What is RHEA-2023:7239?

RHEA-2023:7239 is a security advisory published by Red Hat Product Security with High severity. Red Hat Enhancement Advisory: ExternalDNS Operator 1.2 operator/operand containers

Which CVE IDs does RHEA-2023:7239 cover?

RHEA-2023:7239 covers the following CVE IDs: CVE-2023-44487. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of RHEA-2023:7239?

RHEA-2023:7239 has a CVSS v3 base score of 7.5, published by Red Hat Product Security.

Which products are affected by RHEA-2023:7239?

RHEA-2023:7239 affects 4 products, including: EXT-DNS-OPTR 1.2 for RHEL 8; edo/external-dns-operator-bundle@sha256:a614ec94c2468e34e129e9ecd4bc0d1895eb67b96e77eb5ad94cd8bd507860f5_amd64 as a component of EXT-DNS-OPTR 1.2 for RHEL 8; edo/external-dns-rhel8-operator@sha256:b10916860dfedff4481fec85d682ae8b6ef2588e63b5ca0496044e0cacadb858_amd64 as a component of EXT-DNS-OPTR 1.2 for RHEL 8; edo/external-dns-rhel8@sha256:de5c2dd03fd5a3fb13390fb304f8746da5368df4764f21702e81594a225cec27_amd64 as a component of EXT-DNS-OPTR 1.2 for RHEL 8.

RHEA-2023:7239HighCVSS 7.5

Red Hat Enhancement Advisory: ExternalDNS Operator 1.2 operator/operand containers

Vendor

Red Hat Product Security

Published

November 15, 2023

Last Modified

August 18, 2026

🔗 CVE IDs covered (1)

CVE-2023-44487 →

📋 Description

CVE-2023-44487 — HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

🎯 Affected products4

EXT-DNS-OPTR 1.2 for RHEL 8
edo/external-dns-operator-bundle@sha256:a614ec94c2468e34e129e9ecd4bc0d1895eb67b96e77eb5ad94cd8bd507860f5_amd64 as a component of EXT-DNS-OPTR 1.2 for RHEL 8
edo/external-dns-rhel8-operator@sha256:b10916860dfedff4481fec85d682ae8b6ef2588e63b5ca0496044e0cacadb858_amd64 as a component of EXT-DNS-OPTR 1.2 for RHEL 8
edo/external-dns-rhel8@sha256:de5c2dd03fd5a3fb13390fb304f8746da5368df4764f21702e81594a225cec27_amd64 as a component of EXT-DNS-OPTR 1.2 for RHEL 8

✅ Remediation

OpenShift ExternalDNS Operator Release Workaround: Users are strongly urged to update their software as soon as fixes are available. There are several mitigation approaches for this flaw. 1. If circumstances permit, users may disable http2 endpoints to circumvent the flaw altogether until a fix is available. 2. IP-based blocking or flood protection and rate control tools may be used at network endpoints to filter incoming traffic. 3. Several package specific mitigations are also available. a. nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ b. netty: https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p c. haproxy: https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487 d. nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg e. golang: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 CVE IDs covered (1)

📋 Description

🎯 Affected products4

✅ Remediation

🔗 References (6)