RHBA-2023:5806HighCVSS 7.5

Red Hat Bug Fix Advisory: Red Hat Ansible Automation Platform 2.4 Container Release Update

Published
October 17, 2023
Last Modified
September 14, 2026

🔗 CVE IDs covered (2)

CVE-2023-39325 →CVE-2023-44487 →

📋 Description

CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) CVE-2023-44487 — HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

🎯 Affected products118

  • Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • ansible-automation-platform-24/aap-cloud-billing-rhel8-operator@sha256:3151364d2c3359a253e6f95fe296ad9842bcf859a4d05e65abc1283f7646f986_amd64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • ansible-automation-platform-24/aap-cloud-billing-rhel8@sha256:f650486925c3bb5ff56570543839ef8ab668c91bba11a30aeceba22b0cf25b3e_amd64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • ansible-automation-platform-24/aap-cloud-metrics-collector-rhel8@sha256:738e8ad888db5fa2205b9eb809b25ee98b77b47e7cb009d7aef94e0ab09c9492_amd64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • ansible-automation-platform-24/aap-cloud-ui-rhel8-operator@sha256:2826678e9aca4fc567567c36f0d7af6cc22ee85fcfb23d3552534712685d512d_amd64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • ansible-automation-platform-24/aap-cloud-ui-rhel8@sha256:0d0b96befa8957940d289d905517a6e2ef687cc28c9e68c29acb7813a90a13a6_amd64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • ansible-automation-platform-24/aap-must-gather-rhel8@sha256:1ff8637546e4244650e7ad05e9e287c041198d4848a0834c4b505c73ec2adc40_amd64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • ansible-automation-platform-24/aap-must-gather-rhel8@sha256:53a9a6779f8569b03faec060888f39d2d3f071d3a4af8269f66490abd8bfad7e_arm64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • ansible-automation-platform-24/aap-must-gather-rhel8@sha256:ba77e7f17865da4d59f91b69ab58cbeafaa86debe50d2d6fb89e9812f4aed1c7_s390x as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • ansible-automation-platform-24/aap-must-gather-rhel8@sha256:d1730361a768cc0dc847958b872eac8befb5bcbe87d4fc18098b9ff4ed072cf3_ppc64le as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • ansible-automation-platform-24/ansible-builder-rhel8@sha256:0089971676a347149081311def7417185edfeac0fa0fb09bac556d1e4ac17971_arm64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • ansible-automation-platform-24/ansible-builder-rhel8@sha256:0a5ae31195b5b32e8f0800a301ce0e1e282812af59c667c4b40af82a8ca09d62_amd64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • ansible-automation-platform-24/ansible-builder-rhel8@sha256:73220bd2c0da0524f6eb6c7a88378ee9970a804a998f039fa14683cf5d7adf2f_s390x as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • ansible-automation-platform-24/ansible-builder-rhel8@sha256:9aa60f9acfd33709262f38091589521ef49674607e69a3baa6f3d9c9508a10fe_ppc64le as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • ansible-automation-platform-24/ansible-builder-rhel9@sha256:20092308c17687aa6059400af8d1772b8fe85207db9f9a5b6d259908e0b63aab_arm64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • ansible-automation-platform-24/ansible-builder-rhel9@sha256:45ff186bff94f30a34c2fe59bc342d10bf47071567b9d09d1fa61bf08e72f1c4_amd64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • ansible-automation-platform-24/ansible-builder-rhel9@sha256:a4a88494691f2fc7689d16a4da97a857e8b795e41ecf5fe09b09ebfc729511ce_s390x as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • ansible-automation-platform-24/ansible-builder-rhel9@sha256:eb2f2e5796823643b8b52b98976a04089cdc82ce32f3e4a348fc25dd12eff275_ppc64le as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • ansible-automation-platform-24/ansible-python-base-rhel8@sha256:5cf9e0d8a0ad5b1492187b177751cede769b53dc830e5b1bc5dcdd110a71a397_amd64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • ansible-automation-platform-24/ansible-python-base-rhel8@sha256:6599eee6f2b0b8c08ea3dc49598f97aea3b53b456afcc410dd740c39bbfdcd63_arm64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • ansible-automation-platform-24/ansible-python-base-rhel8@sha256:697fa0ba756009f66eb78f1feb4f9597da4b2382644c76f7755d29dd70aecea2_s390x as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • ansible-automation-platform-24/ansible-python-base-rhel8@sha256:dd8c5dc68cf8d71a563743040922540101be6c1b29c2f565e1352ece5b68377b_ppc64le as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • ansible-automation-platform-24/ansible-python-base-rhel9@sha256:7ecc021d626a20acc20f73b28005c16a8d20c7640ec51dffdaff236440702172_amd64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • ansible-automation-platform-24/ansible-python-base-rhel9@sha256:8c34db5cc4c68c80db22a835c095d60e3988a3e6d1c82fb91cc8558b43a47b33_s390x as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • ansible-automation-platform-24/ansible-python-base-rhel9@sha256:91f0cc9dd9261b7bff0484d3db8e499912fa1781aa71ad24c77d0809cccb03f4_ppc64le as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • ansible-automation-platform-24/ansible-python-base-rhel9@sha256:cd96a0ece925ed1443c0797bc3baf992ed7ae087f5977df8728a4aab8940516f_arm64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • ansible-automation-platform-24/ansible-python-toolkit-rhel8@sha256:9273cfd468a23859d784dc3fbf2ad1abb04892e6a3f2ad55d8d2e7c623d0419f_s390x as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • ansible-automation-platform-24/ansible-python-toolkit-rhel8@sha256:99e842a1ca0ea2234c09a8a9466d936968ef36032c102e26fa761089528461e7_amd64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • ansible-automation-platform-24/ansible-python-toolkit-rhel8@sha256:d2d4b79f72dfe3f646f27b2c35e5108ed3a3c867fd0b9c04d0193e6ec717ad75_ppc64le as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • +88 more not shown

✅ Remediation

Red Hat Ansible Automation Platform Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2. Workaround: Users are strongly urged to update their software as soon as fixes are available. There are several mitigation approaches for this flaw. 1. If circumstances permit, users may disable http2 endpoints to circumvent the flaw altogether until a fix is available. 2. IP-based blocking or flood protection and rate control tools may be used at network endpoints to filter incoming traffic. 3. Several package specific mitigations are also available. a. nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ b. netty: https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p c. haproxy: https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487 d. nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg e. golang: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (2)