What’s Vulnerable › Vulnerabilities

CVE-2024-8007: Openstack-tripleo-common: rhosp director disables tls verification for registry mirrors

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-08-21 · updated 2026-06-17
• Weakness: CWE-295

Description

A flaw was found in the openstack-tripleo-common component of the Red Hat OpenStack Platform (RHOSP) director. This vulnerability allows an attacker to deploy potentially compromised container images via disabling TLS certificate verification for registry mirrors, which could enable a man-in-the-middle (MITM) attack.

Affected products

• nova_libvirt container provided by the Red Hat OpenStack Platform: 16.1, 16.2, 17.1

References

• https://access.redhat.com/errata/RHSA-2024:9990
• https://access.redhat.com/errata/RHSA-2024:9991
• https://access.redhat.com/security/cve/CVE-2024-8007
• https://bugzilla.redhat.com/show_bug.cgi?id=2305975

Get alerted when CVE-2024-8007 or the next vulnerability affects your stack