CVE-2021-20267: OpenStack Neutron Open vSwitch Firewall Rules Impersonation Vulnerability
Summary
CVE-2021-20267: A flaw was found in openstack-neutron's default Open vSwitch firewall rules. Affects neutron across 3 version ranges.
< 15.3.3
>= 16.0.0, < 16.3.1
>= 17.0.0, < 17.1.1
Fixed in 15.3.3, 16.3.1 or 17.1.1, depending on the release line you run. How to fix ↓
Also tracked for
- neutron · Debian:11
The same CVE-2021-20267 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Neutron is an open-source networking service that provides connectivity between different components and services in an OpenStack cloud environment. It includes a plugin architecture that allows for the integration of different networking technologies. One of the supported plugins is the Open vSwitch driver, which enables the use of Open vSwitch as the virtual switch for network traffic. The Open vSwitch firewall rules in openstack-neutron control the traffic flow between instances connected to the virtual switch.
Vulnerability Detail
A flaw has been discovered in the default Open vSwitch firewall rules of openstack-neutron. This vulnerability allows an attacker who has control over a server instance connected to the virtual switch to impersonate IPv6 addresses of other systems on the network. By sending specially crafted packets, the attacker can cause denial of service or intercept traffic intended for other destinations. It is important to note that only deployments using the Open vSwitch driver are affected. The vulnerability has been assigned CVE-2021-20267.
How To Fix
Latest published version: 29.0.0 as of 22 Oct 2026
pip install --upgrade "neutron==29.0.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 15.3.315.3.3pip install --upgrade "neutron==15.3.3" -
>= 16.0.0, < 16.3.116.3.1pip install --upgrade "neutron==16.3.1" -
>= 17.0.0, < 17.1.117.1.1pip install --upgrade "neutron==17.1.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the OpenStack Neutron Open vSwitch Firewall Rules Impersonation Vulnerability (CVE-2021-20267) affects versions of openstack-neutron before 15.3.3, 16.3.1, and 17.1.1. It allows an attacker to impersonate IPv6 addresses and potentially disrupt network traffic or intercept sensitive information. It is crucial to upgrade to the fixed versions to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for neutron →
FAQ
Versions before openstack-neutron 15.3.3, openstack-neutron 16.3.1, and openstack-neutron 17.1.1 are affected.
The vulnerability allows an attacker to impersonate IPv6 addresses of other systems on the network, leading to denial of service or interception of traffic intended for other destinations.
Yes, only deployments using the Open vSwitch driver are affected by this vulnerability.
Yes, this vulnerability has been assigned CVE-2021-20267.
The recommended mitigation is to upgrade to a fixed version of openstack-neutron.
References
Related vulnerabilities
Recent vulnerabilities recorded for neutron.
