CVE-2024-4437 Etcd: incomplete fix for cve-2021-44716 in openstack platform

2024-05-0808:57:40

CWE-400

redhat

www.cve.org

etcd

incomplete fix

cve-2021-44716

red hat openstack

package

http2

update

compile time

security issue

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

8 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

69.4%

JSON

The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2021-44716. This issue occurs because the etcd package in the Red Hat OpenStack platform is using http://golang.org/x/net/http2 instead of the one provided by Red Hat Enterprise Linux versions, meaning it should be updated at compile time instead.

CNA Affected

[
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenStack Platform 16.1",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "etcd",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:3.3.23-16.el8ost",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:openstack:16.1::el8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenStack Platform 16.2",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "etcd",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:3.3.23-16.el8ost",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:openstack:16.2::el8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenStack Platform 17.1",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "etcd",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/a:redhat:openstack:17.1"
    ]
  }
]