CVE-2019-9735

An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By setting a destination port in a security group rule along with a protocol that doesn't support that option (for example, VRRP), an authenticated user may block further application of security group rules for instances from any project/tenant on the compute hosts to which it's applied. (Only deployments using the iptables security group driver are affected.)

• CWE-755

• http://www.openwall.com/lists/oss-security/2019/03/18/2Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/107390Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2019:0879Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:0916Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:0935Third Party Advisory
• https://launchpad.net/bugs/1818385Exploit, Issue Tracking, Patch, Third Party Advisory
• https://seclists.org/bugtraq/2019/Mar/24Mailing List, Third Party Advisory
• https://security.openstack.org/ossa/OSSA-2019-001.htmlPatch, Vendor Advisory
• https://usn.ubuntu.com/4036-1/
• https://www.debian.org/security/2019/dsa-4409Third Party Advisory
• http://www.openwall.com/lists/oss-security/2019/03/18/2Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/107390Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2019:0879Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:0916Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:0935Third Party Advisory
• https://launchpad.net/bugs/1818385Exploit, Issue Tracking, Patch, Third Party Advisory
• https://seclists.org/bugtraq/2019/Mar/24Mailing List, Third Party Advisory
• https://security.openstack.org/ossa/OSSA-2019-001.htmlPatch, Vendor Advisory
• https://usn.ubuntu.com/4036-1/
• https://www.debian.org/security/2019/dsa-4409Third Party Advisory

Published

Mar 13, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-9727Unauthenticated password hash disclosure in the User.getUser…
• CVE-2019-9729In Shanda MapleStory Online V160, the SdoKeyCrypt.sys driver…
• CVE-2019-9730Incorrect access control in the CxUtilSvc component of the S…
• CVE-2019-9732An issue was discovered in GitLab Community and Enterprise E…
• CVE-2019-9733An issue was discovered in JFrog Artifactory 6.7.3. By defau…
• CVE-2019-9734Aquarius CMS through 4.3.5 writes POST and GET parameters (i…
• CVE-2019-9736DOM-based XSS exists in 1024Tools Markdown 1.0 via vectors i…
• CVE-2019-9737Editor.md 1.5.0 has DOM-based XSS via vectors involving the …6.1
• CVE-2019-9738jimmykuu Gopher 2.0 has DOM-based XSS via vectors involving …
• CVE-2019-9740An issue was discovered in urllib2 in Python 2.x through 2.7…6.1
• CVE-2019-9741An issue was discovered in net/http in Go 1.11.5. CRLF injec…6.1
• CVE-2019-9742gdwfpcd.sys in G Data Total Security before 2019-02-22 allow…