GHSA-w8hx-f868-pvch

    Dashboard / Vulnerabilities / GHSA-w8hx-f868-pvch

    GHSA-w8hx-f868-pvch

    Published: 24 May 2022Last Modified: 26 Sept 2024

    Summary: Openstack Neutron has Insufficient Verification of IPv6 addresses

    Details: A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the IPv6 addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations. Only deployments using the Open vSwitch driver are affected. Source: OpenStack project. Versions before openstack-neutron 15.3.3, openstack-neutron 16.3.1 and openstack-neutron 17.1.1 are affected.

    References: https://nvd.nist.gov/vuln/detail/CVE-2021-20267, https://bugzilla.redhat.com/show_bug.cgi?id=1934330, https://github.com/openstack/neutron, https://github.com/pypa/advisory-database/tree/main/vulns/neutron/PYSEC-2021-136.yaml, https://security.openstack.org/ossa/OSSA-2021-001.html

    Affected packages

    Package

    Name: neutron

    Purl: pkg:pypi/neutron

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 16.0.0
    Fixed -16.3.1

    Affected versions

    16.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-w8hx-f868-pvch | CVE-DB