Published: 23/08/2021 Updated: 08/08/2023

CVSS v2 Base Score: 5.8 | Impact Score: 4.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 9.1 | Impact Score: 5.2 | Exploitability Score: 3.9

VMScore: 516

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:P

OpenStack Neutron prior to 16.4.1, 17.x prior to 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the hardware addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations.

Vulnerable Product	Search on Vulmon	Subscribe to Product
openstack neutron 18.0.0
openstack neutron

Pavel Toporkov discovered a vulnerability in Neutron, the OpenStack virtual network service, which allowed a reconfiguration of dnsmasq via crafted dhcp_extra_opts parameters For the oldstable distribution (buster), this problem has been fixed in version 2:1307+git20210927bace3d1890-0+deb10u1 This update also fixes CVE-2021-20267 For the s ...

No description is available for this CVE ...

On Tuesday 2021-08-17 17:17, Jeremy Stanley wrote: ip_tables is running atop the netfilter API, so it's not an ordered set with predecessors and successors ...

On 2021-08-17 19:30:21 +0200 (+0200), Jan Engelhardt wrote: Yes, thanks It would have been more accurate to draw the comparison between ebtables and ebtables-nft, which is where the underlying problem arises I was trying not to get too into the weeds with technical detail for the general user audience, who may not be particularly aware of the n ...

=================================================================== OSSA-2021-004: Linuxbridge ARP filter bypass on Netfilter platforms =================================================================== :Date: August 17, 2021 :CVE: CVE-2021-38598 Affects ~~~~~~~ - Neutron: <1641, >=1700 <1713, ==1800 Description ~~~~~~~~~~~ J ...

CWE-290 https://launchpad.net/bugs/1938670 https://nvd.nist.gov https://www.debian.org/security/2021/dsa-4983

CVE-2021-38598

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Mailing Lists

References

Vulmon Search

About

Products

Connect