Vulnerability in OpenStack Neutron
CVE-2021-20267
A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the IPv6 addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations. Only deployments using the Open vSwitch driver are affected. Source: OpenStack project. Versions before openstack-neutron 15.3.3, openstack-neutron 16.3.1 and openstack-neutron 17.1.1 are affected.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H.
EPSS exploit prediction
EPSS: 0.010 (63.5th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 64th percentile — 63.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: 0.000
Affected products
- OpenStack Neutron — versions 18.0.0
- Red Hat OpenStack Platform — versions 10.0, 13.0, 16.1
- Openstack-Neutron — versions openstack-neutron 15.3.3, openstack-neutron 16.3.1, openstack-neutron 17.1.1
Weakness classification (CWE)
References
- bugzilla.redhat.com/show_bug.cgi (Patch, Third Party Advisory, Issue Tracking)
- security.openstack.org/ossa/OSSA-2021-001.html (Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2021-20267?
- CVE-2021-20267 is a high-severity vulnerability in OpenStack Neutron, classified under Insufficient Verification of Data Authenticity. CVSS score: 7.1/10. Published 2021-05-28.
- How severe is CVE-2021-20267?
- High severity. CVSS v3 base score is 7.1 out of 10.