RHSA-2023:5541HighCVSS 7.5

Red Hat Security Advisory: Logging Subsystem 5.6.12 - Red Hat OpenShift security update

Published
October 20, 2023
Last Modified
August 24, 2026

🔗 CVE IDs covered (5)

CVE-2023-44487 →CVE-2023-26136 →CVE-2023-29406 →CVE-2023-29409 →CVE-2023-39325 →

📋 Description

CVE-2023-26136 — tough-cookie: prototype pollution in cookie memstore CVE-2023-29406 — golang: net/http: insufficient sanitization of Host header CVE-2023-29409 — golang: crypto/tls: slow verification of certificate chains containing large RSA keys CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) CVE-2023-44487 — HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

🎯 Affected products64

  • RHOL 5.6 for RHEL 8
  • openshift-logging/cluster-logging-operator-bundle@sha256:02c4a20e1f2b0678afe4ea0757933ce581ef66e6b189622aea7dc0fa91e6c18c_amd64 as a component of RHOL 5.6 for RHEL 8
  • openshift-logging/cluster-logging-rhel8-operator@sha256:556e2c39c0eebd2e8a4d361d40221fa8cf0e9bf7db66dcf2bd2f32576240d94b_amd64 as a component of RHOL 5.6 for RHEL 8
  • openshift-logging/cluster-logging-rhel8-operator@sha256:64d3a93c2adbca869845ea59edfbef2675658bd15fd22dfc1681b57809d3269c_arm64 as a component of RHOL 5.6 for RHEL 8
  • openshift-logging/cluster-logging-rhel8-operator@sha256:a697fe3d581606f0da267205636c94e0dd7076fdf562fe9d4f0332ec0267f880_s390x as a component of RHOL 5.6 for RHEL 8
  • openshift-logging/cluster-logging-rhel8-operator@sha256:f8553bf9f5a75c089cdf5a26f8853e6f4488c19ef2a8dc1e0ebc96e4aab0384f_ppc64le as a component of RHOL 5.6 for RHEL 8
  • openshift-logging/elasticsearch-operator-bundle@sha256:369d45c783651c6e07dfd721fa43025800b263da8e1fdbbc75b296686426e840_amd64 as a component of RHOL 5.6 for RHEL 8
  • openshift-logging/elasticsearch-proxy-rhel8@sha256:26f58db9cb18dfe0eb7a3478a7bb86c87efabe32d98dcf74bc34226a09ea6f0e_ppc64le as a component of RHOL 5.6 for RHEL 8
  • openshift-logging/elasticsearch-proxy-rhel8@sha256:938ac92e58ab4fd377219899c6f3c25f41a58260f078e44b371d91964083d96a_s390x as a component of RHOL 5.6 for RHEL 8
  • openshift-logging/elasticsearch-proxy-rhel8@sha256:c67b4fadb575fc60d60cc3307da75f2fa3e5c4760e572072308a506e4e271ab1_amd64 as a component of RHOL 5.6 for RHEL 8
  • openshift-logging/elasticsearch-proxy-rhel8@sha256:ce5fc5a37453626de4bcb9a05d3849ef7da0722bfc8f0fecfc1f693cf6b5deff_arm64 as a component of RHOL 5.6 for RHEL 8
  • openshift-logging/elasticsearch-rhel8-operator@sha256:2a87c3b6888c57d813169da3ae06aa5bcac1ac916cdc62da3c492928d8eab187_amd64 as a component of RHOL 5.6 for RHEL 8
  • openshift-logging/elasticsearch-rhel8-operator@sha256:34a393916466f1d4544cbe4d75936147c4bfc4e0246bee0faebc5c285f26d30d_arm64 as a component of RHOL 5.6 for RHEL 8
  • openshift-logging/elasticsearch-rhel8-operator@sha256:358c663dbc3c6b0ee31a4b2665c79ff7b826ba6b72c21db62d186a6da09b04c4_ppc64le as a component of RHOL 5.6 for RHEL 8
  • openshift-logging/elasticsearch-rhel8-operator@sha256:7a9678d49d25ec0afbcab3c98a3d26d2eeda04a0ece3a833d91dde818f0dde22_s390x as a component of RHOL 5.6 for RHEL 8
  • openshift-logging/elasticsearch6-rhel8@sha256:8e62859531fcb8dd6b054a76c4bc95b62ff62bcbe69fe18f132689a203168bc8_s390x as a component of RHOL 5.6 for RHEL 8
  • openshift-logging/elasticsearch6-rhel8@sha256:92ab2dde35f2f59c3a8ce7b8b12f5703a7a214e83ca5cc13673d0c8ad373f02e_amd64 as a component of RHOL 5.6 for RHEL 8
  • openshift-logging/elasticsearch6-rhel8@sha256:caeeb679701abcbb9612b77ef0975575cf31c96b74bfc06553d61140a3f52bb7_ppc64le as a component of RHOL 5.6 for RHEL 8
  • openshift-logging/elasticsearch6-rhel8@sha256:cd9a57aad90fdec4fef3b0f9b31df96c12bd7fe97cad90f9a1de79e6b0af4bbb_arm64 as a component of RHOL 5.6 for RHEL 8
  • openshift-logging/eventrouter-rhel8@sha256:b822207e2e70c989cf98d9e5a810e85034a8a1fd2130451e525ce4a804dd1727_s390x as a component of RHOL 5.6 for RHEL 8
  • openshift-logging/eventrouter-rhel8@sha256:ec56cae824197805c3287f57854343d2d26caa0b192a009c966d28c32f0d0d92_ppc64le as a component of RHOL 5.6 for RHEL 8
  • openshift-logging/eventrouter-rhel8@sha256:fc638d1f8ff0f079ea1f5cfa3a9938dc06374ca4e6cd24f92ba62b7d03fd6963_arm64 as a component of RHOL 5.6 for RHEL 8
  • openshift-logging/eventrouter-rhel8@sha256:ff509532db6b7e2d3a44fac2cf9b63687aa8bfbaab46d7a5f9d58be192475818_amd64 as a component of RHOL 5.6 for RHEL 8
  • openshift-logging/fluentd-rhel8@sha256:149d75b8f4f523c86122176935c63b96305f6eb308e74eea9fa6651c8e75d239_amd64 as a component of RHOL 5.6 for RHEL 8
  • openshift-logging/fluentd-rhel8@sha256:3038086e3dbfab1e3070cdeeb7968e863ab4b1012d161ed263e93b153ae2223b_s390x as a component of RHOL 5.6 for RHEL 8
  • openshift-logging/fluentd-rhel8@sha256:816908f1ac923336e8e3b87129af40271bde545e12b3385186425038f1b14991_arm64 as a component of RHOL 5.6 for RHEL 8
  • openshift-logging/fluentd-rhel8@sha256:e489da61d05557fba2718fd3e75b7ba50c51c173f43088334db7f3c993748711_ppc64le as a component of RHOL 5.6 for RHEL 8
  • openshift-logging/kibana6-rhel8@sha256:0958ffa84bed51e99177837ac672324e5a8c1b20535d8110a3bbabe3f952073e_ppc64le as a component of RHOL 5.6 for RHEL 8
  • openshift-logging/kibana6-rhel8@sha256:0c4ea44d09b21a915c3ecc17c9a50ba22d71ed06b0cc4ba1d8bfbe1ced426e47_arm64 as a component of RHOL 5.6 for RHEL 8
  • openshift-logging/kibana6-rhel8@sha256:20b6b6aef51ef6cabe133e53dcc1d6665ff8fae0fab4d56ecd6998ca88554773_s390x as a component of RHOL 5.6 for RHEL 8
  • +34 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2. Workaround: Users are strongly urged to update their software as soon as fixes are available. There are several mitigation approaches for this flaw. 1. If circumstances permit, users may disable http2 endpoints to circumvent the flaw altogether until a fix is available. 2. IP-based blocking or flood protection and rate control tools may be used at network endpoints to filter incoming traffic. 3. Several package specific mitigations are also available. a. nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ b. netty: https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p c. haproxy: https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487 d. nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg e. golang: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (12)