** Changed in: ossa Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to neutron. https://bugs.launchpad.net/bugs/1336207
Title: [OSSA 2014-025] There is no quota for allowed address pair (CVE-2014-3555) Status in OpenStack Neutron (virtual network service): Fix Committed Status in neutron havana series: Fix Committed Status in neutron icehouse series: Fix Committed Status in OpenStack Security Advisories: Fix Released Bug description: Hi all, There is no quota for allowed address pair, user can create unlimited allowed address pair, in the backend, there will be at least 1 iptables rule for one allowed address pair. I tested if we use the attachment script to add about 10,000 allowed address pair. It will cost 30 sec to reflesh iptables rules in kernel... I think that bad man can use this api to attack compute nodes. This will make the compute nodes crash or very slow only if we add enough allowed address pair rules... Thanks. Liping Mao To manage notifications about this bug go to: https://bugs.launchpad.net/neutron/+bug/1336207/+subscriptions -- Mailing list: https://launchpad.net/~yahoo-eng-team Post to : yahoo-eng-team@lists.launchpad.net Unsubscribe : https://launchpad.net/~yahoo-eng-team More help : https://help.launchpad.net/ListHelp