Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2021-38598

Good to know:

icon
icon

Date: August 23, 2021

OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the hardware addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations.

Language: Python

Severity Score

Related Resources (7)

https://security-tracker.debian.org/tracker/CVE-2021-38598
https://seclists.org/oss-sec/2021/q3/107
https://github.com/openstack/neutron/commit/fafa5dacd5057120562184a734e7345e7c0e9639
https://nvd.nist.gov/vuln/detail/CVE-2021-38598
https://people.canonical.com/~ubuntu-security/cve/CVE-2021-38598
https://launchpad.net/bugs/1938670
https://www.mend.io/vulnerability-database/CVE-2021-38598

Severity Score

Weakness Type (CWE)

Authentication Bypass by Spoofing

CWE-290

Incorrect Authorization

CWE-863

Top Fix

icon

Upgrade Version

Upgrade to version neutron - 18.1.0

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): HIGH
Availability (A): HIGH

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): MEDIUM
Authentication (AU): NONE
Confidentiality (C): NONE
Integrity (I): PARTIAL
Availability (A): PARTIAL
Additional information:

Do you need more information?

Contact Us