Synopsis

Moderate: openstack-neutron security and bug fix update

Type/Severity

Security Advisory: Moderate

Topic

Updated openstack-neutron packages that fix one security issue are now
available for Red Hat Enterprise Linux OpenStack Platform 6.0

Red Hat Product Security has rated this update as having a Moderate security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.

Description

OpenStack Networking (Neutron) is a pluggable, scalable, and API-driven
system that provisions networking services to virtual machines. Its main
function is to manage connectivity to and from virtual machines.

A Denial of Service flaw was found in the L2 agent when using the IPTables
firewall driver. By submitting an address pair that will be rejected as
invalid by the ipset tool, an attacker may cause the agent to crash.
(CVE-2015-3221)

Red Hat would like to thank the OpenStack upstream for reporting this
issue. Upstream acknowledges Darragh O'Reilly (HP) as the original reporter.

Additionally, the packages address the following issues:

• Neutron failed to load multiple configuration files. The Puppet recipe
  hard-coded the --config-file parameter to a set list of configuration files
  and additional files were not loaded, even if specified. This fix creates a
  new Neutron configuration directory, /etc/neutron/conf.d, and any .conf
  files in that directory are loaded by Puppet and applied to all services.
  (BZ#1188480)
  
• When configuring load balancer as a service, the Neutron configuration
  used no group as the default system user group. This group does not exist
  in the default Red Hat Enterprise Linux 7 configuration, which caused the
  virtual IP address creation to fail with the error "cannot find group id
  for 'nogroup'." (BZ#1208002)
  
• Log rotation was set to one week for Neutron, but that could allow the
  log file to grow to be very large before rotating. The default log rotation
  policy has been updated to include a size limit of 10MB as well as a time
  limit to rotate daily. (BZ#1212442)
  
• Previously, dnsmasq did not save lease information in persistent storage.
  When it was restarted, the lease information was lost. This behavior
  resulted from removing the '--dhcp-script' option as part of fixing
  BZ#1202392. As a result, instances were stuck in the network boot process
  for a long period of time. In addition, NACK messages were noted in the
  dnsmasq log. This update removes the authoritative option, so that NAKs are
  not sent in response to DHCPREQUESTs to other servers. This change is
  expected to prevent dnsmasq from NAKing clients renewing leases issued
  before it was restarted/rescheduled. DHCPNAK messages should no longer be
  found in the log files. (BZ#1227635)
  
• Conflict tags were included in the python-neutron package spec that
  resulted in Neutron unnecessarily blocking the python-oslo-db package.
  These conflicts have been removed from the spec, so the python-oslo-db
  package can be successfully installed. (BZ#1250056)
  

All openstack-neutron users are advised to upgrade to these updated
packages, which contain backported patches to correct these issues.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenStack 6.0 x86_64

Fixes

• BZ - 1208002 - LBASS VIP creation fails because system group "nogroup" doesn't exist
• BZ - 1227635 - DHCPNAK after neutron-dhcp-agent restart
• BZ - 1232284 - CVE-2015-3221 openstack-neutron: L2 agent DoS through incorrect allowed address pairs
• BZ - 1250056 - neutron unnecessarily blocks python-oslo-db >= 1.1.0

CVEs

• CVE-2015-3221

References

• https://access.redhat.com/security/updates/classification/#moderate

Red Hat OpenStack 6.0

SRPM
x86_64
openstack-neutron-2014.2.3-9.el7ost.noarch.rpm	SHA-256: 7341dd21908690131811951a4f261c38b7ad4708f62fb75826b7b15283a9080c
openstack-neutron-bigswitch-2014.2.3-9.el7ost.noarch.rpm	SHA-256: 818b42e17de8b2a687d6d3fa74dc095c891c08d76ba15aa64de244f56c09627f
openstack-neutron-brocade-2014.2.3-9.el7ost.noarch.rpm	SHA-256: 21d2cf97599f18616cfa05c58eff1ea052189e328c7a1dc0fd33d8e3f7788cec
openstack-neutron-cisco-2014.2.3-9.el7ost.noarch.rpm	SHA-256: d352b475d8e61f15ef2431c556a8fd44838d03c40490a7100deba8e41b49d859
openstack-neutron-common-2014.2.3-9.el7ost.noarch.rpm	SHA-256: c510bf9ad7d9b3a6ba55e4fcf171d6969ad3d24fe6a859c9f283896177085f96
openstack-neutron-embrane-2014.2.3-9.el7ost.noarch.rpm	SHA-256: 9e78477e03cfb20f67339a65f32d37ae3ed75eb803dcd83c8d6b58fdc69783ea
openstack-neutron-hyperv-2014.2.3-9.el7ost.noarch.rpm	SHA-256: 4bd77c5743c264a4f17593cc923569d6de9eed73c997982ad468f02bab6db991
openstack-neutron-ibm-2014.2.3-9.el7ost.noarch.rpm	SHA-256: c8122b9dced2c46659bdb3e8b43c0e74fb40a1bde7d7552007c11589374cb152
openstack-neutron-linuxbridge-2014.2.3-9.el7ost.noarch.rpm	SHA-256: ea6e1997968c0c82b5bb2fdea8be82b43fe1cee937afb31c5c8cc7f2668be878
openstack-neutron-mellanox-2014.2.3-9.el7ost.noarch.rpm	SHA-256: 1961b5324df4ee1ea12d97b02c783c268cf1627b5f83598e0f8ee44d2111322e
openstack-neutron-metaplugin-2014.2.3-9.el7ost.noarch.rpm	SHA-256: d640c5dfcb7dd3e88a5ac05ad1661f8b05eb1525a39efde4866a46229ba42380
openstack-neutron-metering-agent-2014.2.3-9.el7ost.noarch.rpm	SHA-256: 9ba0db494938c32be768d6c55a652761b48f2d3b02eaaa58e90742f572e7556e
openstack-neutron-midonet-2014.2.3-9.el7ost.noarch.rpm	SHA-256: 88aac0a7bf10f31a7341726c00e079f4e2e07b7f7b065adf641ae8acf68c3345
openstack-neutron-ml2-2014.2.3-9.el7ost.noarch.rpm	SHA-256: cb9bad32c633b5c864896e08d75670631d5149520407e8806b46446ee714a629
openstack-neutron-nec-2014.2.3-9.el7ost.noarch.rpm	SHA-256: e06fbe49512d4777a279487e31c6593306db800a91abfb4e1c1be562961d3587
openstack-neutron-nuage-2014.2.3-9.el7ost.noarch.rpm	SHA-256: 93cc543ec5c04b5681763fb4088f2ddf81f33d1f2f950cfcfd00982c440c30a8
openstack-neutron-ofagent-2014.2.3-9.el7ost.noarch.rpm	SHA-256: e56845775eb5ee9d7490f742a559ee3fdf2bfee4c4eed6bd6fda327d5291ce87
openstack-neutron-oneconvergence-nvsd-2014.2.3-9.el7ost.noarch.rpm	SHA-256: ac78b2ea8a3e8e55f33c0e1c02c58dcb15a2c906dbe94e2e28d4206032ef851b
openstack-neutron-opencontrail-2014.2.3-9.el7ost.noarch.rpm	SHA-256: 78a5a4f0f67da799cef36117ca87ee169beef04808a0a2adafefbe6c287508bf
openstack-neutron-openvswitch-2014.2.3-9.el7ost.noarch.rpm	SHA-256: 38857125d22f8d89347ce3df5b325ee5676c713e514c816dda1a21af21c1092e
openstack-neutron-plumgrid-2014.2.3-9.el7ost.noarch.rpm	SHA-256: 6ecb81b3b9e1c4f7ef151acf065af093a10ec1d979e14f7889896c616e7b35a1
openstack-neutron-ryu-2014.2.3-9.el7ost.noarch.rpm	SHA-256: ec35f2f71166f7cfda2bc717b5bffe973e8364b946eed1d2aca865c62cb07567
openstack-neutron-sriov-nic-agent-2014.2.3-9.el7ost.noarch.rpm	SHA-256: 765474cfc684e7783b514deea897d927c0533105ac47b511c4039d8d6ce51643
openstack-neutron-vmware-2014.2.3-9.el7ost.noarch.rpm	SHA-256: fcb602cc9d9d939ef12f1855c5e419331982b13475af9d0b8e8a20a519101168
openstack-neutron-vpn-agent-2014.2.3-9.el7ost.noarch.rpm	SHA-256: 8f20d5ddc1bdfc41c928c819cf13c5597b2c74b325f50f9f7856463aea4b6e96
python-neutron-2014.2.3-9.el7ost.noarch.rpm	SHA-256: 52db1d9fc78ab45c13552db8041d8834a9706c2f46337bc76b0df5121b574982