A OpenStack Neutron security update has been released for Ubuntu Linux 18.04 LTS, 20.04 LTS, and 22.04 LTS.

USN-6067-1: OpenStack Neutron vulnerabilities

==========================================================================
Ubuntu Security Notice USN-6067-1
May 10, 2023

neutron vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS

Summary:

Several security issues were fixed in OpenStack Neutron.

Software Description:
- neutron: OpenStack Virtual Network Service

Details:

David Sinquin discovered that OpenStack Neutron incorrectly handled the
default Open vSwitch firewall rules. An attacker could possibly use this
issue to impersonate the IPv6 addresses of other systems on the network.
This issue only affected Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2021-20267)

Jake Yip and Justin Mammarella discovered that OpenStack Neutron
incorrectly handled the linuxbridge driver when ebtables-nft is being
used. An attacker could possibly use this issue to impersonate the hardware
addresss of other systems on the network. This issue only affected Ubuntu
18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-38598)

Pavel Toporkov discovered that OpenStack Neutron incorrectly handled
extra_dhcp_opts values. An attacker could possibly use this issue to
reconfigure dnsmasq. This issue only affected Ubuntu 18.04 LTS, and Ubuntu
20.04 LTS. (CVE-2021-40085)

Slawek Kaplonski discovered that OpenStack Neutron incorrectly handled the
routes middleware. An attacker could possibly use this issue to cause the
API worker to consume memory, leading to a denial of service. This issue
only affected Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-40797)

It was discovered that OpenStack Neutron incorrectly handled certain
queries. A remote authenticated user could possibly use this issue to cause
resource consumption, leading to a denial of service. (CVE-2022-3277)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS:
python3-neutron 2:20.3.0-0ubuntu1.1

Ubuntu 20.04 LTS:
python3-neutron 2:16.4.2-0ubuntu6.2

Ubuntu 18.04 LTS:
python-neutron 2:12.1.1-0ubuntu8.1

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6067-1
CVE-2021-20267, CVE-2021-38598, CVE-2021-40085, CVE-2021-40797,
CVE-2022-3277

Package Information:
https://launchpad.net/ubuntu/+source/neutron/2:20.3.0-0ubuntu1.1
https://launchpad.net/ubuntu/+source/neutron/2:16.4.2-0ubuntu6.2
https://launchpad.net/ubuntu/+source/neutron/2:12.1.1-0ubuntu8.1