The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6067-1 advisory.

    David Sinquin discovered that OpenStack Neutron incorrectly handled the default Open vSwitch firewall     rules. An attacker could possibly use this issue to impersonate the IPv6 addresses of other systems on the     network. This issue only affected Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-20267)

    Jake Yip and Justin Mammarella discovered that OpenStack Neutron incorrectly handled the linuxbridge     driver when ebtables-nft is being used. An attacker could possibly use this issue to impersonate the     hardware addresss of other systems on the network. This issue only affected Ubuntu 18.04 LTS, and Ubuntu     20.04 LTS. (CVE-2021-38598)

    Pavel Toporkov discovered that OpenStack Neutron incorrectly handled extra_dhcp_opts values. An attacker     could possibly use this issue to reconfigure dnsmasq. This issue only affected Ubuntu 18.04 LTS, and     Ubuntu 20.04 LTS. (CVE-2021-40085)

    Slawek Kaplonski discovered that OpenStack Neutron incorrectly handled the routes middleware. An attacker     could possibly use this issue to cause the API worker to consume memory, leading to a denial of service.
    This issue only affected Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-40797)

    It was discovered that OpenStack Neutron incorrectly handled certain queries. A remote authenticated user     could possibly use this issue to cause resource consumption, leading to a denial of service.
    (CVE-2022-3277)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : OpenStack Neutron vulnerabilities (USN-6067-1)

critical Nessus Plugin ID 175565

Version 1.2

Version 1.1

Version 1.0

Version 1.2 Aug 28, 2024, 7:43 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202408281943
Version 1.1 Oct 23, 2023, 6:27 PM Detection Plugin Feed: 202310231827
Version 1.0 May 14, 2023, 4:00 AM New Plugin Feed: 202305140400