CVE-2024-8007: Openstack-tripleo-common: rhosp director disables tls verification for registry mirrors
A flaw was found in the openstack-tripleo-common component of the Red Hat OpenStack Platform (RHOSP) director. This vulnerability allows an attacker to deploy potentially compromised container images via disabling TLS certificate verification for registry mirrors, which could enable a man-in-the-middle (MITM) attack.
Other sources
RHOSP Director has a "container image prepare" step which generates a deployment configuration file containing the list of container images to deploy on the OSP nodes based on the user provided config. It can optionally populate a local registry and update the configuration file to reference the locally mirrored images instead.
In the first case, where it just generates the image list, connectivity to the registry is tested for each of the images unless it is from a predefined list of secure registries. If TLS verification for this connection fails then the registry is automatically added to the DockerInsecureRegistries parameter in the generated config file. This parameter will ultimately set insecure=true for the referenced registry in /etc/containers/registry.conf on all hosts while deploying/updating RHOSP and images will be pulled from the registry insecurely.
In the second case, while mirroring an image, the same connectivity check is used. If TLS verification of this connection fails then TLS verification is disabled for the image mirroring task.
With TLS verification disabled a MITM attack delivering tainted container images would not be detected.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8007?
CVE-2024-8007 has been classified as a moderate severity vulnerability.
How do I fix CVE-2024-8007?
To fix CVE-2024-8007, update to the latest version of Red Hat OpenStack Platform 16.1, 16.2, or 17.1 that addresses this vulnerability.
What components are affected by CVE-2024-8007?
CVE-2024-8007 affects the openstack-tripleo-common component of the Red Hat OpenStack Platform.
What could an attacker do with CVE-2024-8007?
An attacker could potentially deploy compromised container images by disabling TLS certificate verification for registry mirrors.
Is CVE-2024-8007 found in older versions of Red Hat OpenStack Platform?
CVE-2024-8007 is not documented to affect versions of Red Hat OpenStack Platform older than 16.1.