GHSA-hvm4-mc7m-22w4 · Severity: high · Ecosystem: pip — OpenStack Neutron vulnerable to hardware address impersonation
OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the hardware addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations.
Conclusion & alert: CVE-2021-38598 is rated High Exploit Risk (74.6/100): CVSS Critical severity, with medium exploitation likelihood (EPSS 1.17%). Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). EPSS rose +1.06% over the last day, indicating growing attacker interest. Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
| EDB-ID | Source | Kind | Published | Link |
|---|---|---|---|---|
| — | nvd_ref | exploit_tag | Exploit-DB ↗ |
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.11% | 1.17% | +1.06% |
| 2 | 2026-05-12 | 0.04% | 0.11% | +0.08% |
| 3 | 2025-11-21 | — | 0.04% | — |
Full EPSS history (12 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 9.1 | 3.1 | CRITICAL |
|
3.9 | 5.2 | [email protected] |
| 5.8 | 2.0 | MEDIUM |
|
8.6 | 4.9 | [email protected] |
GHSA-hvm4-mc7m-22w4 · Severity: high · Ecosystem: pip — OpenStack Neutron vulnerable to hardware address impersonation
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2021-38598 not yet assigned priority: Debian including 1 source packages (neutron), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2021-38598 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2021-38598 |
suse
|
medium | CVE-2021-38598 severity moderate: SUSE including 12 source package names (openstack-neutron, openstack-neutron-dhcp-agent, …), 72 product×package rows across 6 product lines (HPE Helion OpenStack 8, SUSE OpenStack Cloud 7, … (6 product lines)): Known Not Affected 72. | https://www.suse.com/security/cve/CVE-2021-38598/ |
ubuntu
|
medium | CVE-2021-38598 medium priority: Ubuntu including 1 source packages (neutron), 15 status rows across 15 suites (bionic, focal, hirsute, impish, jammy, kinetic, lunar, mantic, noble, oracular, plucky, questing, trusty, upstream, xenial): not-affected 9, released 3, DNE 1, ignored 1, needs-triage 1. | https://ubuntu.com/security/CVE-2021-38598 |
| URL | Tags |
|---|---|
| https://launchpad.net/bugs/1938670 | Exploit Issue Tracking Third Party Advisory |