{"id":"CVE-2023-5625","aliases":["EUVD-2023-57918","GHSA-326p-894x-j8c7","OESA-2023-1768","RHSA-2023:6128","RHSA-2024:0188","RHSA-2024:0213"],"status":"published","title":"Python-eventlet: patch regression for cve-2021-21419 in some red hat builds","description":"A regression was introduced in the Red Hat build of python-eventlet due to a change in the patch application strategy, resulting in a patch for CVE-2021-21419 not being applied for all builds of all products.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0098,"percentile":0.62518,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-770"],"published":"2023-10-27T11:06:13Z","modified":"2026-08-18T01:17:55Z","fixes":[{"ecosystem":"openEuler:20.03-LTS-SP3","package":"python-eventlet","fixed_in":["0.30.2-2.oe1"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift_ironic:4.12::el9","package":"python-eventlet","fixed_in":["0:0.30.2-4.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift_ironic:4.12::el9","package":"python3-eventlet","fixed_in":["0:0.30.2-4.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el8","package":"python-eventlet","fixed_in":["0:0.30.2-4.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el8","package":"python3-eventlet","fixed_in":["0:0.30.2-4.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"python-eventlet","fixed_in":["0:0.30.2-4.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"python3-eventlet","fixed_in":["0:0.30.2-4.el9ost"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"python-eventlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.2-2.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.12::el9","package":"python-eventlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.30.2-4.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.12::el9","package":"python3-eventlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.30.2-4.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el8","package":"python-eventlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.30.2-4.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el8","package":"python3-eventlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.30.2-4.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"python-eventlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.30.2-4.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"python3-eventlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.30.2-4.el9ost"}]}]}],"products":[{"vendor":"red hat","product":"ironic content for red hat openshift container platform 4.12"},{"vendor":"red hat","product":"red hat openstack platform 17.1 for rhel 8"},{"vendor":"red hat","product":"red hat openstack platform 17.1 for rhel 9"},{"vendor":"redhat","product":"openshift_container_platform_for_arm64"},{"vendor":"redhat","product":"openshift_container_platform_for_linuxone"},{"vendor":"redhat","product":"openshift_container_platform_for_power"},{"vendor":"redhat","product":"openshift_container_platform_ibm_z_systems"},{"vendor":"redhat","product":"openstack_platform"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2023:6128","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Patch","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0188","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0213","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-5625","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Vendor Advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244717","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5625","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-326p-894x-j8c7"},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1768","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6128.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-5625","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0188.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0213.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-5625","title":"Python-eventlet: patch regression for cve-2021-21419 in some red hat builds","description":"A regression was introduced in the Red Hat build of python-eventlet due to a change in the patch application strategy, resulting in a patch for CVE-2021-21419 not being applied for all builds of all products.","status":"published","published":"2023-11-01T13:28:10.19Z","modified":"2025-11-20T18:06:27.969Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-770","CWE-400"],"updated_at":"2026-11-02T14:35:16.771348Z"}],"euvd":[{"id":"EUVD-2023-57918","description":"A regression was introduced in the Red Hat build of python-eventlet due to a change in the patch application strategy, resulting in a patch for CVE-2021-21419 not being applied for all builds of all products.","status":"published","published":"2023-11-01T13:28:10Z","modified":"2025-11-20T18:06:27Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T19:49:14.564249Z"}],"ghsa":[{"id":"GHSA-326p-894x-j8c7","title":"A regression was introduced in the Red Hat build of python-eventlet due to a change in the patch...","description":"A regression was introduced in the Red Hat build of python-eventlet due to a change in the patch application strategy, resulting in a patch for CVE-2021-21419 not being applied for all builds of all products.","status":"published","published":"2023-11-01T15:33:29Z","modified":"2024-12-06T12:30:47Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:59:03.724628Z"}],"nvd":[{"id":"CVE-2023-5625","description":"A regression was introduced in the Red Hat build of python-eventlet due to a change in the patch application strategy, resulting in a patch for CVE-2021-21419 not being applied for all builds of all products.","status":"published","published":"2023-11-01T14:15:38.897Z","modified":"2026-06-17T06:48:57.99Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-770","CWE-400"],"updated_at":"2026-11-02T14:08:41.047232Z"}],"osv":[{"id":"OESA-2023-1768","title":"python-eventlet security update","description":"Eventlet is a concurrent networking library for Python that allows you to change how you run your code, not how you write it.\r\n\r\nSecurity Fix(es):\r\n\r\nA regression was introduced in the Red Hat build of python-eventlet due to a change in the patch application strategy, resulting in a patch for CVE-2021-21419 not being applied for all builds of all products.(CVE-2023-5625)","status":"published","published":"2023-10-27T11:06:13Z","modified":"2026-08-18T01:17:55.598947753Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"RHSA-2023:6128","title":"Red Hat Security Advisory: OpenShift Container Platform 4.12.41 packages and security update","status":"published","published":"2024-09-16T15:25:31Z","modified":"2026-08-07T10:10:24Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2024:0188","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (python-eventlet) security update","status":"published","published":"2024-09-16T15:25:39Z","modified":"2026-08-07T10:11:48Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2024:0213","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (python-eventlet) security update","status":"published","published":"2024-09-16T15:25:48Z","modified":"2026-08-07T10:11:51Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:12.270484Z"}]}}