CVE-2024-4437

Description

The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2021-44716. This issue occurs because the etcd package in the Red Hat OpenStack platform is using http://golang.org/x/net/http2 instead of the one provided by Red Hat Enterprise Linux versions, meaning it should be updated at compile time instead.

Reserved 2024-05-02 | Published 2024-05-08 | Updated 2024-11-24 | Assigner redhat

Problem types

Uncontrolled Resource Consumption

Product status

Default status
affected

0:3.3.23-16.el8ost before *
unaffected

Default status
affected

0:3.3.23-16.el8ost before *
unaffected

Default status
unaffected

Default status
affected

Timeline

2024-05-06:	Reported to Red Hat.
2024-05-06:	Made public.

References

access.redhat.com/errata/RHSA-2024:3352 (RHSA-2024:3352) vendor-advisory

access.redhat.com/errata/RHSA-2024:3467 (RHSA-2024:3467) vendor-advisory

access.redhat.com/security/cve/CVE-2024-4437 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2279361 (RHBZ#2279361) issue-tracking

cve.org (CVE-2024-4437)

nvd.nist.gov (CVE-2024-4437)

Download JSON