CVE-2024-4437: Etcd: incomplete fix for cve-2021-44716 in openstack platform
The etcd package distributed with Red Hat OpenStack platform has been identified to have an incomplete fix for CVE-2021-44716. This happens because the etcd package in Red Hat OpenStack platform is using the http://golang.org/x/net/http2 instead the one provided by the Red Hat Enterprise linux versions, meaning it should be updated at compile time instead
Other sources
The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2021-44716. This issue occurs because the etcd package in the Red Hat OpenStack platform is using
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/Goto a version that resolves this vulnerability.Fixed in 1.17.5 - Upgrade
Upgrade
redhat/Goto a version that resolves this vulnerability.Fixed in 1.16.12
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4437?
CVE-2024-4437 has a critical severity rating due to its potential impact on the security of the etcd package within Red Hat OpenStack.
How do I fix CVE-2024-4437?
To remediate CVE-2024-4437, update the etcd package to the latest version of Go that is fixed, specifically Go version 1.17.5 or 1.16.12.
Which products are affected by CVE-2024-4437?
CVE-2024-4437 affects the etcd package in Red Hat OpenStack and IBM Edge Application Manager up to version 4.5.
What is the root cause of CVE-2024-4437?
CVE-2024-4437 arises from the incomplete fix for CVE-2021-44716 due to the usage of an outdated http2 package from Go.
Is there a workaround for CVE-2024-4437 if I cannot update immediately?
Currently, there is no formal workaround for CVE-2024-4437; updating to the recommended versions is essential for security compliance.