Red Hat OpenStack Platform (RHOSP) director vulnerability [CVE-2024-8007]

CVE number = CVE-2024-8007

A flaw was found in the Red Hat OpenStack Platform (RHOSP) director.

This vulnerability allows an attacker to deploy potentially compromised container images via disabling TLS certificate verification for registry mirrors, which could enable a man-in-the-middle (MITM) attack.

RHOSP Director has a “container image prepare” step which generates a deployment configuration file containing the list of container images to deploy on the OSP nodes based on the user provided config. It can optionally populate a local registry and update the configuration file to reference the locally mirrored images instead.

In the first case, where it just generates the image list, connectivity to the registry is tested for each of the images unless it is from a predefined list of secure registries. If TLS verification for this connection fails then the registry is automatically added to the DockerInsecureRegistries parameter in the generated config file. This parameter will ultimately set insecure=true for the referenced registry in /etc/containers/registry.conf on all hosts while deploying/updating RHOSP and images will be pulled from the registry insecurely.

In the second case, while mirroring an image, the same connectivity check is used. If TLS verification of this connection fails then TLS verification is disabled for the image mirroring task.

With TLS verification disabled a MITM attack delivering tainted container images would not be detected.

Further details – https://access.redhat.com/security/cve/CVE-2024-8007