PT-2020-6428 · Openstack+3 · Openstack Neutron+3

David Sinquin · Published 2020-11-04 · Updated 2024-08-07 · CVE-2021-20267

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions openstack-neutron versions prior to 15.3.3 openstack-neutron versions prior to 16.3.1 openstack-neutron versions prior to 17.1.1

Description A flaw was found in openstack-neutron's default Open vSwitch firewall rules, related to insufficient authentication of data. This issue can be exploited by sending carefully crafted packets, allowing an attacker to impersonate the IPv6 addresses of other systems on the network. This can result in denial of service or possibly interception of traffic intended for other destinations. The issue affects deployments using the Open vSwitch driver.

Recommendations For versions prior to 15.3.3, update to version 15.3.3 or later. For versions prior to 16.3.1, update to version 16.3.1 or later. For versions prior to 17.1.1, update to version 17.1.1 or later.

Fix

DoS

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

ALT-PU-2024-10658

ALT-PU-2024-1575

BDU:2021-04649

CVE-2021-20267

DSA-4983-1

GHSA-W8HX-F868-PVCH

PYSEC-2021-136

USN-6067-1

Affected Products

Alt Linux

Linuxmint

Ubuntu

Openstack Neutron

References · 26

• https://ubuntu.com/security/CVE-2022-3277 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04649 · Security Note
• https://ubuntu.com/security/CVE-2021-40797 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-20267 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-136 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20267 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-20267 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6067-1 · Vendor Advisory
• https://security.openstack.org/ossa/OSSA-2021-001.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1934330 · Patch
• https://ubuntu.com/security/CVE-2021-20267 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-38598 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-20267 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-20267 · Security Note
• https://ubuntu.com/security/notices/USN-6067-1 · Vendor Advisory