Candidate: CVE-2021-20267
PublicDate: 2021-05-28 19:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20267
 https://review.opendev.org/c/openstack/neutron/+/776599
Description:
 A flaw was found in openstack-neutron's default Open vSwitch firewall
 rules. By sending carefully crafted packets, anyone in control of a server
 instance connected to the virtual switch can impersonate the IPv6 addresses
 of other systems on the network, resulting in denial of service or in some
 cases possibly interception of traffic intended for other destinations.
 Only deployments using the Open vSwitch driver are affected. Source:
 OpenStack project. Versions before openstack-neutron 15.3.3,
 openstack-neutron 16.3.1 and openstack-neutron 17.1.1 are affected.
Ubuntu-Description:
Notes:
 mdeslaur> per upstream Affects: <15.3.3, >=16.0.0 <16.3.1, >=17.0.0 <17.1.1
 mdeslaur> as of 2021-05-13, patch has been flagged as possibly incomplete
 mdeslaur> see comment #17 in upstream bug.
 mdeslaur> addditional patch: https://review.opendev.org/c/openstack/neutron/+/783743
 mdeslaur>
 mdeslaur> This issue is fixed in (2:16.4.0-0ubuntu2) in focal-updates and
 mdeslaur> (2:18.1.0-0ubuntu2) in hirsute-updates, but they have not yet
 mdeslaur> been released to -security.
Mitigation:
Bugs:
 https://bugs.launchpad.net/neutron/+bug/1902917
Priority: medium
Discovered-by: David Sinquin
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H [7.1 HIGH]


Patches_neutron:
upstream_neutron: released (15.3.3,16.3.1,17.1.1)
precise/esm_neutron: DNE
trusty_neutron: ignored (out of standard support)
trusty/esm_neutron: DNE
xenial_neutron: ignored (end of standard support, was deferred [2021-05-13])
esm-infra/xenial_neutron: needed
bionic_neutron: needed
focal_neutron: needed
groovy_neutron: ignored (reached end-of-life)
hirsute_neutron: ignored (reached end-of-life)
impish_neutron: not-affected (2:18.1.0+git2021072117.147830620f-0ubuntu2)
jammy_neutron: not-affected (2:18.1.0+git2021072117.147830620f-0ubuntu2)
devel_neutron: not-affected (2:18.1.0+git2021072117.147830620f-0ubuntu2)