SB2021052812 - MitM attack in OpenStack Neutron
Published: May 28, 2021 Updated: May 12, 2023
Security Bulletin ID
SB2021052812
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Adjecent network
Highest impact
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Insufficient verification of data authenticity (CVE-ID: CVE-2021-20267)
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to insufficient verification of data authenticity when processing IPv6 packets in openstack-neutron's default Open vSwitch firewall rules. A remote attacker in control of a server instance connected to the virtual switch can
impersonate the IPv6 addresses of other systems on the network and intercept traffic or perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.