Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2024-8007

Опубликовано: 20 авг. 2024
Источник: redhat
CVSS3: 8.1

Описание

A flaw was found in the openstack-tripleo-common component of the Red Hat OpenStack Platform (RHOSP) director. This vulnerability allows an attacker to deploy potentially compromised container images via disabling TLS certificate verification for registry mirrors, which could enable a man-in-the-middle (MITM) attack.

Меры по смягчению последствий

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat OpenStack Platform 16.1openstack-tripleo-commonOut of support scope
Red Hat OpenStack Platform 16.2openstack-tripleo-commonAffected
Red Hat OpenStack Platform 17.1 for RHEL 8openstack-tripleo-commonFixedRHSA-2024:999121.11.2024
Red Hat OpenStack Platform 17.1 for RHEL 8python-tripleoclientFixedRHSA-2024:999121.11.2024
Red Hat OpenStack Platform 17.1 for RHEL 9openstack-tripleo-commonFixedRHSA-2024:999021.11.2024
Red Hat OpenStack Platform 17.1 for RHEL 9python-tripleoclientFixedRHSA-2024:999021.11.2024

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-295
https://bugzilla.redhat.com/show_bug.cgi?id=2305975openstack-tripleo-common: RHOSP Director Disables TLS Verification for Registry Mirrors

8.1 High

CVSS3

Связанные уязвимости

CVSS3: 8.1
nvd
больше 1 года назад

A flaw was found in the openstack-tripleo-common component of the Red Hat OpenStack Platform (RHOSP) director. This vulnerability allows an attacker to deploy potentially compromised container images via disabling TLS certificate verification for registry mirrors, which could enable a man-in-the-middle (MITM) attack.

CVSS3: 7.5
github
больше 1 года назад

A flaw was found in the Red Hat OpenStack Platform (RHOSP) director. This vulnerability allows an attacker to deploy potentially compromised container images via disabling TLS certificate verification for registry mirrors, which could enable a man-in-the-middle (MITM) attack.

8.1 High

CVSS3