ed6f33cc5cb6695261b434c4a7062ca 5208 oldlibs optional quantum-plugin-bigswitch_2014.1.1-3_all.deb
 8dd335a74e3a7f14785a716ca9ecf7c1 5206 oldlibs optional quantum-plugin-hyperv_2014.1.1-3_all.deb
 68568bc3d2dfd2c5b4d14284ed89d207 5208 oldlibs optional quantum-plugin-brocade_2014.1.1-3_all.deb
 63ef2d3cd277db9bad3c83c9312bad3b 5204 oldlibs optional quantum-plugin-plumgrid_2014.1.1-3_all.deb
 eb4b104e372589bed525254b2f64c06b 5206 oldlibs optional quantum-plugin-metaplugin_2014.1.1-3_all.deb
 a3c8e9e8e2afa97e64405bd52d045678 5204 oldlibs optional quantum-plugin-nicira_2014.1.1-3_all.deb
 9d363b2f2ba75181fadfa19e9fb88c65 5194 oldlibs optional quantum-l3-agent_2014.1.1-3_all.deb
 1392f82fa8f8fc60816da49e1361bee7 5196 oldlibs optional quantum-dhcp-agent_2014.1.1-3_all.deb
 fbc0b624b438e9c3175d247be9251ba3 5212 oldlibs optional quantum-metadata-agent_2014.1.1-3_all.deb
 7505d79f9a2087d5b2d03fade8818f05 5212 oldlibs optional quantum-lbaas-agent_2014.1.1-3_all.deb
 d969a2135fc827e03cbb4ca19cd087b3 5212 oldlibs optional quantum-plugin-openvswitch_2014.1.1-3_all.deb
 d6501f70241778b4d3f7ee4d01e3d25c 5224 oldlibs optional quantum-plugin-openvswitch-agent_2014.1.1-3_all.deb
 c70c3dd9894782d8b2e401617ac7b93a 5214 oldlibs optional quantum-plugin-linuxbridge_2014.1.1-3_all.deb
 ec1a9423e2543675e99bf4696b501eeb 5222 oldlibs optional quantum-plugin-linuxbridge-agent_2014.1.1-3_all.deb
 91f48851930a3d7047a035ffafc68dba 5537 net optional neutron_2014.1.1-3.dsc
 aa213166b2e6e44fe1a01a3a528f9442 45248 net optional neutron_2014.1.1-3.debian.tar.xz

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJTyJYnAAoJENQWrRWsa0P+99oP/38kVzYhNJ4+5TeZJ93XXVzI
/AKL+0/YPfVYNi9J1cvye5DQA62ekU386nXC6pSEAkXnHF3RdX1veEnUiPJnnkXm
ZsvtKs2OaWB5HnOgjf8fsk8OVHa5mPt/WiRohCHZ3nIDExgrqo78a6YHXEv/lJj9
kH3ft+tgSp/PdqMzufZ9yMTx140mpFu5Cz8SC8xd9kJWbVCb9kkZ2tnaGRx0aoV5
4wkv7PBX8u7REQBkKePkS2eEyZ5ahA3qZSFoKer0sKsmPFGuK9RFHWf1jnykhC/U
HUdcLfdtOzCnk11epj+ctzTem+lrulIdpatjcDpELznUASKV9d916qksAg1bI39r
EdC85DCpxgbLZZ1OEO3kTOvG6bpRMMA6kXczPKr6pWc0+QkJkX7b+o9ztNae3aP7
6B6eqrLeyVRkU1P6PNiqnxFb+HdX8Dfe/e/030NIFAcN4qfMmWBZfcWei0VD9rRL
0T2LM3wC8ea1aV5Z5JBrJ/QqITlDwTXtSJJPM0amohcxiWBiYc566D5x3WUo7t4y
1z/u4JIpsxbsIgIYq7fctL+6iyNnkMy9ZHKIZthzrL4vIsP7i8wVq0tbgVb6cxiG
uzgp06+JdPI3VDB766iqCHMrevQObxMmEN6U6qw6dCiAkelaMubKImxPDIriowqb
40nIWHZ7JZa17tWLnLLx
=0JfE
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.