Incomplete Fix for CVE-2022-41723 in Red Hat OpenStack Platform
CVE-2024-4436
7.5HIGH
Key Information:
- Vendor
Red Hat
- Status
- Vendor
- CVE Published:
- 8 May 2024
What is CVE-2024-4436?
The etcd package utilized within the Red Hat OpenStack platform has a vulnerability stemming from an incomplete resolution of a prior issue (CVE-2022-41723). The root cause is the use of the http://golang.org/x/net/http2 package instead of the secure version provided by Red Hat Enterprise Linux. This oversight necessitates urgent updates at compile time to ensure the package meets required security standards and operates safely within deployed environments. Users of affected versions are advised to implement the latest patches to mitigate any potential security risks.
Affected Version(s)
Red Hat OpenStack Platform 16.1 0:3.3.23-16.el8ost
Red Hat OpenStack Platform 16.2 0:3.3.23-16.el8ost