Medium
Security advisory
An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By setting a destination port in a security group rule along with a protocol that doesn't support that option (for example, VRRP), an authenticated user may block further application of security group rules for instances from any project/tenant on the compute hosts to which it's applied. (Only deployments using the iptables security group driver are affected.)
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-9735
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 07:20 UTC · Revision 1
Source evidence
An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By setting a destination port in a security group rule along with a protocol that doesn't support that option (for example, VRRP), an authenticated user may block further application of security group rules for instances from any project/tenant on the compute hosts to which it's applied. (Only deployments using the iptables security group driver are affected.)
osv:CVE-2019-9735
Complete source record
{
"id": "094527bc2a549c5829eba670f6f107a4d15fb9b8f80255c1c2edc8a5d4eb3a1a",
"url": "https://osv.dev/vulnerability/CVE-2019-9735",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-9735",
"summary": "An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By setting a destination port in a security group rule along with a protocol that doesn't support that option (for example, VRRP), an authenticated user may block further application of security group rules for instances from any project/tenant on the compute hosts to which it's applied. (Only deployments using the iptables security group driver are affected.)",
"evidence": "osv:CVE-2019-9735",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2019-9735",
"aliases": [
"CVE-2019-9735",
"GHSA-9773-3fqg-8w25",
"PYSEC-2019-190"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/openstack/neutron",
"type": "GIT",
"events": [
{
"introduced": "5212c9c563e9470ce9e6abd76bdef22fa652a9b3"
},
{
"fixed": "7ba0d8fb49ad2f86683172ed6fc06fdb44b473a6"
},
{
"introduced": "fb3f71806174bc2fae7e421268aeee61be36412d"
},
{
"fixed": "871b86390a024f19876cda06f2775d6785400878"
},
{
"introduced": "b6314ea6c3df11c6b27cd39844c53b65be0d9060"
},
{
"fixed": "31a48bea869f3b7fafcf8ec2fae683456885c3cf"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:openstack:neutron:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0.0"
},
{
"fixed": "11.0.7"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:openstack:neutron:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "12.0.0"
},
{
"fixed": "12.0.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:openstack:neutron:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "13.0.0"
},
{
"fixed": "13.0.3"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"13.0.2",
"11.0.6",
"12.0.5",
"13.0.1",
"12.0.4",
"13.0.0.0rc2",
"13.0.0",
"12.0.3",
"11.0.5",
"11.0.4",
"12.0.2",
"12.0.1",
"11.0.3",
"12.0.0.0rc2",
"12.0.0",
"11.0.2",
"11.0.1",
"11.0.0.0rc3",
"11.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-9735.json"
}
}
],
"modified": "2026-10-24T10:30:51.933682079Z",
"provider": "osv",
"references": [
"https://usn.ubuntu.com/4036-1/",
"https://access.redhat.com/errata/RHSA-2019:0879",
"https://access.redhat.com/errata/RHSA-2019:0916",
"https://access.redhat.com/errata/RHSA-2019:0935",
"https://seclists.org/bugtraq/2019/Mar/24",
"https://www.debian.org/security/2019/dsa-4409",
"https://launchpad.net/bugs/1818385",
"https://security.openstack.org/ossa/OSSA-2019-001.html"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:openstack:neutron:*:*:*:*:*:*:*:*"
],
"vendor_product": "openstack:neutron",
"extracted_events": [
{
"range": [
{
"fixed": "10.0.8"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*",
"cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*",
"cpe:2.3:a:redhat:openstack:14:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:openstack",
"extracted_events": [
{
"range": [
{
"introduced": "10"
},
{
"last_affected": "10"
},
{
"introduced": "13"
},
{
"last_affected": "13"
},
{
"introduced": "14"
},
{
"last_affected": "14"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2019-9735",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 437588,
"published_at": "2019-03-13T02:29:00.277+00:00"
}