CVE-2024-28718

The vulnerability classified as CWE-367 (Time-of-check Time-of-use, TOCTOU) is located in the cert_manager.py component responsible for certificate management in OpenStack Magnum. The flaw results from a race condition between the moment of object state verification and its actual use, allowing an attacker to manipulate the code execution flow. An attacker can invoke the vulnerable component remotely without needing any credentials, which corresponds to the attack vector AV:N/AC:L/PR:N/UI:N.

Successful exploitation of the vulnerability allows an attacker to execute arbitrary code remotely (RCE) on the server hosting the OpenStack Magnum service, which may lead to complete system takeover, disclosure of sensitive data, and compromise of the integrity and availability of the environment.

Apply patches available from the vendor according to the references — fix available through code review at https://review.opendev.org/c/openstack/magnum/+/907305. It is recommended to update the OpenStack Magnum environment as soon as possible and monitor the activity of the cert_manager.py component until the patch is deployed.

OpenStack Magnum in yoga-eom version