CVE-2021-38598

Description

OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the hardware addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations.

Risk Information

Base Score

9.1

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

EPSS Score

Exploitation Probability

0.036

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2021-38598,CVE-2021-40085,CVE-2021-40797 are fixed in Python-neutron 16.4.1	Windows
Vulnerabilities CVE-2021-38598 are fixed in Python-neutron 17.1.3	Windows
Vulnerabilities CVE-2021-38598 are affected in Python-neutron 18.0.0	Windows
OpenStack Virtual Network Service (USN-6067-1) python-neutron_12.1.1-0ubuntu8.1_all.deb	Linux
OpenStack Virtual Network Service (USN-6067-1) python3-neutron_16.4.2-0ubuntu6.2_all.deb	Linux
OpenStack Virtual Network Service (USN-6067-1) python3-neutron_20.3.0-0ubuntu1.1_all.deb	Linux
Vulnerabilities CVE-2021-38598,CVE-2021-40085,CVE-2021-40797 are fixed in Python-neutron for linux 16.4.1	Linux
Vulnerabilities CVE-2021-38598 are fixed in Python-neutron for linux 17.1.3	Linux
Vulnerabilities CVE-2021-38598 are affected in Python-neutron for linux 18.0.0	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234