Skip to content
Fencer Vulns
high 8.1

CVE-2024-8007 json

Openstack-tripleo-common: rhosp director disables tls verification for registry mirrors

published 2024-08-21 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-49528

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 33%
public exploits
0
none known

Summary

A flaw was found in the openstack-tripleo-common component of the Red Hat OpenStack Platform (RHOSP) director. This vulnerability allows an attacker to deploy potentially compromised container images via disabling TLS certificate verification for registry mirrors, which could enable a man-in-the-middle (MITM) attack.

Patch / fix

  • Red Hat Red Hat OpenStack Platform 17.1 for RHEL 8 0:15.4.1-17.1.20240911093743.e5b18f2.el8ost, 0:16.5.1-17.1.20240913093745.f3599d0.el8ost
  • Red Hat Red Hat OpenStack Platform 17.1 for RHEL 9 0:15.4.1-17.1.20240911100820.e5b18f2.el9ost, 0:16.5.1-17.1.20240913100806.f3599d0.el9ost
  • python-tripleoclient openstack 17.1 16.5.1-17.1.20240913093745.f3599d0.el8ost
  • python3-tripleoclient openstack 17.1 16.5.1-17.1.20240913093745.f3599d0.el8ost
  • python3-tripleo-common openstack 17.1 15.4.1-17.1.20240911093743.e5b18f2.el8ost
  • openstack-tripleo-common openstack 17.1 15.4.1-17.1.20240911093743.e5b18f2.el8ost
  • openstack-tripleo-common-containers openstack 17.1 15.4.1-17.1.20240911093743.e5b18f2.el8ost
  • openstack-tripleo-common-container-base openstack 17.1 15.4.1-17.1.20240911093743.e5b18f2.el8ost
  • python-tripleoclient openstack 17.1 16.5.1-17.1.20240913100806.f3599d0.el9ost
  • python3-tripleoclient openstack 17.1 16.5.1-17.1.20240913100806.f3599d0.el9ost

red hat advisories RHSA-2024:9991RHSA-2024:9990

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-8007 updated cvss 8.1

openstack-tripleo-common: RHOSP Director Disables TLS Verification for Registry Mirrors

  • Red Hat OpenStack Platform 16.1 python3-tripleo-common, openstack-tripleo-common, openstack-tripleo-common-devtools, openstack-tripleo-common-containers, openstack-tripleo-common-container-base
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenStack Platform 16.2 python3-tripleo-common, openstack-tripleo-common, openstack-tripleo-common-devtools, openstack-tripleo-common-containers, openstack-tripleo-common-container-base
    affected: workaround, no fix available
  • Red Hat OpenStack Platform 17.1 python-tripleoclient 16.5.1-17.1.20240913093745.f3599d0.el8ost, python-tripleoclient 16.5.1-17.1.20240913100806.f3599d0.el9ost, python3-tripleoclient 16.5.1-17.1.20240913093745.f3599d0.el8ost, python3-tripleoclient 16.5.1-17.1.20240913100806.f3599d0.el9ost, python3-tripleo-common 15.4.1-17.1.20240911093743.e5b18f2.el8ost, python3-tripleo-common 15.4.1-17.1.20240911100820.e5b18f2.el9ost, +7 more
    fixed: vendor fix RHSA-2024:9991

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.39% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Red Hat Red Hat OpenStack Platform 17.1 for RHEL 8
  • Red Hat Red Hat OpenStack Platform 17.1 for RHEL 9
  • Red Hat Red Hat OpenStack Platform 16.1
  • Red Hat Red Hat OpenStack Platform 16.2

Classification

Weakness
  • CWE-295 Improper Certificate Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.