** Changed in: ossa
Status: Fix Committed => Fix Released
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1336207
Title:
[OSSA 2014-025] There is no quota for allowed address pair
(CVE-2014-3555)
Status in OpenStack Neutron (virtual network service):
Fix Committed
Status in neutron havana series:
Fix Committed
Status in neutron icehouse series:
Fix Committed
Status in OpenStack Security Advisories:
Fix Released
Bug description:
Hi all,
There is no quota for allowed address pair, user can create unlimited
allowed address pair, in the backend, there will be at least 1
iptables rule for one allowed address pair. I tested if we use the
attachment script to add about 10,000 allowed address pair. It will
cost 30 sec to reflesh iptables rules in kernel... I think that bad
man can use this api to attack compute nodes. This will make the
compute nodes crash or very slow only if we add enough allowed address
pair rules...
Thanks.
Liping Mao
To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1336207/+subscriptions
--
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help : https://help.launchpad.net/ListHelp
