Description
A flaw was found in the openstack-tripleo-common component of the Red Hat OpenStack Platform (RHOSP) director. This vulnerability allows an attacker to deploy potentially compromised container images via disabling TLS certificate verification for registry mirrors, which could enable a man-in-the-middle (MITM) attack.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | openstack-tripleo-common | — | — |
| Red Hat | Red Hat OpenStack Platform 17.1 for RHEL 8 | — | — |
| Red Hat | Red Hat OpenStack Platform 17.1 for RHEL 9 | — | — |
| Red Hat | Red Hat OpenStack Platform 16.1 | — | — |
| Red Hat | Red Hat OpenStack Platform 16.2 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 17 | openstack-tripleo-common-devtools | 15.4.1-17.1.20240911100820.e5b18f2.el9ost | RHSA-2024:9990 |
| Red Hat OpenStack 17 | python-tripleoclient +1 | 16.5.1-17.1.20240913093745.f3599d0.el8ost | RHSA-2024:9991, RHSA-2024:9990 |
| Red Hat OpenStack 17 | python3-tripleo-common +3 | 15.4.1-17.1.20240911093743.e5b18f2.el8ost | RHSA-2024:9991, RHSA-2024:9990 |
Advisories 3
- RHSA-2024:9991 Red Hat Security Advisory: RHOSP 17.1.4 (openstack-tripleo-common and python-tripleoclient) security update Red Hat Security Advisories (RHSA) · Feb 26, 2026
- RHSA-2024:9990 Red Hat Security Advisory: RHOSP 17.1.4 (openstack-tripleo-common and python-tripleoclient) security update Red Hat Security Advisories (RHSA) · Feb 26, 2026
- WID-SEC-2024-1893 Red Hat OpenStack: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Nov 20, 2024
References
- RHSA-2024:9990 vendor-advisory
- RHSA-2024:9991 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-8007 vdb-entry
- RHBZ#2305975 issue-tracking