Vulnerability · Published May 8, 2024 · Assigned by redhat

CVE-2024-4436Etcd: incomplete fix for cve-2022-41723 in openstack platform

High 7.5

In plain English

A high-severity uncontrolled resource consumption in etcd as shipped in Red Hat Openstack. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.8%top 44.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2022-41723. This issue occurs because the etcd package in the Red Hat OpenStack platform is using http://golang.org/x/net/http2 instead of the one provided by Red Hat Enterprise Linux versions, meaning it should be updated at compile time instead.

Affected products (as reported)

Vendor	Product	Versions
	etcd as shipped in Red Hat Openstack	see references
Red Hat	Red Hat OpenStack Platform 16.1	see references
Red Hat	Red Hat OpenStack Platform 16.2	see references
Red Hat	Red Hat OpenStack Platform 17.1	see references
Red Hat	Red Hat OpenStack Platform 18.0	see references

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

RHSA-2024:3352 vendor-advisory, x_refsource_REDHAT
RHSA-2024:3467 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2024-4436 vdb-entry, x_refsource_REDHAT
RHBZ#2279357 issue-tracking, x_refsource_REDHAT