CVE-2021-20267
Openstack Neutron has Insufficient Verification of IPv6 addresses
A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the IPv6 addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations. Only deployments using the Open vSwitch driver are affected. Source: OpenStack project. Versions before openstack-neutron 15.3.3, openstack-neutron 16.3.1 and openstack-neutron 17.1.1 are affected.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the IPv6 addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations. Only deployments using the Open vSwitch driver are affected. Source: OpenStack project. Versions before openstack-neutron 15.3.3, openstack-neutron 16.3.1 and openstack-neutron 17.1.1 are affected.
- Record
CVE-2021-20267- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H - CVSS 2.0
- 5.5 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:P - Weakness
- CWE-345
- Updated
- 2026-11-02
CVE List No score
A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the IPv6 addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations. Only deployments using the Open vSwitch driver are affected. Source: OpenStack project. Versions before openstack-neutron 15.3.3, openstack-neutron 16.3.1 and openstack-neutron 17.1.1 are affected.
- Record
CVE-2021-20267- Weakness
- CWE-345
- Updated
- 2026-11-02
EUVDEUVD-2021-0142 No score
A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the IPv6 addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations. Only deployments using the Open vSwitch driver are affected. Source: OpenStack project. Versions before openstack-neutron 15.3.3, openstack-neutron 16.3.1 and openstack-neutron 17.1.1 are affected.
- Record
EUVD-2021-0142- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w8hx-f868-pvch
Openstack Neutron has Insufficient Verification of IPv6 addresses
A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the IPv6 addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations. Only deployments using the Open vSwitch driver are affected. Source: OpenStack project. Versions before openstack-neutron 15.3.3, openstack-neutron 16.3.1 and openstack-neutron 17.1.1 are affected.
- Record
GHSA-w8hx-f868-pvch- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H - Weakness
- CWE-345
- Updated
- 2026-11-02
OSV
A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the IPv6 addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations. Only deployments using the Open vSwitch driver are affected. Source: OpenStack project. Versions before openstack-neutron 15.3.3, openstack-neutron 16.3.1 and openstack-neutron 17.1.1 are affected.
- Record
CVE-2021-20267- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-20267
A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the IPv6 addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations. Only deployments using the Open vSwitch driver are affected. Source: OpenStack project. Versions before openstack-neutron 15.3.3, openstack-neutron 16.3.1 and openstack-neutron 17.1.1 are affected.
- Record
DEBIAN-CVE-2021-20267- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-w8hx-f868-pvch
Openstack Neutron has Insufficient Verification of IPv6 addresses
A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the IPv6 addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations. Only deployments using the Open vSwitch driver are affected. Source: OpenStack project. Versions before openstack-neutron 15.3.3, openstack-neutron 16.3.1 and openstack-neutron 17.1.1 are affected.
- Record
GHSA-w8hx-f868-pvch- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H - Weakness
- CWE-345
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-20267
A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the IPv6 addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations. Only deployments using the Open vSwitch driver are affected. Source: OpenStack project. Versions before openstack-neutron 15.3.3, openstack-neutron 16.3.1 and openstack-neutron 17.1.1 are affected.
- Record
UBUNTU-CVE-2021-20267- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
OSVPYSEC-2021-136 No score
A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the IPv6 addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations. Only deployments using the Open vSwitch driver are affected. Source: OpenStack project. Versions before openstack-neutron 15.3.3, openstack-neutron 16.3.1 and openstack-neutron 17.1.1 are affected.
- Record
PYSEC-2021-136- Updated
- 2026-11-02
OSVUSN-6067-1 No score
neutron vulnerabilities
David Sinquin discovered that OpenStack Neutron incorrectly handled the default Open vSwitch firewall rules. An attacker could possibly use this issue to impersonate the IPv6 addresses of other systems on the network. This issue only affected Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-20267)
Jake Yip and Justin Mammarella discovered that OpenStack Neutron incorrectly handled the linuxbridge driver when ebtables-nft is being used. An attacker could possibly use this issue to impersonate the hardware addresss of other systems on the network. This issue only affected Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-38598)
Pavel Toporkov discovered that OpenStack Neutron incorrectly handled extra_dhcp_opts values. An attacker could possibly use this issue to reconfigure dnsmasq. This issue only affected Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-40085)
Slawek Kaplonski discovered that OpenStack Neutron incorrectly handled the routes middleware. An attacker could possibly use this issue to cause the API worker to consume memory, leading to a denial of service. This issue only affected Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-40797)
It was discovered that OpenStack Neutron incorrectly handled certain queries. A remote authenticated user could possibly use this issue to cause resource consumption, leading to a denial of service. (CVE-2022-3277)
- Record
USN-6067-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
neutronPyPI |
16.0.0 up to 16.3.1 | 16.3.1 |
neutronPyPI |
before 15.3.3 | 15.3.3 |
neutronPyPI |
17.0.0 up to 17.1.1 | 17.1.1 |
neutronDebian:12 |
before 2:17.1.1-5 | 2:17.1.1-5 |
neutronDebian:13 |
before 2:17.1.1-5 | 2:17.1.1-5 |
neutronDebian:14 |
before 2:17.1.1-5 | 2:17.1.1-5 |
neutronPyPI |
16.0.0 up to 16.3.1, plus listed versions 16.1.016.2.016.3.0 |
16.3.1 |
neutronPyPI |
before 15.3.3, plus listed versions 0.010.0.510.0.610.0.711.0.3 Show 45 moreShow less11.0.411.0.511.0.611.0.711.0.812.0.012.0.0.0b312.0.0.0rc112.0.0.0rc212.0.112.0.212.0.312.0.412.0.512.0.612.1.012.1.113.0.013.0.0.0b113.0.0.0b213.0.0.0b313.0.0.0rc113.0.0.0rc213.0.113.0.213.0.313.0.413.0.513.0.613.0.714.0.014.0.0.0b114.0.0.0b214.0.0.0b314.0.0.0rc114.0.114.0.214.0.314.0.414.1.014.2.014.3.014.3.114.4.014.4.1 |
15.3.3 |
neutronPyPI |
17.0.0 up to 17.1.1, plus listed versions 17.1.0 |
17.1.1 |
neutronPyPI |
before 15.3.3, 16.0.0 up to 16.3.1, 17.0.0 up to 17.1.1, plus listed versions 0.010.0.510.0.610.0.711.0.3 Show 45 moreShow less11.0.411.0.511.0.611.0.711.0.812.0.012.0.0.0b312.0.0.0rc112.0.0.0rc212.0.112.0.212.0.312.0.412.0.512.0.612.1.012.1.113.0.013.0.0.0b113.0.0.0b213.0.0.0b313.0.0.0rc113.0.0.0rc213.0.113.0.213.0.313.0.413.0.513.0.613.0.714.0.014.0.0.0b114.0.0.0b214.0.0.0b314.0.0.0rc114.0.114.0.214.0.314.0.414.1.014.2.014.3.014.3.114.4.014.4.1 |
15.3.316.3.117.1.1 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
neutronUbuntu:16.04:LTS |
All versions, plus listed versions 2:7.0.0-0ubuntu12:8.0.0~b1-0ubuntu22:8.0.0~b2-0ubuntu42:8.0.0~b2-0ubuntu52:8.0.0~b2-0ubuntu7 Show 20 moreShow less2:8.0.0~b3-0ubuntu12:8.0.0~rc1-0ubuntu12:8.0.0-0ubuntu12:8.1.0-0ubuntu0.16.04.22:8.1.2-0ubuntu12:8.2.0-0ubuntu12:8.3.0-0ubuntu12:8.3.0-0ubuntu1.12:8.3.0-0ubuntu1.22:8.4.0-0ubuntu12:8.4.0-0ubuntu22:8.4.0-0ubuntu32:8.4.0-0ubuntu42:8.4.0-0ubuntu52:8.4.0-0ubuntu62:8.4.0-0ubuntu7.12:8.4.0-0ubuntu7.22:8.4.0-0ubuntu7.32:8.4.0-0ubuntu7.42:8.4.0-0ubuntu7.5 |
None known |
neutronUbuntu:18.04:LTS |
before 2:12.1.1-0ubuntu8.1, plus listed versions 2:11.0.1-0ubuntu12:12.0.0~b1-0ubuntu12:12.0.0~b1-0ubuntu22:12.0.0~b2-0ubuntu12:12.0.0~b3-0ubuntu1 Show 26 moreShow less2:12.0.0~rc1-0ubuntu12:12.0.0~rc2-0ubuntu12:12.0.0-0ubuntu12:12.0.0-0ubuntu1.12:12.0.0-0ubuntu1.22:12.0.0-0ubuntu1.32:12.0.0-0ubuntu1.42:12.0.0-0ubuntu22:12.0.0-0ubuntu32:12.0.1-0ubuntu12:12.0.1-0ubuntu1.12:12.0.2-0ubuntu12:12.0.3-0ubuntu12:12.0.5-0ubuntu12:12.0.5-0ubuntu42:12.0.5-0ubuntu52:12.0.6-0ubuntu12:12.0.6-0ubuntu22:12.0.6-0ubuntu32:12.1.0-0ubuntu12:12.1.1-0ubuntu12:12.1.1-0ubuntu22:12.1.1-0ubuntu32:12.1.1-0ubuntu42:12.1.1-0ubuntu72:12.1.1-0ubuntu8 |
2:12.1.1-0ubuntu8.1 |
neutronUbuntu:20.04:LTS |
before 2:16.4.2-0ubuntu6.2, plus listed versions 2:15.0.0-0ubuntu12:16.0.0~b1~git2019121613.3e8abb9a8f-0ubuntu12:16.0.0~b2~git2020020712.d5b33ffc77-0ubuntu12:16.0.0~b2~git2020020712.d5b33ffc77-0ubuntu32:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu1 Show 28 moreShow less2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu22:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu32:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu42:16.0.0~b3~git2020041013.e74c8f8c88-0ubuntu12:16.0.0~b3~git2020041516.5f42488a9a-0ubuntu12:16.0.0~b3~git2020041516.5f42488a9a-0ubuntu22:16.0.0-0ubuntu0.20.04.12:16.0.0-0ubuntu0.20.04.22:16.1.0-0ubuntu12:16.1.0-0ubuntu22:16.2.0-0ubuntu12:16.2.0-0ubuntu22:16.2.0-0ubuntu32:16.3.0-0ubuntu32:16.3.1-0ubuntu12:16.3.1-0ubuntu1.12:16.3.2-0ubuntu22:16.3.2-0ubuntu32:16.4.0-0ubuntu22:16.4.0-0ubuntu32:16.4.1-0ubuntu22:16.4.2-0ubuntu12:16.4.2-0ubuntu22:16.4.2-0ubuntu32:16.4.2-0ubuntu42:16.4.2-0ubuntu52:16.4.2-0ubuntu62:16.4.2-0ubuntu6.1 |
2:16.4.2-0ubuntu6.2 |
neutronUbuntu:22.04:LTS |
before 2:20.3.0-0ubuntu1.1, plus listed versions 2:19.0.0-0ubuntu12:19.1.0+git2022030313.b072cbf05f-0ubuntu12:20.0.0-0ubuntu12:20.0.0-0ubuntu22:20.0.0-0ubuntu32:20.1.0-0ubuntu22:20.2.0-0ubuntu12:20.3.0-0ubuntu1 |
2:20.3.0-0ubuntu1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-20267 is a high vulnerability (CVSS 7.1) in Openstack Neutron, published May 28, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.02%, the 63rd percentile. Fixed in neutron 16.3.1.
References
bugzilla.redhat.com/show_bug.cgi?id=1934330
security.openstack.org/ossa/OSSA-2021-001.html
nvd.nist.gov/vuln/detail/CVE-2021-20267
github.com/pypa/advisory-database/tree/main/vulns/neutron/PYSEC-2021-136.yaml
security-tracker.debian.org/tracker/CVE-2021-20267
Show 9 moreShow less
ubuntu.com/security/CVE-2021-20267
review.opendev.org/c/openstack/neutron/+/776599
cve.org/CVERecord?id=CVE-2021-20267
Left out here: 28 versions. The JSON record has them.