RHSA-2023:5951HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift Service Mesh for 2.3.8 security update

Published
October 19, 2023
Last Modified
August 2, 2026

🔗 CVE IDs covered (1)

CVE-2023-39325 →

📋 Description

CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

🎯 Affected products25

  • RHOSSM 2.3 for RHEL 8
  • openshift-service-mesh/grafana-rhel8@sha256:4e67414dfcc88b3f94dca8ee7fe62d03ac3d138b18f5f6574713dc9bb809d3ff_s390x as a component of RHOSSM 2.3 for RHEL 8
  • openshift-service-mesh/grafana-rhel8@sha256:66bdf543e17fe026a5b720087682d33a492a84bfd5b3c717fbbc30535a6a4c4d_ppc64le as a component of RHOSSM 2.3 for RHEL 8
  • openshift-service-mesh/grafana-rhel8@sha256:f29b28ae92405e632bf63dbb6566c04073a62ef446ea9bca584265a8f3353013_amd64 as a component of RHOSSM 2.3 for RHEL 8
  • openshift-service-mesh/istio-cni-rhel8@sha256:344e639a1b16c36a70d09e4d10f6a1ab4804f01de8ff3bd6c60d1030a8090911_amd64 as a component of RHOSSM 2.3 for RHEL 8
  • openshift-service-mesh/istio-cni-rhel8@sha256:750f4b83ce44dd47d27439e087611e3c399710ebb0ea33765b3c83182d18e396_ppc64le as a component of RHOSSM 2.3 for RHEL 8
  • openshift-service-mesh/istio-cni-rhel8@sha256:d7152f40deaa38d416cd653455ac20b802490f84bc79024f54956a380bb02055_s390x as a component of RHOSSM 2.3 for RHEL 8
  • openshift-service-mesh/istio-must-gather-rhel8@sha256:2427a853c9389bb114156fa27486d212ccd78de225f4142e5532842e253d9c37_amd64 as a component of RHOSSM 2.3 for RHEL 8
  • openshift-service-mesh/istio-must-gather-rhel8@sha256:b6cd43ff321e7f85117b3bf03917a4482b1407b902969b4bf9eb1df5deae5c61_s390x as a component of RHOSSM 2.3 for RHEL 8
  • openshift-service-mesh/istio-must-gather-rhel8@sha256:d76e482f8630a923c7242a594d213456e03cfafd60c46b13d45b54feae948f10_ppc64le as a component of RHOSSM 2.3 for RHEL 8
  • openshift-service-mesh/kiali-rhel8@sha256:2cabeb129d785a02781cf55f7f2d51ab61803aeceab8631f629ea28d67e87619_amd64 as a component of RHOSSM 2.3 for RHEL 8
  • openshift-service-mesh/kiali-rhel8@sha256:32413bff489fcc1bee1429f7961afc952a7ee14dc85c9be09595bd904748c351_ppc64le as a component of RHOSSM 2.3 for RHEL 8
  • openshift-service-mesh/kiali-rhel8@sha256:ceb2befd459e5d0dbe11d8bf7f5300ea22e652c470d03527a67889aede1727cc_s390x as a component of RHOSSM 2.3 for RHEL 8
  • openshift-service-mesh/pilot-rhel8@sha256:7c8cc5ef1661c3251218c018ac22d12ef01d5131c97f892b56e73e7bc156e191_amd64 as a component of RHOSSM 2.3 for RHEL 8
  • openshift-service-mesh/pilot-rhel8@sha256:dbdcbcc8418a1e72b5334e3d44a2335f83c8e7f9fe81be75ab4d0590ec3fd771_ppc64le as a component of RHOSSM 2.3 for RHEL 8
  • openshift-service-mesh/pilot-rhel8@sha256:fd3c33346c04944302b8bb4a17a271f5d972477cbe7ccfe6b4a2978cade0471d_s390x as a component of RHOSSM 2.3 for RHEL 8
  • openshift-service-mesh/prometheus-rhel8@sha256:806004d0539858a2186d68044f2e745a317de9f1ebc2b2b62bc2090fec5ad246_amd64 as a component of RHOSSM 2.3 for RHEL 8
  • openshift-service-mesh/prometheus-rhel8@sha256:c6e94904608cbb391c0ffb2a8822141137f17c0278edc2d0272cadb80e905dd3_ppc64le as a component of RHOSSM 2.3 for RHEL 8
  • openshift-service-mesh/prometheus-rhel8@sha256:f6a56e4cf0ede7181179dcbb76bfc01cecb70b8888abc0366b0a7fd5c70d29c9_s390x as a component of RHOSSM 2.3 for RHEL 8
  • openshift-service-mesh/proxyv2-rhel8@sha256:087c8e702374130c2b615a094be1c0b9b8f317e9266c8b8b4d043449d2cb64d9_amd64 as a component of RHOSSM 2.3 for RHEL 8
  • openshift-service-mesh/proxyv2-rhel8@sha256:983e1408faa6fc6a7f5494b817fe35fd67e897a0d06e206a0e6a931df92d7be7_s390x as a component of RHOSSM 2.3 for RHEL 8
  • openshift-service-mesh/proxyv2-rhel8@sha256:a4995e0d3dd1670c973df461230df237151b385a91a67dfe6f671fae77d2b9e2_ppc64le as a component of RHOSSM 2.3 for RHEL 8
  • openshift-service-mesh/ratelimit-rhel8@sha256:3d49622cf676691f77379b8aae6622297ff2ac8e0a1e1031dd94d531fcc0613d_s390x as a component of RHOSSM 2.3 for RHEL 8
  • openshift-service-mesh/ratelimit-rhel8@sha256:8c893e92950f88e4bad45a278b12570d5e91f6e28b038f0f30778d6b3f11a3e4_ppc64le as a component of RHOSSM 2.3 for RHEL 8
  • openshift-service-mesh/ratelimit-rhel8@sha256:b47bafddc9df4e933ee3cc620b87bc1fef140455fde9329c642850836d6b760d_amd64 as a component of RHOSSM 2.3 for RHEL 8

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (7)