GHSA-hvm4-mc7m-22w4

Source

https://github.com/advisories/GHSA-hvm4-mc7m-22w4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-hvm4-mc7m-22w4/GHSA-hvm4-mc7m-22w4.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-hvm4-mc7m-22w4

Aliases

Published

2022-05-24T19:11:58Z

Modified

2024-10-03T21:33:12.369038Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

OpenStack Neutron vulnerable to hardware address impersonation

Details

OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the hardware addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations.

Database specific

{
    "nvd_published_at": "2021-08-23T05:15:00Z",
    "cwe_ids": [
        "CWE-863"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-23T21:31:08Z"
}

References

Affected packages

PyPI / neutron

Package

Name: neutron; View open source insights on deps.dev
Purl: pkg:pypi/neutron

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

16.4.1

Affected versions

0.*

0.0

10.*

10.0.5

10.0.6

10.0.7

11.*

11.0.3

11.0.4

11.0.5

11.0.6

11.0.7

11.0.8

12.*

12.0.0.0b3

12.0.0.0rc1

12.0.0.0rc2

12.0.0

12.0.1

12.0.2

12.0.3

12.0.4

12.0.5

12.0.6

12.1.0

12.1.1

13.*

13.0.0.0b1

13.0.0.0b2

13.0.0.0b3

13.0.0.0rc1

13.0.0.0rc2

13.0.0

13.0.1

13.0.2

13.0.3

13.0.4

13.0.5

13.0.6

13.0.7

14.*

14.0.0.0b1

14.0.0.0b2

14.0.0.0b3

14.0.0.0rc1

14.0.0

14.0.1

14.0.2

14.0.3

14.0.4

14.1.0

14.2.0

14.3.0

14.3.1

14.4.0

14.4.1

14.4.2

15.*

15.0.0.0b1

15.0.0.0rc1

15.0.0.0rc2

15.0.0

15.0.1

15.0.2

15.1.0

15.2.0

15.3.0

15.3.1

15.3.2

15.3.3

15.3.4

16.*

16.0.0.0b1

16.0.0.0rc1

16.0.0.0rc2

16.0.0

16.1.0

16.2.0

16.3.0

16.3.1

16.3.2

16.4.0

PyPI / neutron

Package

Name: neutron; View open source insights on deps.dev
Purl: pkg:pypi/neutron

Affected ranges

Type: ECOSYSTEM
Events: Introduced

17.0.0

Fixed

17.1.3

Affected versions

17.*

17.0.0

17.1.0

17.1.1

17.1.2

PyPI / neutron

Package

Name: neutron; View open source insights on deps.dev
Purl: pkg:pypi/neutron

Affected ranges

Affected versions

18.*

18.0.0