CVE-2024-8007
📋 TL;DR
This vulnerability in Red Hat OpenStack Platform director allows attackers to deploy compromised container images by disabling TLS certificate verification for registry mirrors, enabling man-in-the-middle attacks. It affects RHOSP deployments using the openstack-tripleo-common component. Attackers could intercept and modify container images during deployment.
💻 Affected Systems
- Red Hat OpenStack Platform (RHOSP) director
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers deploy malicious container images that compromise the entire OpenStack infrastructure, leading to data theft, service disruption, or persistent backdoors.
Likely Case
Attackers intercept and modify legitimate container images to inject malicious code or credentials, potentially gaining unauthorized access to OpenStack components.
If Mitigated
With proper TLS verification and network segmentation, impact is limited to potential deployment failures or delays.
🎯 Exploit Status
Requires ability to intercept registry mirror traffic and modify container images. Exploitation depends on specific deployment configurations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: RHOSP 17.1 with errata RHSA-2024:9990 and RHSA-2024:9991
Vendor Advisory: https://access.redhat.com/errata/RHSA-2024:9990
Restart Required: Yes
Instructions:
1. Update openstack-tripleo-common package via yum update. 2. Apply RHOSP 17.1 errata updates. 3. Restart affected director services. 4. Verify TLS verification is enforced for registry mirrors.
🔧 Temporary Workarounds
Enforce TLS verification
linuxConfigure registry mirrors to require TLS certificate verification
# Edit tripleo configuration to set verify_tls: true for registry mirrors
# In your deployment configuration, ensure registry_mirrors uses verified TLS endpoints
Network segmentation
allIsolate registry mirror traffic to prevent interception
# Use VLANs or network policies to protect registry traffic
# Implement TLS inspection with proper certificate validation
🧯 If You Can't Patch
- Implement strict network controls to prevent MITM attacks on registry traffic
- Use internal, trusted registry mirrors with certificate pinning and monitoring
🔍 How to Verify
Check if Vulnerable:
Check openstack-tripleo-common package version and configuration for registry mirror TLS settingsCheck Version:
rpm -q openstack-tripleo-commonVerify Fix Applied:
Verify package version is updated and TLS verification is enabled in registry mirror configuration📡 Detection & Monitoring
Log Indicators:
- Failed TLS certificate verification for registry mirrors
- Unexpected container image deployments
- Registry connection errors
Network Indicators:
- Unencrypted or unverified TLS connections to registry mirrors
- Suspicious MITM activity on registry network segments
SIEM Query:
source="openstack-director" AND ("registry" AND "tls" AND ("failed" OR "disabled"))