RHBA-2024:0815HighCVSS 7.5

Red Hat Bug Fix Advisory: OpenShift sandboxed containers 1.5.2 update

Published
February 15, 2024
Last Modified
August 18, 2026

🔗 CVE IDs covered (1)

CVE-2023-44487 →

📋 Description

CVE-2023-44487 — HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

🎯 Affected products15

  • OpenShift Sandboxed Containers 1.5
  • openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9@sha256:53000d1403d8301cd5b422526a9224f0e23789f7433ab0ee96d9b9ee6bbe457c_s390x as a component of OpenShift Sandboxed Containers 1.5
  • openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9@sha256:5aca71d775675519bd5e8c17c266ca70e91482a723fadeee48a4436553c2a88c_amd64 as a component of OpenShift Sandboxed Containers 1.5
  • openshift-sandboxed-containers/osc-cloud-api-adaptor-webhook-rhel9@sha256:17fcd1d7b6003ed409cb6ff291642ec55daa476bd2f7f6a88b7aa4822e54e61e_s390x as a component of OpenShift Sandboxed Containers 1.5
  • openshift-sandboxed-containers/osc-cloud-api-adaptor-webhook-rhel9@sha256:a4176d2b3eaba687ecce5cb39d8c6b466fab02eea7634d148196cc4ca19cefc9_amd64 as a component of OpenShift Sandboxed Containers 1.5
  • openshift-sandboxed-containers/osc-monitor-rhel9@sha256:1fb51e73ed876f7ca60e2fa70fe35ad8941435ac27648030dd0f124e6d12a215_amd64 as a component of OpenShift Sandboxed Containers 1.5
  • openshift-sandboxed-containers/osc-monitor-rhel9@sha256:45ada6552aa5ed43986230dd26bbe4de630dc3ab04ab1a9a371770666a878a81_s390x as a component of OpenShift Sandboxed Containers 1.5
  • openshift-sandboxed-containers/osc-must-gather-rhel9@sha256:081259e193cdf6a7e0849d8ecbe922c72fd1616fb6f1d8ff07ba2089a4a38462_s390x as a component of OpenShift Sandboxed Containers 1.5
  • openshift-sandboxed-containers/osc-must-gather-rhel9@sha256:bffdc077129a33c71b10390ebe4ba4eed0031bc29ce2e0aef29e6454ef53f710_amd64 as a component of OpenShift Sandboxed Containers 1.5
  • openshift-sandboxed-containers/osc-operator-bundle@sha256:94242bcaeb70f40d450104651b66ac4d6c5b3eb97bc6f97c3db9f6d94bed95d1_amd64 as a component of OpenShift Sandboxed Containers 1.5
  • openshift-sandboxed-containers/osc-operator-bundle@sha256:b637dcf57a9e26ff7b9a87926bda980147a41f8207f78ecdc2bc601aeb7138e0_s390x as a component of OpenShift Sandboxed Containers 1.5
  • openshift-sandboxed-containers/osc-podvm-payload-rhel9@sha256:7340a2577a4236000104e3d3fdf4419582232bff392613a6855f8a9af1ea06a4_amd64 as a component of OpenShift Sandboxed Containers 1.5
  • openshift-sandboxed-containers/osc-podvm-payload-rhel9@sha256:b489543912586bd234dabb84068901a4248f0c983882aa2ec64f3092ef336c94_s390x as a component of OpenShift Sandboxed Containers 1.5
  • openshift-sandboxed-containers/osc-rhel9-operator@sha256:6cbad372f0162070e06d935ecec918ab2ba93fb8ad473da3c591b2f7bf384114_amd64 as a component of OpenShift Sandboxed Containers 1.5
  • openshift-sandboxed-containers/osc-rhel9-operator@sha256:7db98893604a59d0d4a0cc322f56b06970fafcf799e790c286643784ab0d8c3f_s390x as a component of OpenShift Sandboxed Containers 1.5

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Users are strongly urged to update their software as soon as fixes are available. There are several mitigation approaches for this flaw. 1. If circumstances permit, users may disable http2 endpoints to circumvent the flaw altogether until a fix is available. 2. IP-based blocking or flood protection and rate control tools may be used at network endpoints to filter incoming traffic. 3. Several package specific mitigations are also available. a. nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ b. netty: https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p c. haproxy: https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487 d. nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg e. golang: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (5)