CVE-2019-10876: openstack neutron
Vulnerability summary
CVE-2019-10876 is a medium (CVSS 6.5) vulnerability in openstack neutron. EPSS estimates a 1.73% chance of exploitation in the next 30 days, higher than 77.5% of scored vulnerabilities.
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 4 · Related 2Timeline
- 05-04-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated user may prevent Neutron from being able to configure networks on any compute nodes where those security groups are present, because of an Open vSwitch (OVS) firewall KeyError. All Neutron deployments utilizing neutron-openvswitch-agent are affected.
CVSS metrics
6 scores · 4 sources · 3 versions- OSV · PypiEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
1.73%
Chance of exploitation in the next 30 days
Percentile
78%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.73% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian1 product
- neutron< 2:13.0.2-15
Openstack1 product
- neutron≥ 11.0.0, < 11.0.7 | ≥ 12.0.0, < 12.0.6 | ≥ 13.0.0, < 13.0.3
PyPI1 product
- neutron≥ 11.0.0, < 11.0.7 | ≥ 12.0.0, < 12.0.6 | ≥ 13.0.0, < 13.0.3
Redhat1 product
- openstack13 | 14
Ubuntu1 product
- neutron< 2:12.0.5-0ubuntu4
5 vendors · 5 products
References
13 links- www.openwall.com/lists/oss-security/2019/04/09/2Mailing ListX Refsource MLISTThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2019:0935Vendor AdvisoryX Refsource REDHATThird Party AdvisoryWEBAdvisory
- access.redhat.com/errata/RHSA-2019:0879Vendor AdvisoryX Refsource REDHATThird Party AdvisoryWEBAdvisory
- github.com/openstack/neutronPACKAGE
