RHSA-2023:3167MediumCVSS 7.5

Red Hat Security Advisory: Red Hat build of Cryostat 2.3.0: new RHEL 8 container images

Published
May 18, 2023
Last Modified
September 22, 2026

🔗 CVE IDs covered (6)

CVE-2023-24536 →CVE-2023-24537 →CVE-2022-41723 →CVE-2022-41724 →CVE-2022-41725 →CVE-2023-24534 →

📋 Description

CVE-2022-41723 — golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding CVE-2022-41724 — golang: crypto/tls: large handshake records may cause panics CVE-2022-41725 — golang: net/http, mime/multipart: denial of service from excessive resource consumption CVE-2023-24534 — golang: net/http, net/textproto: denial of service from excessive memory allocation CVE-2023-24536 — golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption CVE-2023-24537 — golang: go/parser: Infinite loop in parsing

🎯 Affected products7

  • Cryostat 2 on RHEL 8
  • cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:c0bd96a3e451ee82a5874e56b34156050452ff7fbafaf192b5991b825e6dd979_amd64 as a component of Cryostat 2 on RHEL 8
  • cryostat-tech-preview/cryostat-operator-bundle@sha256:d5dc8178232bc360954311bfc28fbbf0ead2144a73b289b0308f27d9c3379b60_amd64 as a component of Cryostat 2 on RHEL 8
  • cryostat-tech-preview/cryostat-reports-rhel8@sha256:21c64326fda1bf605b430844634fd456f3ebbafd7539c18356ee0ceb204f614f_amd64 as a component of Cryostat 2 on RHEL 8
  • cryostat-tech-preview/cryostat-rhel8-operator@sha256:91b3cf3508eff9ebc86b40aed0e9216caf2120d68ce2dfa178094733153b467c_amd64 as a component of Cryostat 2 on RHEL 8
  • cryostat-tech-preview/cryostat-rhel8@sha256:e207cee8c61092f6c8e75b3a4aea220d248ec24169da45864c948a966d686f81_amd64 as a component of Cryostat 2 on RHEL 8
  • cryostat-tech-preview/jfr-datasource-rhel8@sha256:5156043fce0f9130235c7cf9cdb19545620524dac856f6638dff72735647206f_amd64 as a component of Cryostat 2 on RHEL 8

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, upgrade Go to version 1.19.8, 1.20.3, or later, where the vulnerability has been addressed.

🔗 References (10)