RHSA-2023:5952HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift Service Mesh for 2.4.4 security update

Published
October 19, 2023
Last Modified
August 24, 2026

🔗 CVE IDs covered (3)

CVE-2021-32760 →CVE-2023-26054 →CVE-2023-39325 →

📋 Description

CVE-2021-32760 — containerd: pulling and extracting crafted container image may result in Unix file permission changes CVE-2023-26054 — buildkit: Data disclosure in provenance attestation describing a build CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

🎯 Affected products37

  • RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/grafana-rhel8@sha256:16bd0b018e8963d4ae6d7de1a708957df32b3742c7f17332307d49e2a27c6f89_s390x as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/grafana-rhel8@sha256:1748793c68ec25241a013f174ff8e23216f7423f0ec7c2993e0caf014645769e_ppc64le as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/grafana-rhel8@sha256:63ca6224c3093d46d11560f9da7fec7d678d6e8a7ceac1affdcca5c42ac515ae_amd64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/grafana-rhel8@sha256:a38e77c4fed992fa7333cecb0da33c37eb258b733646b2126a74abf26fe05463_arm64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/istio-cni-rhel8@sha256:7aac4c38673741ca0bdc2ea79c04462ae58b1721f6b7cfbaf3105ebbbea01b70_ppc64le as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/istio-cni-rhel8@sha256:a02b2316e1f1c5728602050222927845d909665050eb72d939ae23150e621f81_amd64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/istio-cni-rhel8@sha256:cc74f8b7aa9fefd2f01f8dbf5a7a5d40d1665d0e38981db034727ecca0546a4f_s390x as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/istio-cni-rhel8@sha256:f0cedac077b6b8722c4dcc92d2fdbff1f4c7d39ed9726f8f5bd391702c5d8bf1_arm64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/istio-must-gather-rhel8@sha256:25ae7e232a09401ec0a723d851ce18b9f2ec6c7483ee7752b3bf2ff282faf042_amd64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/istio-must-gather-rhel8@sha256:756587b46c3153f7c142a2b8d7652bc3904f907a2e3a2ea2ba3ed19a2e57c761_s390x as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/istio-must-gather-rhel8@sha256:a88f990d3f7b9deecafb830a73e8a96ff4fd8fd3d3eda119eddc6fa73ee57716_ppc64le as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/istio-must-gather-rhel8@sha256:bd5219b2280e0c26e25f270aea1194b6d22f34d9b003a8b31b2bb578be055411_arm64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/istio-rhel8-operator@sha256:0ebfeced4b015fd7fbf8f22fe011f65045a37d8931ddd9a7a5edf9c1bc07b9eb_ppc64le as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/istio-rhel8-operator@sha256:1a91f1785414e7adb5ce7056eb0767c0fea4e8c3f266bb4d126987fe6d69f1db_arm64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/istio-rhel8-operator@sha256:2065d9d04eed3ec4bb67557692adc02250d6a66a04478562883932204036e603_s390x as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/istio-rhel8-operator@sha256:58d727f8226552a988b037709731aa05f72781bd2a025cf6f777dc0c9151e06e_amd64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/kiali-rhel8-operator@sha256:011b879576fe0f0fc3d8dd9eb8b0748ba2b6f938b487fc91c3b594ea0a8d13d6_arm64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/kiali-rhel8-operator@sha256:2dcb1f61e124e769bc4088be99a9b2609706004869e7532d0b7f69a967294f9a_ppc64le as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/kiali-rhel8-operator@sha256:d905ae2fb3756f342317e62c195a07ed84bd02b39e75971b3de3ecdad18e017a_s390x as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/kiali-rhel8-operator@sha256:efe543762053890aa8b627ba4dafb6a3820b8fd6e8a2bb0cc76b8997035ae4d9_amd64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/kiali-rhel8@sha256:11d69d75236df90918ba030d00806939c4b2d6998a8d6d73d71d764042e01358_amd64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/kiali-rhel8@sha256:9faf9a44ab318f14fa2dab4994112a0df657affa80ce40499c35a88b596a44b6_s390x as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/kiali-rhel8@sha256:c77aec7474d57257b6f75007f9411dcee4e6d4f90149b1625fab2601ea5a5924_ppc64le as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/kiali-rhel8@sha256:d7c9c06e7a10026c991c58e3e69de0707315493c988a563af0ca1808eff8443b_arm64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/pilot-rhel8@sha256:42ee3b2fcfca713d836e3ca977acbf4c9cddde15095b21d173bacc9445b1a0ea_s390x as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/pilot-rhel8@sha256:6554054dd70a3f7720c08aa9d9a9fd537b9c2034fa4faa3259ecc6f93e88a6e7_ppc64le as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/pilot-rhel8@sha256:69015bb4efdbbc25ce6561370ee19e48e96fbb70ce89ff98c3bb975c0d0c694c_arm64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/pilot-rhel8@sha256:c3dc9de0e2466b0566bf7ebe2c5a5d79740655e64334fbd3b4677da9e8b6569b_amd64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/proxyv2-rhel8@sha256:1fce71e399a6c093adc2348f1ce4c63daf64bc8485abaafd77b17baad9955417_s390x as a component of RHOSSM 2.4 for RHEL 8
  • +7 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (14)