Read the docs
TI-2016-04654 Aliases CVE-2016-5363GHSA-9pp3-cvmq-9p22

The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows…

Priority MEDIUM 41CWE-254Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · High
Fix status
Partial Red Hat: 2 fixed, 3 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended MAC-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via (1) a crafted DHCP discovery message or (2) crafted non-IP traffic.

Why it matters now

EPSS 0.03266 88th percentileScored 2026-11-07
Fix Partial neutron (PyPI): 7.1.0, 8.1.0Red Hat: 2 advisoriesRed Hat: 2 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—neutron (PyPI)before 7.1.07.1.0Patch availableGHSA-9pp3-cvmq-9p22
—neutron (PyPI)8.0.0 to before 8.1.08.1.0Patch availableGHSA-9pp3-cvmq-9p22
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • neutron (PyPI) Vendor— Affected before 7.1.0 Fixed in 7.1.0 Patch available GHSA-9pp3-cvmq-9p22
  • neutron (PyPI) Vendor— Affected 8.0.0 to before 8.1.0 Fixed in 8.1.0 Patch available GHSA-9pp3-cvmq-9p22

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:openstack:neutron:7.0.0:*:*:*:*:*:*:*7.0.0VulnerableOpenStack
cpe:2.3:a:openstack:neutron:7.0.1:*:*:*:*:*:*:*7.0.1VulnerableOpenStack
cpe:2.3:a:openstack:neutron:7.0.2:*:*:*:*:*:*:*7.0.2VulnerableOpenStack
cpe:2.3:a:openstack:neutron:7.0.3:*:*:*:*:*:*:*7.0.3VulnerableOpenStack
cpe:2.3:a:openstack:neutron:7.0.4:*:*:*:*:*:*:*7.0.4VulnerableOpenStack
cpe:2.3:a:openstack:neutron:8.0.0:*:*:*:*:*:*:*8.0.0VulnerableOpenStack
cpe:2.3:a:openstack:neutron:8.1.0:*:*:*:*:*:*:*8.1.0VulnerableOpenStack
  • cpe:2.3:a:openstack:neutron:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:neutron:7.0.1:*:*:*:*:*:*:* Versions 7.0.1 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:neutron:7.0.2:*:*:*:*:*:*:* Versions 7.0.2 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:neutron:7.0.3:*:*:*:*:*:*:* Versions 7.0.3 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:neutron:7.0.4:*:*:*:*:*:*:* Versions 7.0.4 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:neutron:8.0.0:*:*:*:*:*:*:* Versions 8.0.0 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:neutron:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·OpenStack

Remediation

  • Fix · GHSA-9pp3-cvmq-9p22 neutron (PyPI) Fixed in 7.1.0 Advisory →
  • Fix · GHSA-9pp3-cvmq-9p22 neutron (PyPI) Fixed in 8.1.0 Advisory →

Red Hat 2 advisories

  • RHSA-2016:1473 Released 2016-07-20 · Red Hat rating Low
    openstack-neutron security and bug fix update
    • Red Hat OpenStack Platform 8.0 (Liberty) openstack-neutron-1:7.0.4-11.el7ost, openstack-neutron-bigswitch-1:7.0.4-11.el7ost, openstack-neutron-brocade-1:7.0.4-11.el7ost +19
  • RHSA-2016:1474 Released 2016-07-20 · Red Hat rating Low
    openstack-neutron security, bug fix, and enhancement update
    • Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 openstack-neutron-2015.1.4-2.el7ost, openstack-neutron-bigswitch-2015.1.4-2.el7ost, openstack-neutron-brocade-2015.1.4-2.el7ost +22

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse)AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux OpenStack Platform 6 (Juno)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 9 (Mitaka)AffectedNo fix yet
Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7Fixed RHSA-2016:1474
Red Hat OpenStack Platform 8.0 (Liberty)Fixed RHSA-2016:1473
Not affected: 1 product
  • Red Hat OpenStack Platform 10 (Newton)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-5363
  2. 2026-10-03 Alias added: GHSA-9pp3-cvmq-9p22

References

Advisory 4

Other 14

  • TI-2022-03027 Uncontrolled resource consumption in openstack-neutron CVSS 3.1MEDIUM 6.5
  • TI-2015-07327 The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows… CVSS 3.0CRITICAL 9.1
  • TI-2014-00181 The openvswitch-agent process in OpenStack Neutron 2013.1 before 2013.2.4 and 2014.1… CVSS 2.0HIGH 9.0
  • TI-2021-16185 OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address… CVSS 3.1CRITICAL 9.1
  • TI-2016-04653 The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows… CVSS 3.0HIGH 8.2
  • TI-2013-05386 The default configuration in the Red Hat openstack-neutron package before 2013.2.3-7 does… CVSS 2.0HIGH 7.6
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences