{"id":"CVE-2024-4437","aliases":["EUVD-2024-44548","GHSA-qv84-5j9v-4hj7","RHSA-2024:3352","RHSA-2024:3467"],"status":"published","title":"Etcd: incomplete fix for cve-2021-44716 in openstack platform","description":"The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2021-44716. This issue occurs because the etcd package in the Red Hat OpenStack platform is using http://golang.org/x/net/http2 instead of the one provided by Red Hat Enterprise Linux versions, meaning it should be updated at compile time instead.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00768,"percentile":0.55867,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-400"],"published":"2024-05-08T08:57:40Z","modified":"2026-10-20T10:02:50Z","affected":[{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.23-16.el8ost"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"etcd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.23-16.el8ost"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"etcd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.23-16.el8ost"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.23-16.el8ost"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"etcd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.23-16.el8ost"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"etcd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.23-16.el8ost"}]}],"bundled":9}],"products":[{"vendor":"red hat","product":"red hat openstack platform 16.1"},{"vendor":"red hat","product":"red hat openstack platform 16.2"},{"vendor":"red hat","product":"red hat openstack platform 17.1"},{"vendor":"red hat","product":"red hat openstack platform 18.0"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:3352","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3467","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-4437","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2279361","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4437","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qv84-5j9v-4hj7"},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2237773","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2237776","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2237777","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2237778","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2253330","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268273","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2279357","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2279365","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3352.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39318","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39318","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39318","tags":["advisory"]},{"url":"https://go.dev/cl/526156","tags":["article"]},{"url":"https://go.dev/issue/62196","tags":["article"]},{"url":"https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ","tags":["article"]},{"url":"https://vuln.go.dev/ID/GO-2023-2041.json","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39319","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39319","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39319","tags":["advisory"]},{"url":"https://go.dev/cl/526157","tags":["article"]},{"url":"https://go.dev/issue/62197","tags":["article"]},{"url":"https://vuln.go.dev/ID/GO-2023-2043.json","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39321","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39321","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39321","tags":["advisory"]},{"url":"https://go.dev/cl/523039","tags":["article"]},{"url":"https://go.dev/issue/62266","tags":["article"]},{"url":"https://vuln.go.dev/ID/GO-2023-2044.json","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39322","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39322","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39322","tags":["advisory"]},{"url":"https://vuln.go.dev/ID/GO-2023-2045.json","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39326","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39326","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39326","tags":["advisory"]},{"url":"https://pkg.go.dev/vuln/GO-2023-2382","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45288","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45288","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45288","tags":["advisory"]},{"url":"https://nowotarski.info/http2-continuation-flood/","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2687","tags":["advisory"]},{"url":"https://www.kb.cert.org/vuls/id/421644","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-1394","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2262921","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-1394","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1394","tags":["advisory"]},{"url":"https://github.com/golang-fips/openssl/commit/85d31d0d257ce842c8a1e63c4d230ae850348136","tags":["article"]},{"url":"https://github.com/golang-fips/openssl/security/advisories/GHSA-78hx-gp6g-7mj6","tags":["article"]},{"url":"https://github.com/microsoft/go-crypto-openssl/commit/104fe7f6912788d2ad44602f77a0a0a62f1f259f","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2660","tags":["advisory"]},{"url":"https://vuln.go.dev/ID/GO-2024-2660.json","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-4436","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-4436","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4436","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-4437","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-4438","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-4438","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4438","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3467.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-4437","title":"Etcd: incomplete fix for cve-2021-44716 in openstack platform","description":"The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2021-44716. This issue occurs because the etcd package in the Red Hat OpenStack platform is using http://golang.org/x/net/http2 instead of the one provided by Red Hat Enterprise Linux versions, meaning it should be updated at compile time instead.","status":"published","published":"2024-05-08T08:57:40.229Z","modified":"2025-11-20T07:30:50.038Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:34:16.78507Z"}],"euvd":[{"id":"EUVD-2024-44548","description":"The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2021-44716. This issue occurs because the etcd package in the Red Hat OpenStack platform is using http://golang.org/x/net/http2 instead of the one provided by Red Hat Enterprise Linux versions, meaning it should be updated at compile time instead.","status":"published","published":"2024-05-08T08:57:40Z","modified":"2025-11-20T07:30:50Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:15.042838Z"}],"ghsa":[{"id":"GHSA-qv84-5j9v-4hj7","title":"The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE...","description":"The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2021-44716. This issue occurs because the etcd package in the Red Hat OpenStack platform is using http://golang.org/x/net/http2 instead of the one provided by Red Hat Enterprise Linux versions, meaning it should be updated at compile time instead.","status":"published","published":"2024-05-08T09:30:50Z","modified":"2024-05-08T09:30:56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:57:20.289371Z"}],"nvd":[{"id":"CVE-2024-4437","description":"The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2021-44716. This issue occurs because the etcd package in the Red Hat OpenStack platform is using http://golang.org/x/net/http2 instead of the one provided by Red Hat Enterprise Linux versions, meaning it should be updated at compile time instead.","status":"published","published":"2024-05-08T09:15:09.467Z","modified":"2026-06-17T08:01:52.797Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:09:57.497105Z"}],"osv":[{"id":"RHSA-2024:3352","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (etcd) security update","status":"published","published":"2024-09-30T15:52:57Z","modified":"2026-10-20T10:02:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:3467","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.1 (etcd) security update","status":"published","published":"2024-09-30T15:53:26Z","modified":"2026-10-20T10:02:50Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"}]}}