Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2024-4438— Etcd: incomplete fix for cve-2023-39325/cve-2023-44487 in openstack platform

Quick assessment

Affected

Red Hat Red Hat OpenStack Platform 16.1

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Red Hat OpenStack Platform是美国红帽（Red Hat）公司的一个云计算管理平台。 Red Hat OpenStack Platform 存在安全漏洞，该漏洞源于存在不受控制的资源消耗。受影响版本如下：16.1版本、16.2版本及17.1版本

CVSS 7.5 · High EPSS 0.79% · P56 Updated Feb 26, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-4438

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Etcd: incomplete fix for cve-2023-39325/cve-2023-44487 in openstack platform

Source: CVE Program / CVE List V5

Vulnerability Description

The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2023-39325/CVE-2023-44487, known as Rapid Reset. This issue occurs because the etcd package in the Red Hat OpenStack platform is using http://golang.org/x/net/http2 instead of the one provided by Red Hat Enterprise Linux versions, meaning it should be updated at compile time instead.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

未加控制的资源消耗(资源穷尽)

Source: CVE Program / CVE List V5

Vulnerability Title

Red Hat OpenStack Platform 安全漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE
Red Hat	Red Hat OpenStack Platform 16.1	0:3.3.23-16.el8ost ~ *	`cpe:/a:redhat:openstack:16.1::el8`
Red Hat	Red Hat OpenStack Platform 16.2	0:3.3.23-16.el8ost ~ *	`cpe:/a:redhat:openstack:16.2::el8`
Red Hat	Red Hat OpenStack Platform 17.1 for RHEL 9	0:3.4.26-8.el9ost ~ *	`cpe:/a:redhat:openstack:17.1::el9`
Red Hat	Red Hat OpenStack Platform 18.0	-	`cpe:/a:redhat:openstack:18.0`

II. Public POCs for CVE-2024-4438

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2024-4438

请登录查看更多情报信息。

Vendor Advisories for CVE-2024-4438 (5)

https://access.redhat.com/security/cve/CVE-2024-4438 vdb-entry x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2279365 issue-tracking x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:3352 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:3467 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:2729 vendor-advisory x_refsource_REDHAT

https://www.cve.org/CVERecord?id=CVE-2024-4438

IV. Related Vulnerabilities

Same weakness: CWE-400