CVE-2024-28717 OpenStack Storlets arbitrary code execution vulnerability
A remote attacker can cause a denial of service in OpenStack Storlets via the gateway component, requiring an upgrade to mitigate.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-28717?
CVE-2024-28717 is a medium-severity denial of service vulnerability in n/a, published on 22 Apr 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An issue in OpenStack Storlets yoga-eom allows a remote attacker to execute arbitrary code via the gateway.py component.
Weakness: CWE-400
Which versions are affected by CVE-2024-28717?
3 open source packages ship an affected version, including storlets.
| Package | Affected | Fixed in |
|---|---|---|
storlets PyPI | All versions | 13.0.0.0rc1 |
storlets PyPI | All versions | 13.0.0.0rc1 |
storlets PyPI | All versions | 13.0.0.0rc1 |
How do I fix CVE-2024-28717?
Upgrade storlets to 13.0.0.0rc1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-28717 being exploited?
There is no known exploitation of CVE-2024-28717 in the wild and no public exploit code.
Sources
Also known as GHSA-rfm2-f94j-qhjp, PYSEC-2026-1945.