Description
A regression was introduced in the Red Hat build of python-eventlet due to a change in the patch application strategy, resulting in a patch for CVE-2021-21419 not being applied for all builds of all products.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Ironic content for Red Hat OpenShift Container Platform 4.12 | — | — |
| Red Hat | Red Hat OpenStack Platform 17.1 for RHEL 8 | — | — |
| Red Hat | Red Hat OpenStack Platform 17.1 for RHEL 9 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Openshift Ironic 4 | python-eventlet +1 | 0.30.2-4.el9 | RHSA-2023:6128 |
| Red Hat OpenStack 17 | python-eventlet +1 | 0.30.2-4.el8ost | RHSA-2024:0213, RHSA-2024:0188 |
Advisories 4
- RHSA-2024:0213 Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (python-eventlet) security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2024:0188 Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (python-eventlet) security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2023:6128 Red Hat Security Advisory: OpenShift Container Platform 4.12.41 packages and security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- WID-SEC-2023-2806 Red Hat OpenShift: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Jan 16, 2024
References
- RHSA-2023:6128 vendor-advisory
- RHSA-2024:0188 vendor-advisory
- RHSA-2024:0213 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2023-5625 vdb-entry
- RHBZ#2244717 issue-tracking