CVE-2023-5625

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A regression was introduced in the Red Hat build of python-eventlet due to a change in the patch application strategy, resulting in a patch for CVE-2021-21419 not being applied for all builds of all products.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770 CWE-400

Affected software

Vendor	Product	Versions
Red Hat	Ironic content for Red Hat OpenShift Container Platform 4.12	—
Red Hat	Red Hat OpenStack Platform 17.1 for RHEL 8	—
Red Hat	Red Hat OpenStack Platform 17.1 for RHEL 9	—

References

https://access.redhat.com/errata/RHSA-2023:6128Patch, Vendor Advisory
https://access.redhat.com/errata/RHSA-2024:0188
https://access.redhat.com/errata/RHSA-2024:0213
https://access.redhat.com/security/cve/CVE-2023-5625Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2244717Issue Tracking, Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:6128Patch, Vendor Advisory
https://access.redhat.com/errata/RHSA-2024:0188
https://access.redhat.com/errata/RHSA-2024:0213
https://access.redhat.com/security/cve/CVE-2023-5625Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2244717Issue Tracking, Vendor Advisory

Timeline

Published: Nov 1, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-56268.8Cross-Site Request Forgery (CSRF) in GitHub repository pkp/ojs prior to 3.3.0-16.CVE-2023-56277.5A vulnerability has been identified in NPort 6000 Series, making the authentication mechanism vulnerable. This vulnerability arises from the CVE-2023-56296.1A CWE-601:URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability exists that could cause disclosure of information through phishi CVE-2023-56304.9A CWE-494: Download of Code Without Integrity Check vulnerability exists that could allow a privileged user to install an untrusted firmware CVE-2023-56315.4Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document CVE-2023-56327.5In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT e CVE-2023-56337.8The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory obje CVE-2023-56349.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ArslanSoft Education Portal allows SQL CVE-2023-56357.5Improper Protection for Outbound Error Messages and Alert Signals vulnerability in ArslanSoft Education Portal allows Account Footprinting. CVE-2023-56369.8Unrestricted Upload of File with Dangerous Type vulnerability in ArslanSoft Education Portal allows Command Injection. This issue affects E CVE-2023-56377.5Unrestricted Upload of File with Dangerous Type vulnerability in ArslanSoft Education Portal allows Read Sensitive Strings Within an Executa CVE-2023-56385.4The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wcj_image' shortcode in versions up to, a