CVE-2024-8007 Openstack-tripleo-common: rhosp director disables tls verification for registry mirrors
Attackers can deploy compromised container images via MITM attacks because TLS verification is disabled for registry mirrors in OpenStack director.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-8007?
CVE-2024-8007 is a high-severity vulnerability in Red Hat OpenStack Platform 16.1, published on 21 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in the openstack-tripleo-common component of the Red Hat OpenStack Platform (RHOSP) director. This vulnerability allows an attacker to deploy potentially compromised container images via disabling TLS certificate verification for registry mirrors, which could enable a man-in-the-middle (MITM) attack.
Weakness: CWE-295
Which versions are affected by CVE-2024-8007?
It affects 1 product.
Linux distribution packages (13)
openstack-tripleo-common Red Hat:openstack:17.1::el8 | All versions | 0:15.4.1-17.1.20240911093743.e5b18f2.el8ost |
openstack-tripleo-common-container-base Red Hat:openstack:17.1::el8 | All versions | 0:15.4.1-17.1.20240911093743.e5b18f2.el8ost |
openstack-tripleo-common-containers Red Hat:openstack:17.1::el8 | All versions | 0:15.4.1-17.1.20240911093743.e5b18f2.el8ost |
python-tripleoclient Red Hat:openstack:17.1::el8 | All versions | 0:16.5.1-17.1.20240913093745.f3599d0.el8ost |
python3-tripleo-common Red Hat:openstack:17.1::el8 | All versions | 0:15.4.1-17.1.20240911093743.e5b18f2.el8ost |
python3-tripleoclient Red Hat:openstack:17.1::el8 | All versions | 0:16.5.1-17.1.20240913093745.f3599d0.el8ost |
openstack-tripleo-common Red Hat:openstack:17.1::el9 | All versions | 0:15.4.1-17.1.20240911100820.e5b18f2.el9ost |
openstack-tripleo-common-container-base Red Hat:openstack:17.1::el9 | All versions | 0:15.4.1-17.1.20240911100820.e5b18f2.el9ost |
openstack-tripleo-common-containers Red Hat:openstack:17.1::el9 | All versions | 0:15.4.1-17.1.20240911100820.e5b18f2.el9ost |
openstack-tripleo-common-devtools Red Hat:openstack:17.1::el9 | All versions | 0:15.4.1-17.1.20240911100820.e5b18f2.el9ost |
python-tripleoclient Red Hat:openstack:17.1::el9 | All versions | 0:16.5.1-17.1.20240913100806.f3599d0.el9ost |
python3-tripleo-common Red Hat:openstack:17.1::el9 | All versions | 0:15.4.1-17.1.20240911100820.e5b18f2.el9ost |
python3-tripleoclient Red Hat:openstack:17.1::el9 | All versions | 0:16.5.1-17.1.20240913100806.f3599d0.el9ost |
Products include Redhat Openstack Platform.
How do I fix CVE-2024-8007?
Apply the vendor's patch.
Is CVE-2024-8007 being exploited?
There is no known exploitation of CVE-2024-8007 in the wild and no public exploit code.
Other vulnerabilities in Red Hat OpenStack Platform 16.1
- CVE-2020-10731 Misconfiguration in nova libvirt container provided by the Red Hat OpenStack Platform
- CVE-2017-15114 Missing authorization in n/a
- CVE-2022-3596 Instack-undercloud: rsync leaks information to undercloud
- CVE-2023-6725 Tripleo-ansible: bind keys are world readable
- CVE-2022-3261 Plain-text passwords saved in /var/log/messages
Sources
Also known as GHSA-w89j-rfr2-3vwq, RHSA-2024:9990, RHSA-2024:9991.