CVE-2024-8007: high-severity vulnerability in openstack-tripleo-common
Openstack-tripleo-common: rhosp director disables tls verification for registry mirrors
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.1epss 0.4%
A flaw was found in the openstack-tripleo-common component of the Red Hat OpenStack Platform (RHOSP) director. This vulnerability allows an attacker to deploy potentially compromised container images via disabling TLS certificate verification for registry mirrors, which could enable a man-in-the-middle (MITM) attack.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
openstack-tripleo-commonRed Hat · Red Hat OpenStack Platform 16.1Red Hat · Red Hat OpenStack Platform 16.2Red Hat · Red Hat OpenStack Platform 17.1 for RHEL 8Red Hat · Red Hat OpenStack Platform 17.1 for RHEL 9Related CVEs — openstack-tripleo-common
In the same product, most dangerous first.
CVE-2013-0270MEDIUMKeystone: openstack keystone: denial of service via large http request with long tenant nameEPSS 3.2%CVE-2013-0335HIGHOpenstack nova: vnc proxy can connect to the wrong vmEPSS 2.1%CVE-2012-5571MEDIUMOpenstack keystone: openstack keystone: authorization bypass via improper ec2 token handlingEPSS 2.0%CVE-2013-1840MEDIUMOpenstack glance: swift: s3: openstack glance: information disclosure of backend credentials via cached image requestEPSS 1.7%CVE-2024-1394HIGHGolang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloadsEPSS 1.5%CVE-2012-5625MEDIUMOpenstack nova: information leak in libvirt lvm-backed instancesEPSS 1.3%