RHSA-2023:5950HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift Service Mesh for 2.2.11 security update

Published
October 19, 2023
Last Modified
August 2, 2026

🔗 CVE IDs covered (1)

CVE-2023-39325 →

📋 Description

CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

🎯 Affected products25

  • RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/grafana-rhel8@sha256:7f58375b39ee7ed44fb1bd351f55057929fe94cc973cfae52336a3a23245308a_amd64 as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/grafana-rhel8@sha256:8c32a706594a914ea07519d8b8181af80d7d63f8ae16cdff00552e9bde3e04a4_s390x as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/grafana-rhel8@sha256:a43e967f356eb8c3dfa082752045b4f3d3e4accaf539825487c3d9dc222e89be_ppc64le as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/istio-cni-rhel8@sha256:1be9910498fad81c5f75b549888a1848a72025de76c7077319d88c2c01810307_amd64 as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/istio-cni-rhel8@sha256:3acabc42f763763a0dd787b847b95cc851cfe1e8d0ef23e29149a406c926a5f1_ppc64le as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/istio-cni-rhel8@sha256:a22df732e77a5352f63c9043dc07d0ebc21aa13322d809d36c23967a748671bd_s390x as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/istio-must-gather-rhel8@sha256:1d4de29ba184fba74c0a20228f02731480e08804f173f04e1c23dba55811de32_ppc64le as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/istio-must-gather-rhel8@sha256:6a32af0e0ea904a63369444e1de9075941cda6268b6c1f3e129a2aafb2892efb_amd64 as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/istio-must-gather-rhel8@sha256:8c93aafd4c2424e8cf5065aca72eae6b4fd13c701deccaa37f1c4bf241802dae_s390x as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/kiali-rhel8@sha256:957d12face152b24cf0dfbb965b3091ea75eb968e1041079986ac84ca39ed076_amd64 as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/kiali-rhel8@sha256:d9dd763fbb43bd1db2b5c59a921b532d898dd2029c2d149fc6a3839546b30ed5_ppc64le as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/kiali-rhel8@sha256:e24e22e9155184d5140fb3bbea77ac91908505796f55811b4800e75445f7a20e_s390x as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/pilot-rhel8@sha256:1233216c4378bcf01dc9673856d34439ad254f3fcdc1acb584d6abe4de550da8_amd64 as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/pilot-rhel8@sha256:319e5911c349cd8613d6a8b429b9402a7cebfcd0d7175e0bef449f0eb305643b_ppc64le as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/pilot-rhel8@sha256:7a2cca59e90e285eccf4f0b46786c0e653dd803091a35c3a751d12bcffe8c817_s390x as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/prometheus-rhel8@sha256:4a9dcc95179300d844f62e30f667965e62a86a850fd3417f422d2f72d5a8ccf5_amd64 as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/prometheus-rhel8@sha256:5b4a6cfe137c2fc858609f5e0bd3305cd0c8f4ad054d601f603b9d39ce335144_s390x as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/prometheus-rhel8@sha256:f1975242cf74fe2d6ab0908e04e4ea5b33c32e09112b7ef58640436e677ac9b9_ppc64le as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/proxyv2-rhel8@sha256:23478091aeaeb3d161af0925a9b51d8b9684d08e3b3ce28f46c922c99d454b43_s390x as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/proxyv2-rhel8@sha256:7d529995fe3512ce543cc612717c8c7af34a57447620e5abd749de0456a30a47_amd64 as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/proxyv2-rhel8@sha256:b429f0c68834e5e6dd95e9b9396980ed789302e3ab756decf00a18d9bc94a74b_ppc64le as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/ratelimit-rhel8@sha256:0917002c2854e6161df80644db34e7908fd9522e56ab1a8e8865d0f4859c8880_amd64 as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/ratelimit-rhel8@sha256:e99c2da16e42573a7684c7a36ba5eafbc58101ce25c321602bac9926f37a5a28_s390x as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/ratelimit-rhel8@sha256:f230fe266302fde1ec9e793e8598d34a8e6814ee1641eacfb526cf67badd6642_ppc64le as a component of RHOSSM 2.2 for RHEL 8

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (6)