Red Hat OpenStack Platform 17.1 includes the python-waitress pure-python WSGI server, which was found to have two security issues. CVE-2024-49768 is a race condition in request processing during HTTP pipelining with an invalid first request. CVE-2024-49769 is a denial of service vulnerability that leads to high CPU usage and resource exhaustion. These vulnerabilities were rated as important by Red Hat Product Security. A security update has been issued to fix these vulnerabilities in the python-waitress package for Red Hat OpenStack Platform 17.1 on RHEL 9 x86_64. The advisory references Red Hat Bugzilla entries 2322460 and 2322461 for the respective CVEs. The update is available and users are advised to apply it following Red Hat's official instructions.

Successful exploitation of CVE-2024-49768 could cause a race condition during HTTP pipelining, potentially leading to unexpected behavior in request processing. CVE-2024-49769 could allow an attacker to cause a denial of service by exhausting CPU resources, impacting service availability. Both vulnerabilities affect the python-waitress server component in Red Hat OpenStack Platform 17.1, potentially disrupting hosted services relying on this WSGI server.

Red Hat has released an official security update for python-waitress in Red Hat OpenStack Platform 17.1 (Wallaby) on RHEL 9 that addresses these vulnerabilities. Users should apply this update promptly by following the instructions in the Red Hat article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the provided patch. Patch status is confirmed as available.