Description
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a link-local source address.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | neutron | 2:8.1.2-1 | — |
| Debian 13 | neutron | 2:8.1.2-1 | — |
| Debian 12 | neutron | 2:8.1.2-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 8 | python-neutron +21 | 1:7.0.4-11.el7ost | RHSA-2016:1473 |
| Red Hat OpenStack 7 | python-neutron +24 | 2015.1.4-2.el7ost | RHSA-2016:1474 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | neutron | < 7.0.5 | 7.0.5 | GHSA-3vj4-cvjp-482h |
| PyPI | neutron | >= 8.0.0, < 8.1.1 | 8.1.1 | GHSA-3vj4-cvjp-482h |
| PyPI | neutron | < 7.0.5 · >= 8.0.0, < 8.1.1 | 7.0.5, 8.1.1 | PYSEC-2026-431 |
Advisories 2
- RHSA-2016:1474 Red Hat Security Advisory: openstack-neutron security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2016:1473 Red Hat Security Advisory: openstack-neutron security and bug fix update Red Hat Security Advisories (RHSA) · Aug 1, 2026
References
- https://review.openstack.org/#/c/310652/
- RHSA-2016:1473 vendor-advisory
- [oss-security] 20160610 CVE request for vulnerability in OpenStack Neutron mailing-list
- [oss-security] 20160610 Re: CVE request for vulnerability in OpenStack Neutron mailing-list
- https://security.openstack.org/ossa/OSSA-2016-009.html
- https://review.openstack.org/#/c/310648/
- https://bugs.launchpad.net/neutron/+bug/1502933
- https://review.openstack.org/#/c/300233/
- RHSA-2016:1474 vendor-advisory