RHBA-2023:6109HighCVSS 9.8

Red Hat Bug Fix Advisory: MTV 2.4.3 Images

Published
October 25, 2023
Last Modified
August 24, 2026

🔗 CVE IDs covered (14)

CVE-2023-24539 →CVE-2023-24536 →CVE-2023-24538 →CVE-2023-29400 →CVE-2023-29409 →CVE-2023-39325 →CVE-2023-44487 →CVE-2022-32190 →CVE-2022-41723 →CVE-2022-41724 →CVE-2022-41725 →CVE-2023-3978 →CVE-2023-24534 →CVE-2023-24537 →

📋 Description

CVE-2022-32190 — golang: net/url: JoinPath does not strip relative path components in all circumstances CVE-2022-41723 — golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding CVE-2022-41724 — golang: crypto/tls: large handshake records may cause panics CVE-2022-41725 — golang: net/http, mime/multipart: denial of service from excessive resource consumption CVE-2023-3978 — golang.org/x/net/html: Cross site scripting CVE-2023-24534 — golang: net/http, net/textproto: denial of service from excessive memory allocation CVE-2023-24536 — golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption CVE-2023-24537 — golang: go/parser: Infinite loop in parsing CVE-2023-24538 — golang: html/template: backticks not treated as string delimiters CVE-2023-24539 — golang: html/template: improper sanitization of CSS values CVE-2023-29400 — golang: html/template: improper handling of empty HTML attributes CVE-2023-29409 — golang: crypto/tls: slow verification of certificate chains containing large RSA keys CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) CVE-2023-44487 — HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

🎯 Affected products15

  • 8Base-MTV-2.4
  • migration-toolkit-virtualization/mtv-api-rhel9@sha256:61de05b8dffe208fb8d4c00aed8bba71a4e428f74cc06b936debfbe4fb640747_amd64 as a component of 8Base-MTV-2.4
  • migration-toolkit-virtualization/mtv-console-plugin-rhel9@sha256:3022d96f38b8900d1b545cbf045f96816194bfba917f08c2e67758f7928acf2c_amd64 as a component of 8Base-MTV-2.4
  • migration-toolkit-virtualization/mtv-controller-rhel9@sha256:c9b7db0c74e38e5f028b3b72066892c96b6f684575d395a197a0826c09d96e1d_amd64 as a component of 8Base-MTV-2.4
  • migration-toolkit-virtualization/mtv-must-gather-api-rhel8@sha256:afc08bab3b5b19bcd4003819d4e1bc1c9c3faf71370154ee1695c9a3a6192223_amd64 as a component of 8Base-MTV-2.4
  • migration-toolkit-virtualization/mtv-must-gather-rhel8@sha256:0b766d8e51580920d3b558eaac237b39b70f890127adaac34177aff1b97596fa_amd64 as a component of 8Base-MTV-2.4
  • migration-toolkit-virtualization/mtv-openstack-populator-rhel9@sha256:cb8d1bc7320c4ba9caa1d3bb45e48c6d1d2b71799f5dc466c5de8b87579d0c63_amd64 as a component of 8Base-MTV-2.4
  • migration-toolkit-virtualization/mtv-operator-bundle@sha256:f3172be67364c2a3a5acc25976759e91643c30dfa4d034ea39884ce2be084741_amd64 as a component of 8Base-MTV-2.4
  • migration-toolkit-virtualization/mtv-populator-controller-rhel9@sha256:4bbec09dfd8021e9cf676f1fb85a0a3f168845b91421afa5ded7983a3561d301_amd64 as a component of 8Base-MTV-2.4
  • migration-toolkit-virtualization/mtv-rhel8-operator@sha256:30cea757cbe41f54ecfd59320ea92351e1209f5646c7346d7d7563e383e988bb_amd64 as a component of 8Base-MTV-2.4
  • migration-toolkit-virtualization/mtv-rhv-populator-rhel8@sha256:f1c946eb52c6464db8a68cd4c6b61b6df145c68aef4a4858651076ba27d5c40b_amd64 as a component of 8Base-MTV-2.4
  • migration-toolkit-virtualization/mtv-ui-rhel8@sha256:f872479bcfbf35cae89eb3c95005067b8e64aca090cc058c4e4a1f0db56df9ff_amd64 as a component of 8Base-MTV-2.4
  • migration-toolkit-virtualization/mtv-validation-rhel9@sha256:8d9947ca76642dacb58290203f5ad003f7ca4f1a5a075ac584ab9e27018a0eed_amd64 as a component of 8Base-MTV-2.4
  • migration-toolkit-virtualization/mtv-virt-v2v-rhel9@sha256:7ecf4ffb01ccf2cd92fa96407bca9e5b6054e3b5033ada74c98e00dca163d1f7_amd64 as a component of 8Base-MTV-2.4
  • migration-toolkit-virtualization/mtv-virt-v2v-warm-rhel8@sha256:c8a7ee4f36ffc0206d614ad47ce95a13aacdf80a47e1ea7209e0f9824914c36c_amd64 as a component of 8Base-MTV-2.4

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2. Workaround: Users are strongly urged to update their software as soon as fixes are available. There are several mitigation approaches for this flaw. 1. If circumstances permit, users may disable http2 endpoints to circumvent the flaw altogether until a fix is available. 2. IP-based blocking or flood protection and rate control tools may be used at network endpoints to filter incoming traffic. 3. Several package specific mitigations are also available. a. nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ b. netty: https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p c. haproxy: https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487 d. nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg e. golang: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (2)