CVE-2023-5625 Python-eventlet: patch regression for cve-2021-21419 in some red hat builds

2023-11-0113:28:10

redhat

www.cve.org

regression

red hat

python-eventlet

patch

application

strategy

cve-2021-21419

builds

products

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

5.8

Confidence

High

EPSS

0.001

Percentile

47.2%

JSON

A regression was introduced in the Red Hat build of python-eventlet due to a change in the patch application strategy, resulting in a patch for CVE-2021-21419 not being applied for all builds of all products.

CNA Affected

[
  {
    "vendor": "Red Hat",
    "product": "Ironic content for Red Hat OpenShift Container Platform 4.12",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "python-eventlet",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:0.30.2-4.el9",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:openshift:4.12::el9",
      "cpe:/a:redhat:openshift:4.12::el8",
      "cpe:/a:redhat:openshift_ironic:4.12::el9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenStack Platform 17.1 for RHEL 8",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "python-eventlet",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:0.30.2-4.el8ost",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:openstack:17.1::el8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "python-eventlet",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:0.30.2-4.el9ost",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:openstack:17.1::el9"
    ]
  }
]