RHSA-2023:5851HighCVSS 7.5

Red Hat Security Advisory: RHACS 4.1 enhancement and security update

Published
October 18, 2023
Last Modified
September 14, 2026

🔗 CVE IDs covered (2)

CVE-2023-39325 →CVE-2023-44487 →

📋 Description

CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) CVE-2023-44487 — HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

🎯 Affected products34

  • RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-central-db-rhel8@sha256:01bd7d0eb01bbccaedb4bd874f9d25ec1de15b6ffa7d9afa772c633c901b4d19_ppc64le as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-central-db-rhel8@sha256:bed6dd0b095914635cc4c7492e7c7f312bc84138df4dbb63ce632835697da1eb_amd64 as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-central-db-rhel8@sha256:f92672857754ee0baad0e17802ec23aa3f14e11dce65b59f60a8002a21987c75_s390x as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-collector-rhel8@sha256:192562d3cc181ff2cc14b9bf7202dd1b09c3d25c3308154d3878834c42139b8a_s390x as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-collector-rhel8@sha256:2168e357d9d8b663595aefd49434fa7b87e3dcb5dfb1aa9cceeddf656d89436f_ppc64le as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-collector-rhel8@sha256:9974f6a4a1e0a9409fc5fee5addbc58ecafda1fd34231f2ac4b2972fbdbb422b_amd64 as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:39b9d467f3b5fc5813fc2b2a27e187b62673817d98ce496a5f35551046110ed1_ppc64le as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:6de4dae7bd8e1cae0bcf98e76380f10ce23e2d7868eac7189c5be44fb370c65b_s390x as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:ec6d6c5af603b2ca083e7a7600680e3e121daedc43c53b4c0c760463fc5e569c_amd64 as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-main-rhel8@sha256:0165f336652e61518f87398d395766f408e372f1487026e6e06c5dd37e6cca24_s390x as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-main-rhel8@sha256:2d91c9e119a9c6f69f5f6b44fd54cdb89a255a1f831c14c0346291a085cf1255_amd64 as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-main-rhel8@sha256:70119ac2a99ae2b42a84f18d5dfc5a719ffd183a2c6587fd2654e17b207cbaa7_ppc64le as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-operator-bundle@sha256:54e95a79b10a119472b6ef0351ff878e6a384b8e3100d25e943678bb120ed322_amd64 as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-operator-bundle@sha256:594533fdc64148e9222d6a1bfaa2ac9c912478161035b2aadb3161e6a6c7de71_s390x as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-operator-bundle@sha256:f996eaff3c93ae2a0589c038358da2932d85f7642289e6b5cc63e87af130e0f2_ppc64le as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-rhel8-operator@sha256:38933d28d8f623e8e421708f34a56e42cddd66b09c77b90ba7d0bab1ee10e6a6_amd64 as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-rhel8-operator@sha256:564a8cbb9da8f2daab1d4163a4dfffdb2fadf87808cee3d4cc0ca210cf37801c_ppc64le as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-rhel8-operator@sha256:62be9d1228353bb890192444a8f79aa10afa9acf57b6fbae49e6751d4355eced_s390x as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-roxctl-rhel8@sha256:356142a0cef442132a39383a807ff74c6cad931071c45f44e1f7a794accf7ed1_ppc64le as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-roxctl-rhel8@sha256:ad51e30709c6b9f4350473b72eed6f0cb037f41f08c675ad7868cc70462513ae_amd64 as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-roxctl-rhel8@sha256:e3088b93eaf3e6114ec3706f4a86cf9a1135a19b2b9274ccd5a47d4d530d5ead_s390x as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:024076d8e8f8759397d35ccf6d7e23c72e301d9ac76f9f3783802306412b6e82_ppc64le as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:16c06f7d13b140eace33c92e4de25080a369fb8cb07e8cd37dab1c77e20b98dc_s390x as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:6455831309117beb15181b443ca8f43c42b296798f9deaae25f5e180ef67f68e_amd64 as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:505df709de90a7c86795312064564df6365d2150ee4536332c5896f767c7dd26_s390x as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:784f6bd4459fe4ba58dba416fcd4ad259ad71d15afef167d3331e43063813e0c_amd64 as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:f3c15fec3acb45f2b026820460c4be9b6d13fd2d5f10b0b7ddd8692971b2201b_ppc64le as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-scanner-rhel8@sha256:86a79d36cdbdeccd47fd477ea503b859b068a168ec95c4a44c2784300c1dc036_amd64 as a component of RHACS 4.1 for RHEL 8
  • advanced-cluster-security/rhacs-scanner-rhel8@sha256:8ec71419eb15e2fc5300fdc7bcab0422bd0c467d718a0a37568b80df4272a0ff_ppc64le as a component of RHACS 4.1 for RHEL 8
  • +4 more not shown

✅ Remediation

If you are using an earlier version of RHACS 4.1, you are advised to upgrade to patch release 4.1.4. Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2. Workaround: Users are strongly urged to update their software as soon as fixes are available. There are several mitigation approaches for this flaw. 1. If circumstances permit, users may disable http2 endpoints to circumvent the flaw altogether until a fix is available. 2. IP-based blocking or flood protection and rate control tools may be used at network endpoints to filter incoming traffic. 3. Several package specific mitigations are also available. a. nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ b. netty: https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p c. haproxy: https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487 d. nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg e. golang: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (7)