RHSA-2023:5530HighCVSS 7.5

Red Hat Security Advisory: Logging Subsystem 5.7.7 - Red Hat OpenShift security update

Published
October 20, 2023
Last Modified
September 30, 2026

🔗 CVE IDs covered (4)

CVE-2023-44487 →CVE-2023-29406 →CVE-2023-29409 →CVE-2023-39325 →

📋 Description

CVE-2023-29406 — golang: net/http: insufficient sanitization of Host header CVE-2023-29409 — golang: crypto/tls: slow verification of certificate chains containing large RSA keys CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) CVE-2023-44487 — HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

🎯 Affected products64

  • RHOL 5.7 for RHEL 8
  • openshift-logging/cluster-logging-operator-bundle@sha256:0761943b57451fa8cd0d42942a831376ab48f723e8ea461d0a5ea49c9a391d7b_amd64 as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/cluster-logging-rhel8-operator@sha256:1d6a2bd236f72f3dbb4c2e284cb2ac2554d7d79b416d57ee94b8d158ea3ea807_arm64 as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/cluster-logging-rhel8-operator@sha256:2023d126c1be90ab6e6b27e778cc3944a2e5af2b44358537d65e60d385e78959_ppc64le as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/cluster-logging-rhel8-operator@sha256:c9a5546e0f427376f36d6d350cebe7ed3e7d2468d3c8290528fbe054462e22d6_s390x as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/cluster-logging-rhel8-operator@sha256:efb5cb250782473d1f4eb42d06747c9fad6df65c888cca88ed421bba399c5d96_amd64 as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/elasticsearch-operator-bundle@sha256:060f8fd11a32cbb6247d7d41e4be1fc71026e9bab9238995b7b2e563fb94e6d7_amd64 as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/elasticsearch-proxy-rhel8@sha256:2995302941f4c0d5016e49c3a01ca3bc4d80935ce1de70c84a2124e28e290947_arm64 as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/elasticsearch-proxy-rhel8@sha256:6f64ee3aeedb891cb4b88e90c7569235d8e136cb2a66c7da1bc3ec73a518aa5d_s390x as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/elasticsearch-proxy-rhel8@sha256:7ca7ec92b15a7556d6a8daabd24a70f42e4260b6caf9168e852890c063e91186_amd64 as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/elasticsearch-proxy-rhel8@sha256:f223378bb8b335e6ed531a451a48fc17c039004414836cc1f2bf8d408eb6eb18_ppc64le as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/elasticsearch-rhel8-operator@sha256:368447ae5216ada4c092c8781d3b847a5d37606d7c4ce430376ed5d3a4384863_amd64 as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/elasticsearch-rhel8-operator@sha256:640dfbd649bde0c5fed45d5ecaf595e1cf09ffa6d76be3b75751108c0d85bbcb_ppc64le as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/elasticsearch-rhel8-operator@sha256:720587fcb7a89a571c04c8e222e5ebf54c899086ce07461e5f5dac7dfe8e6af9_s390x as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/elasticsearch-rhel8-operator@sha256:9a492f0164ba9ea96a8cef43577a6d62ce5806dc1e821d3aee2abfcf35a02ac0_arm64 as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/elasticsearch6-rhel8@sha256:0fab0830499ef530add912e8022f9d5a09addbf229e62bea989a1d8734e70a33_ppc64le as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/elasticsearch6-rhel8@sha256:560831bdc34128719564aaaca4b80bba32062b97c87118b4ac00413609bcf067_amd64 as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/elasticsearch6-rhel8@sha256:90c408f644a8a853de8338f2d4c1b7ff10877973a98c15868e1e0662da8eca46_s390x as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/elasticsearch6-rhel8@sha256:a00a7c1c152b6d2897bdc06b0137b556e6931b7d309e4e9a585825dbd558d3ba_arm64 as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/eventrouter-rhel8@sha256:3054aade5994df42ab7c2981865a7851049ea46ed20b7805d1553d6b28ab5af8_amd64 as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/eventrouter-rhel8@sha256:7a45458250a73682ab11a3c743d563ab1c9072281b15d3a18088c5902130a4cd_s390x as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/eventrouter-rhel8@sha256:ac827708b7d49a217770e510124427e9430ec13b23d8fc3e0f7bdcb682214b34_ppc64le as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/eventrouter-rhel8@sha256:bc31b395c3a2353048cad9d0d44f28e60f7e0a01e5fc6f6b2803d813ec279687_arm64 as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/fluentd-rhel8@sha256:08ba4f66916d6331ce739c856c863e2de59c7b870ef2247ed2ee4b5895932193_s390x as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/fluentd-rhel8@sha256:65b491f9794f306cfe74b6ff622e9fe8b1155df5ed89e8db1f34ee2d299b2245_ppc64le as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/fluentd-rhel8@sha256:d920792d5ea71265702f0a408888e051b47d23cb8b624c02e6ed29b142d152bf_arm64 as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/fluentd-rhel8@sha256:f93ddeb2a52c0aead46bb0bb2af71a68c9a11093617615faadb3b07f45590fa1_amd64 as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/kibana6-rhel8@sha256:6bdd69f14340d82695bd645b14f4faaa99c830630087d43aa843418cfb34b89e_arm64 as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/kibana6-rhel8@sha256:b104e6731b8ddfb98dd8a0891dfb1051fb59e82d70f91c297a62402922412c32_amd64 as a component of RHOL 5.7 for RHEL 8
  • openshift-logging/kibana6-rhel8@sha256:e8af2bde433bebee9236365ce6bc52db26981c8e484df2048cb4ed2b7cb5bed1_s390x as a component of RHOL 5.7 for RHEL 8
  • +34 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2. Workaround: Users are strongly urged to update their software as soon as fixes are available. There are several mitigation approaches for this flaw. 1. If circumstances permit, users may disable http2 endpoints to circumvent the flaw altogether until a fix is available. 2. IP-based blocking or flood protection and rate control tools may be used at network endpoints to filter incoming traffic. 3. Several package specific mitigations are also available. a. nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ b. netty: https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p c. haproxy: https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487 d. nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg e. golang: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (12)