vdanen/rhvex-cve huggingface dataset:
CVE-2021-38507 (Important severity, published 2021-11-01)
CVSS score: 7.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
CWE: CWE-829
Description: The Mozilla Foundation Security Advisory describes this flaw as:

The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded to TLS while retaining the visual properties of an HTTP connection, including being same-origin with unencrypted connections on port 80.  However, if a second encrypted port on the same IP address (e.g. Port 8443) did not opt-in to opportunistic encryption; a network attacker could forward a connection from the browser to port 443 to port 8443, causing the browser to treat the content of port 8443 as same-origin with HTTP. This was resolved by disabling the Opportunistic Encryption feature, which had low usage.
CVE-2021-3461 (Moderate severity, published 2021-03-21)
CVSS score: 7.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
CWE: CWE-613
Description: A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute [Name].
CVE-2021-47374 (Low severity, published 2024-05-20)
CVSS score: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CWE: CWE-779
Description: In the Linux kernel, the following vulnerability has been resolved:

dma-debug: prevent an error message from causing runtime problems

For some drivers, that use the DMA API. This error message can be reached
several millions of times per second, causing spam to the kernel's printk
buffer and bringing the CPU usage up to 100% (so, it should be rate
limited). However, since there is at least one driver that is in the
mainline and suffers from the error condition, it is more useful to
err_printk() here instead of just rate limiting the error message (in hopes
that it will make it easier for other drivers that suffer from this issue
to be spotted).
CVE-2021-47231 (Low severity, published 2024-05-20)
CVSS score: 5.1 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L)
CWE: CWE-402
Description: In the Linux kernel, the following vulnerability has been resolved:

can: mcba_usb: fix memory leak in mcba_usb

Syzbot reported memory leak in SocketCAN driver for Microchip CAN BUS
Analyzer Tool. The problem was in unfreed usb_coherent.

In mcba_usb_start() 20 coherent buffers are allocated and there is
nothing, that frees them:

1) In callback function the urb is resubmitted and that's all
2) In disconnect function urbs are simply killed, but URB_FREE_BUFFER
   is not set (see mcba_usb_start) and this flag cannot be used with
   coherent buffers.

Fail log:
| [ 1354.053291][ T8413] mcba_usb 1-1:0.0 can0: device disconnected
| [ 1367.059384][ T8420] kmemleak: 20 new suspected memory leaks (see /sys/kernel/debug/kmem)

So, all allocated buffers should be freed with usb_free_coherent()
explicitly

NOTE:
The same pattern for allocating and freeing coherent buffers
is used in drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
CVE-2021-0308 (Moderate severity, published 2022-02-03)
CVSS score: 6.8 (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CWE: CWE-787
Description: An out-of-bounds write flaw was found in gdisks' ReadLogicalParts() function of 'basicmbr.cc'. The exploitation of this flaw requires the use of a malicious storage device (for example, a USB Stick) that can cause a crash when physically inserted into the system and possible local privilege escalation. This flaw allows an attacker to compromise confidentiality, integrity, and data availability.
Statement: This vulnerability does affect Red Hat Enterprise Linux 6, 7, and 8 because our code-base is vulnerable to this issue.

Red Hat Product Security has rated this issue as a Moderate security impact and the issue is not currently planned to be addressed in future updates for Red Hat Enterprise Linux 6 and 7, hence, marked as Out-of-Support-Scope. For additional information, refer to the Red Hat Enterprise Linux Life Cycle & Update Policy: https://access.redhat.com/support/policy/updates/errata/.
CVE-2021-32761 (Moderate severity, published 2021-07-20)
CVSS score: 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CWE: CWE-190
Description: A flaw was found in Redis. Issuing the BITFIELD command on a 32-bit version of Redis may result in an integer wrap around allowing an attacker to crash the service or perform remote code execution. The highest threat from this vulnerability is to the data confidentiality, integrity, and service availability.
Statement: This does not affect Redis 5 and Redis 6 packages shipped on Red Hat Enterprise Linux 7 and Red Hat Enterprise Linux 8, as they are 64-bit packages and the issue only affects 32-bit.
CVE-2021-46973 (Moderate severity, published 2024-02-26)
CVSS score: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CWE: CWE-416
Description: A use-after-free flaw was found in the Linux kernel. This issue may lead to compromised availability.
CVE-2021-3524 (Moderate severity, published 2021-04-14)
CVSS score: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
CWE: CWE-20
Description: A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when making the CORS request. The highest threat from this vulnerability is to integrity.
Statement: * Red Hat Ceph Storage (RHCS) 4 is affected by this vulnerability. Note: although this issue affects the RadosGW S3 API, it does not affect the Swift API.
* Red Hat OpenShift Container Storage (RHOCS) 4 shipped ceph package for the usage of RHOCS 4.2 only which has reached End of Life. The shipped version of ceph package is neither used nor supported with the release of RHOCS 4.3.
* Red Hat Enterprise Linux 7 and 8 are not affected by this flaw, as the shipped versions of `ceph` are not compiled with RadosGW support.
* Red Hat OpenStack Platform deployments use the ceph package directly from the Ceph channel; the RHOSP package will not be updated at this time.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2021-29984 (Important severity, published 2021-08-09)
CVSS score: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CWE: CWE-416
Description: Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly considered during garbage collection. This led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91.
CVE-2021-47548 (Moderate severity, published 2024-05-23)
CVSS score: 6 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H)
CWE: CWE-129
Description: In the Linux kernel, the following vulnerability has been resolved:

ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port()

The if statement:
  if (port >= DSAF_GE_NUM)
        return;

limits the value of port less than DSAF_GE_NUM (i.e., 8).
However, if the value of port is 6 or 7, an array overflow could occur:
  port_rst_off = dsaf_dev->mac_cb[port]->port_rst_off;

because the length of dsaf_dev->mac_cb is DSAF_MAX_PORT_NUM (i.e., 6).

To fix this possible array overflow, we first check port and if it is
greater than or equal to DSAF_MAX_PORT_NUM, the function returns.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2021-43858 (Important severity, published 2021-12-26)
CVSS score: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CWE: CWE-863
Description: MinIO is a Kubernetes native application for cloud storage. Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version `RELEASE.2021-12-27T07-23-18Z` changes the accepted request body type and removes the ability to apply policy changes through this API.
Mitigation: There is a workaround for this vulnerability: Changing passwords can be disabled by adding an explicit `Deny` rule to disable the API for users.
CVE-2021-41865 (Moderate severity, published 2021-10-06)
CVSS score: 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CWE: CWE-400
Description: HashiCorp Nomad and Nomad Enterprise 1.1.1 through 1.1.5 allowed authenticated users with job submission capabilities to cause denial of service by submitting incomplete job specifications with a Consul mesh gateway and host networking mode. Fixed in 1.1.6.
CVE-2021-39711 (Low severity, published 2022-03-06)
CVSS score: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CWE: CWE-125
Description: An out-of-bounds (OOB) read flaw was found in bpf_prog_test_run_skb in the net/bpf/test_run.c function due to an incorrect Size Value in the Linux kernel.
Statement: There was no shipped kernel version that was seen affected by this problem.
CVE-2021-4127 (Important severity, published 2021-03-22)
CVSS score: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CWE: CWE-119
Description: The Mozilla Foundation Security Advisory describes this issue as:

An out of date graphics library (Angle) likely contained vulnerabilities that could potentially be exploited.
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.
CVE-2021-3748 (Moderate severity, published 2021-08-26)
CVSS score: 7.5 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)
CWE: CWE-416
Description: A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to num_buffers being set after the virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a denial of service condition, or potentially execute code on the host with the privileges of the QEMU process.
Statement: This issue affects the versions of `qemu-kvm` as shipped with Red Hat Enterprise Linux 8 and Red Hat Enterprise Linux 8 Advanced Virtualization. A future update may address this flaw.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2021-21321 (Critical severity, published 2021-02-22)
CVSS score: 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N)
CWE: CWE-20
Description: A flaw was found in fastify-reply-from. Escaping of the prefix of the proxied backend service is possible allowing an attacker, using a specially crafted URL, to gain access to directories that would otherwise be out of bounds. The highest threat from this vulnerability is to data confidentiality and integrity.
Statement: The impact of this flaw largely depends on the environment where the affected library is being used. This flaw could be used to redirect an adversary to an exposed, unprotected endpoint. Depending on the functionality of the affected endpoint that could result in a loss of confidentiality, integrity and availability.  The severity of this flaw in for Red Had Advanced Cluster Management for Kubernetes is rated as important as there are no exposed, un-authenticated endpoints that could be accessed by exploiting this flaw.
CVE-2021-47362 (Low severity, published 2024-05-20)
CVSS score: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CWE: CWE-476
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/pm: Update intermediate power state for SI

Update the current state as boot state during dpm initialization.
During the subsequent initialization, set_power_state gets called to
transition to the final power state. set_power_state refers to values
from the current state and without current state populated, it could
result in NULL pointer dereference.

For ex: on platforms where PCI speed change is supported through ACPI
ATCS method, the link speed of current state needs to be queried before
deciding on changing to final power state's link speed. The logic to query
ATCS-support was broken on certain platforms. The issue became visible
when broken ATCS-support logic got fixed with commit
f9b7f3703ff9 ("drm/amdgpu/acpi: make ATPX/ATCS structures global (v2)").

Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1698
CVE-2021-4218 (Moderate severity, published 2022-01-30)
CVSS score: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CWE: CWE-824
Description: A flaw was found in the Linux kernel’s implementation of reading the SVC RDMA counters. Reading the counter sysctl panics the system. This flaw allows a local attacker with local access to cause a denial of service while the system reboots.
CVE-2021-36221 (Moderate severity, published 2021-08-04)
CVSS score: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
CWE: CWE-362
Description: A race condition flaw was found in Go. The incoming requests body weren't closed after the handler panic and as a consequence this could lead to ReverseProxy crash.  The highest threat from this vulnerability is to Availability.
Statement: * In Red Hat OpenStack Platform, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the impacted RHOSP packages.

* In Service Telemetry Framework, because the flaw has a lower impact and the package is not directly used by STF1.3, no update will be provided at this time for the STF1.3 sg-core-container. Additionally, because Service Telemetry Framework1.2 will be retiring soon, no update will be provided at this time for the STF1.2 smart-gateway-container.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2021-3477 (Low severity, published 2021-02-14)
CVSS score: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CWE: CWE-125
Description: There's a flaw in OpenEXR's deep tile sample size calculations. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger an integer overflow, subsequently leading to an out-of-bounds read. The greatest risk of this flaw is to application availability.
CVE-2021-3498 (Moderate severity, published 2021-03-14)
CVSS score: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CWE: CWE-119
Description: GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.
CVE-2021-3532 (None severity, published 2021-05-10)
CVSS score: 0 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:N)
CWE: CWE-200
Description: A flaw was found in Ansible. Confidential information is disclosed in async_files when the user changes the jobdir to a world-readable directory. Any confidential information in an async status file will be readable by a malicious user on that system.
Statement: Red Hat Product Security does not consider this to be a vulnerability.
CVE-2021-46965 (Low severity, published 2024-02-26)
CVSS score: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
CWE: CWE-125
Description: In the Linux kernel, the following vulnerability has been resolved:

mtd: physmap: physmap-bt1-rom: Fix unintentional stack access

Cast &data to (char *) in order to avoid unintentionally accessing
the stack.

Notice that data is of type u32, so any increment to &data
will be in the order of 4-byte chunks, and this piece of code
is actually intended to be a byte offset.

Addresses-Coverity-ID: 1497765 ("Out-of-bounds access")
Statement: No Red Hat Products are affected by this vulnerability.
CVE-2021-32777 (Important severity, published 2021-08-24)
CVSS score: 8.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L)
CWE: CWE-863
Description: An authorization bypass vulnerability was found in envoyproxy/envoy. Envoy incorrectly evaluates an HTTP request with multiple `value` headers. This flaw allows an attacker to bypass rule policies that use the `ext_authz` extension. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
CVE-2021-47227 (Moderate severity, published 2024-05-20)
CVSS score: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CWE: CWE-20
Description: A vulnerability was found in the Linux kernel's x86/fpu, within the __fpu__restore_sig() function. When user data is copied into the kernel buffer without proper validation, it can lead to corruption of the kernel's state, resulting in a system crash when using the FPU.
Mitigation: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
CVE-2021-45830 (Low severity, published 2022-01-04)
CVSS score: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CWE: CWE-787
Description: A heap-based buffer overflow vulnerability exists in HDF5 1.13.1-1 via H5F_addr_decode_len in /hdf5/src/H5Fint.c, which could cause a Denial of Service.
Statement: In Red Hat OpenStack Platform 16 the hdf5 package is not actually utilized. Red Hat OpenStack Platform 13 will be retiring soon. For these reasons and because the flaw's impact is lower, no update will be provided at this time for the hdf5 package.
CVE-2021-39212 (Moderate severity, published 2021-09-12)
CVSS score: 4.4 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
CWE: CWE-287
Description: A flaw was found in ImageMagick in the Postscript File Handler component. An attacker could exploit this flaw which would, in some cases, lead to postscript files to be read and written to even when specifically excluded by a module policy in policy.xml.
Mitigation: Users are advised to use the coder policy instead of the module policy as a workaround.
CVE-2021-20199 (Moderate severity, published 2020-12-31)
CVSS score: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
CWE: CWE-346
Description: A flaw was found in podman. Rootless containers receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts) which impact containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. The highest threat from this vulnerability is to data integrity.
Statement: This issue does not affect Podman prior to version 1.8.0. Podman shipped in the following products are therefore not affected:

* Red Hat Enterprise Linux 7 Extras
* Red Hat Enterprise Linux 8 Container Tools stream 1.0
* Red Hat Enterprise Linux 8 Container Tools stream 2.0
* OpenShift Container Platform 3.11
* OpenShift Container Platform 4.1 to 4.5
Mitigation: Configure containerized applications to require authentication for connections from all sources, including localhost.
CVE-2021-21272 (Moderate severity, published 2021-01-21)
CVSS score: 7.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N)
CWE: CWE-22
Description: A flaw was found in oras. The directory support feature allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links. A well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs `oras pull`.
Statement: A vulnerable version of github.com/deislabs/oras package is delivered in listed OpenShift Container Platform (OCP) and OpenShift Container Storage components, but the vulnerable code is not invoked, therefore these components are affected but with impact Low.
CVE-2021-28950 (Moderate severity, published 2021-03-03)
CVSS score: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CWE: CWE-835
Description: A denial of service in the kernel side of the FUSE functionality can allow a local system to create a denial of service.
Mitigation: As the FUSE module will be auto-loaded when required, its use can be disabled  by preventing the module from loading with the following instructions:

# echo "install fuse /bin/true" >> /etc/modprobe.d/disable-fuse.conf

The system will need to be restarted if the FUSE modules are loaded. In most circumstances, the CIFS kernel modules will be unable to be unloaded while the FUSE filesystems are in  use.

If the system requires this module to work correctly, this mitigation may not be suitable.

If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services.
CVE-2021-20176 (Moderate severity, published 2021-01-05)
CVSS score: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
CWE: CWE-369
Description: A divide-by-zero flaw was found in ImageMagick in gem.c. This flaw allows an attacker who submits a crafted file that is processed by ImageMagick to trigger undefined behavior through a division by zero. The highest threat from this vulnerability is to system availability.
CVE-2021-41035 (Moderate severity, published 2021-11-29)
CVSS score: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
CWE: CWE-732
Description: In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods.
CVE-2021-28116 (Moderate severity, published 2021-02-08)
CVSS score: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
CWE: CWE-200
Description: A flaw was found in squid. An out-of-bounds read in the WCCP protocol can be leveraged as part of a chain for remote code execution leading to an information disclosure. The highest threat from this vulnerability is to data confidentiality.
CVE-2021-22235 (Moderate severity, published 2021-07-15)
CVSS score: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CWE: CWE-835
Description: Crash in DNP dissector in Wireshark 3.4.0 to 3.4.6 and 3.2.0 to 3.2.14 allows denial of service via packet injection or crafted capture file
CVE-2021-20208 (Moderate severity, published 2021-04-12)
CVSS score: 6.1 (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N)
CWE: CWE-266
Description: A flaw was found in cifs-utils. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vulnerability is to data confidentiality and integrity.
Statement: This flaw is rated as having Moderate impact because of the need to have elevated privileges and limited possibilities of the attack: an attacker will not get actual credentials cache accessed by themselves, but might cause an authentication attempt to an SMB server and may be succeed in file access.
Mitigation: DFS and multiuser mounts can be disabled in the container SMB mounts options i.e. adding 'nodfs' and removing 'multiuser' (if present).
CVE-2021-21419 (Moderate severity, published 2021-05-05)
CVSS score: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CWE: CWE-400
Description: A flaw was found in eventlet. If an unauthenticated user manages to send large websocket frames or highly compressed data frames that can lead to memory exhaustion. An attacker could use this flaw to cause a denial of service (DoS).
Statement: * In OpenShift Container Platform 4, the python-eventlet package is only used in Ironic container images, used for Baremetal provisioning, and Kuryr SDN container images, used for deployments on OpenStack.

* In Red Hat Gluster Storage 3, python-eventlet package was primarily shipped as a dependency of openstack-swift. However, Openstack Swift is no longer supported with the recent release of Red Hat Gluster Storage 3.5.

* Because the flaw's impact is lower and Red Hat OpenStack Platform 13 will be retiring soon, no update will be provided at this time for the RHOSP13 python-eventlet package.