{"id":"CVE-2024-8007","aliases":["EUVD-2024-49528","GHSA-w89j-rfr2-3vwq","RHSA-2024:9990","RHSA-2024:9991"],"status":"published","title":"Openstack-tripleo-common: rhosp director disables tls verification for registry mirrors","description":"A flaw was found in the openstack-tripleo-common component of the Red Hat OpenStack Platform (RHOSP) director. This vulnerability allows an attacker to deploy potentially compromised container images via disabling TLS certificate verification for registry mirrors, which could enable a man-in-the-middle (MITM) attack.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00392,"percentile":0.33622,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2024-08-21T13:40:25Z","modified":"2026-06-17T08:21:39Z","fixes":[{"ecosystem":"Red Hat:openstack:17.1::el9","package":"openstack-tripleo-common","fixed_in":["0:15.4.1-17.1.20240911100820.e5b18f2.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"openstack-tripleo-common-container-base","fixed_in":["0:15.4.1-17.1.20240911100820.e5b18f2.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"openstack-tripleo-common-containers","fixed_in":["0:15.4.1-17.1.20240911100820.e5b18f2.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"openstack-tripleo-common-devtools","fixed_in":["0:15.4.1-17.1.20240911100820.e5b18f2.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"python-tripleoclient","fixed_in":["0:16.5.1-17.1.20240913100806.f3599d0.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"python3-tripleo-common","fixed_in":["0:15.4.1-17.1.20240911100820.e5b18f2.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"python3-tripleoclient","fixed_in":["0:16.5.1-17.1.20240913100806.f3599d0.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el8","package":"openstack-tripleo-common","fixed_in":["0:15.4.1-17.1.20240911093743.e5b18f2.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el8","package":"openstack-tripleo-common-container-base","fixed_in":["0:15.4.1-17.1.20240911093743.e5b18f2.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el8","package":"openstack-tripleo-common-containers","fixed_in":["0:15.4.1-17.1.20240911093743.e5b18f2.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el8","package":"python-tripleoclient","fixed_in":["0:16.5.1-17.1.20240913093745.f3599d0.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el8","package":"python3-tripleo-common","fixed_in":["0:15.4.1-17.1.20240911093743.e5b18f2.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el8","package":"python3-tripleoclient","fixed_in":["0:16.5.1-17.1.20240913093745.f3599d0.el8ost"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"openstack-tripleo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.4.1-17.1.20240911100820.e5b18f2.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"openstack-tripleo-common-container-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.4.1-17.1.20240911100820.e5b18f2.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"openstack-tripleo-common-containers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.4.1-17.1.20240911100820.e5b18f2.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"openstack-tripleo-common-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.4.1-17.1.20240911100820.e5b18f2.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"python-tripleoclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.5.1-17.1.20240913100806.f3599d0.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"python3-tripleo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.4.1-17.1.20240911100820.e5b18f2.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"python3-tripleoclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.5.1-17.1.20240913100806.f3599d0.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el8","package":"openstack-tripleo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.4.1-17.1.20240911093743.e5b18f2.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el8","package":"openstack-tripleo-common-container-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.4.1-17.1.20240911093743.e5b18f2.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el8","package":"openstack-tripleo-common-containers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.4.1-17.1.20240911093743.e5b18f2.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el8","package":"python-tripleoclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.5.1-17.1.20240913093745.f3599d0.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el8","package":"python3-tripleo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.4.1-17.1.20240911093743.e5b18f2.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el8","package":"python3-tripleoclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.5.1-17.1.20240913093745.f3599d0.el8ost"}]}]}],"products":[{"vendor":"red hat","product":"red hat openstack platform 16.1"},{"vendor":"red hat","product":"red hat openstack platform 16.2"},{"vendor":"red hat","product":"red hat openstack platform 17.1 for rhel 8"},{"vendor":"red hat","product":"red hat openstack platform 17.1 for rhel 9"},{"vendor":"redhat","product":"openstack_platform"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:9990","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9991","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-8007","tags":["vdb-entry","x_refsource_REDHAT","Vendor Advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2305975","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8007","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w89j-rfr2-3vwq"},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2213408","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2251692","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2259470","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2272202","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2279328","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2292699","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2295391","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2301634","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2303654","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2307955","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2308677","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2320103","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9990.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-8007","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2258093","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2294406","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9991.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-8007","title":"Openstack-tripleo-common: rhosp director disables tls verification for registry mirrors","description":"A flaw was found in the openstack-tripleo-common component of the Red Hat OpenStack Platform (RHOSP) director. This vulnerability allows an attacker to deploy potentially compromised container images via disabling TLS certificate verification for registry mirrors, which could enable a man-in-the-middle (MITM) attack.","status":"published","published":"2024-08-21T13:40:25.242Z","modified":"2026-02-25T20:32:06.71Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:34:09.540667Z"}],"euvd":[{"id":"EUVD-2024-49528","description":"A flaw was found in the openstack-tripleo-common component of the Red Hat OpenStack Platform (RHOSP) director. This vulnerability allows an attacker to deploy potentially compromised container images via disabling TLS certificate verification for registry mirrors, which could enable a man-in-the-middle (MITM) attack.","status":"published","published":"2024-08-21T13:40:25Z","modified":"2026-02-25T20:32:06Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:48:28.530473Z"}],"ghsa":[{"id":"GHSA-w89j-rfr2-3vwq","title":"A flaw was found in the Red Hat OpenStack Platform (RHOSP) director. This vulnerability allows an...","description":"A flaw was found in the Red Hat OpenStack Platform (RHOSP) director. This vulnerability allows an attacker to deploy potentially compromised container images via disabling TLS certificate verification for registry mirrors, which could enable a man-in-the-middle (MITM) attack.","status":"published","published":"2024-08-21T15:30:54Z","modified":"2024-11-25T06:34:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:58:56.443174Z"}],"nvd":[{"id":"CVE-2024-8007","description":"A flaw was found in the openstack-tripleo-common component of the Red Hat OpenStack Platform (RHOSP) director. This vulnerability allows an attacker to deploy potentially compromised container images via disabling TLS certificate verification for registry mirrors, which could enable a man-in-the-middle (MITM) attack.","status":"published","published":"2024-08-21T14:15:09.753Z","modified":"2026-06-17T08:21:39.58Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:10:19.870727Z"}],"osv":[{"id":"RHSA-2024:9990","title":"Red Hat Security Advisory: RHOSP 17.1.4 (openstack-tripleo-common and python-tripleoclient) security update","status":"published","published":"2024-11-25T09:53:40Z","modified":"2026-02-26T10:16:08Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2024:9991","title":"Red Hat Security Advisory: RHOSP 17.1.4 (openstack-tripleo-common and python-tripleoclient) security update","status":"published","published":"2024-11-25T09:53:50Z","modified":"2026-02-26T10:16:09Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"}]}}