CVE-2024-4437

2024-05-0800:00:00

ubuntu.com

etcd package

red hat openstack

incomplete fix

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.3 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

69.5%

JSON

The etcd package distributed with the Red Hat OpenStack platform has an
incomplete fix for CVE-2021-44716. This issue occurs because the etcd
package in the Red Hat OpenStack platform is using
http://golang.org/x/net/http2 instead of the one provided by Red Hat
Enterprise Linux versions, meaning it should be updated at compile time
instead.