Vulnerability · Published Aug 21, 2024 · Assigned by redhat
CVE-2024-8007Openstack-tripleo-common: rhosp director disables tls verification for registry mirrors
High 8.1
In plain English
A high-severity improper certificate validation in openstack-tripleo-common. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.4%top 66.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw was found in the openstack-tripleo-common component of the Red Hat OpenStack Platform (RHOSP) director. This vulnerability allows an attacker to deploy potentially compromised container images via disabling TLS certificate verification for registry mirrors, which could enable a man-in-the-middle (MITM) attack.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| openstack-tripleo-common | see references | |
| Red Hat | Red Hat OpenStack Platform 17.1 for RHEL 8 | see references |
| Red Hat | Red Hat OpenStack Platform 17.1 for RHEL 8 | see references |
| Red Hat | Red Hat OpenStack Platform 17.1 for RHEL 9 | see references |
| Red Hat | Red Hat OpenStack Platform 17.1 for RHEL 9 | see references |
| Red Hat | Red Hat OpenStack Platform 16.1 | see references |
| Red Hat | Red Hat OpenStack Platform 16.2 | see references |
Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- RHSA-2024:9990 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:9991 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2024-8007 vdb-entry, x_refsource_REDHAT
- RHBZ#2305975 issue-tracking, x_refsource_REDHAT