CVE-2023-5625 Python-eventlet: patch regression for cve-2021-21419 in some red hat builds
A regression in Red Hat builds of python-eventlet failed to apply a previous security patch, leaving systems vulnerable to denial of service attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-5625?
CVE-2023-5625 is a medium-severity denial of service vulnerability in Ironic content for Red Hat OpenShift Container Platform 4.12, published on 1 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A regression was introduced in the Red Hat build of python-eventlet due to a change in the patch application strategy, resulting in a patch for CVE-2021-21419 not being applied for all builds of all products.
Which versions are affected by CVE-2023-5625?
It affects 5 products.
Linux distribution packages (6)
python-eventlet Red Hat:openshift_ironic:4.12::el9 | All versions | 0:0.30.2-4.el9 |
python3-eventlet Red Hat:openshift_ironic:4.12::el9 | All versions | 0:0.30.2-4.el9 |
python-eventlet Red Hat:openstack:17.1::el8 | All versions | 0:0.30.2-4.el8ost |
python3-eventlet Red Hat:openstack:17.1::el8 | All versions | 0:0.30.2-4.el8ost |
python-eventlet Red Hat:openstack:17.1::el9 | All versions | 0:0.30.2-4.el9ost |
python3-eventlet Red Hat:openstack:17.1::el9 | All versions | 0:0.30.2-4.el9ost |
Products include Redhat Openshift Container Platform for Arm64, Redhat Openshift Container Platform for Linuxone, Redhat Openshift Container Platform for Power, Redhat Openshift Container Platform Ibm Z Systems, Redhat Openstack Platform.
How do I fix CVE-2023-5625?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-5625 being exploited?
There is no known exploitation of CVE-2023-5625 in the wild and no public exploit code.
Sources
Also known as GHSA-326p-894x-j8c7, OESA-2023-1768, RHSA-2023:6128, RHSA-2024:0188, RHSA-2024:0213.