Key Information Summary Vulnerability Overview Vulnerability Title: Neutron agent internal ports not tagged for a period, causing them to become trunk ports Vulnerability ID: #1767422 Reporter: Miguel Angel Ajo Report Date: 2018-04-27 Impact Scope Affected Component: neutron Severity: High Assigned To: Jakub Libosvar Milestone: neutron rocky-1 Vulnerability Description Issue: Neutron agent ports, when added to br-int, are not tagged, causing them to become trunk ports and receive traffic from all VLANs until processed by neutron-openvswitch-agent. In some cases, ports remain untagged indefinitely, leading to various issues, such as ha-router ports directly receiving traffic from external networks. Relevance: Linked to security issue (https://bugs.launchpad.net/bugs/174320). Resolution Fix Status: Fix Released Fix Details: - Multiple fix proposals were submitted and merged into different branches (master, stable/queens, stable/pike, stable/ocata) - Key fix commits: - Commit for master branch - Commit for stable/queens branch Additional Information Related Bug: #1558336 Released Versions: Fixed in openstack/neutron 13.0.0.0b2, 11.0.6, 12.0.3, and other versions. Tags: in-stable-ocata, in-stable-pike, in-stable-queens, neutron-proactive-backport-potential