GHSA-w8hx-f868-pvch

Source

https://github.com/advisories/GHSA-w8hx-f868-pvch

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-w8hx-f868-pvch/GHSA-w8hx-f868-pvch.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-w8hx-f868-pvch

Aliases

Published

2022-05-24T19:03:37Z

Modified

2024-09-26T15:10:49.249796Z

Severity

7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H CVSS Calculator
7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Openstack Neutron has Insufficient Verification of IPv6 addresses

Details

A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the IPv6 addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations. Only deployments using the Open vSwitch driver are affected. Source: OpenStack project. Versions before openstack-neutron 15.3.3, openstack-neutron 16.3.1 and openstack-neutron 17.1.1 are affected.

References

Affected packages

PyPI / neutron

Package

Name: neutron; View open source insights on deps.dev
Purl: pkg:pypi/neutron

Affected ranges

Type: ECOSYSTEM
Events: Introduced

16.0.0

Fixed

16.3.1

Affected versions

16.*

16.0.0

16.1.0

16.2.0

16.3.0

PyPI / neutron

Package

Name: neutron; View open source insights on deps.dev
Purl: pkg:pypi/neutron

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

15.3.3

Affected versions

0.*

0.0

10.*

10.0.5

10.0.6

10.0.7

11.*

11.0.3

11.0.4

11.0.5

11.0.6

11.0.7

11.0.8

12.*

12.0.0.0b3

12.0.0.0rc1

12.0.0.0rc2

12.0.0

12.0.1

12.0.2

12.0.3

12.0.4

12.0.5

12.0.6

12.1.0

12.1.1

13.*

13.0.0.0b1

13.0.0.0b2

13.0.0.0b3

13.0.0.0rc1

13.0.0.0rc2

13.0.0

13.0.1

13.0.2

13.0.3

13.0.4

13.0.5

13.0.6

13.0.7

14.*

14.0.0.0b1

14.0.0.0b2

14.0.0.0b3

14.0.0.0rc1

14.0.0

14.0.1

14.0.2

14.0.3

14.0.4

14.1.0

14.2.0

14.3.0

14.3.1

14.4.0

14.4.1

14.4.2

15.*

15.0.0.0b1

15.0.0.0rc1

15.0.0.0rc2

15.0.0

15.0.1

15.0.2

15.1.0

15.2.0

15.3.0

15.3.1

15.3.2

PyPI / neutron

Package

Name: neutron; View open source insights on deps.dev
Purl: pkg:pypi/neutron

Affected ranges

Type: ECOSYSTEM
Events: Introduced

17.0.0

Fixed

17.1.1

Affected versions

17.*

17.0.0

17.1.0