OpenStack Platform Vulnerability Exposes Containers to MITM Attacks

CVE-2024-8007

What is CVE-2024-8007?

A flaw exists in the openstack-tripleo-common component of the Red Hat OpenStack Platform (RHOSP) director. An attacker may exploit this to deploy potentially compromised container images because the system has the option to disable TLS certificate verification for registry mirrors. This could lead to a serious security risk known as a man-in-the-middle (MITM) attack, where an attacker could intercept and manipulate communications between users and the registry. Properly managing TLS certificate verification settings is crucial to maintaining the integrity and security of the OpenStack environment.

References