RHSA-2023:5976HighCVSS 7.5

Red Hat Security Advisory: Service Telemetry Framework 1.5.2 security update

Published
October 20, 2023
Last Modified
August 24, 2026

🔗 CVE IDs covered (7)

CVE-2023-24534 →CVE-2023-29406 →CVE-2023-29409 →CVE-2023-39325 →CVE-2023-44487 →CVE-2022-41724 →CVE-2023-24532 →

📋 Description

CVE-2022-41724 — golang: crypto/tls: large handshake records may cause panics CVE-2023-24532 — golang: crypto/internal/nistec: specific unreduced P-256 scalars produce incorrect results CVE-2023-24534 — golang: net/http, net/textproto: denial of service from excessive memory allocation CVE-2023-29406 — golang: net/http: insufficient sanitization of Host header CVE-2023-29409 — golang: crypto/tls: slow verification of certificate chains containing large RSA keys CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) CVE-2023-44487 — HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

🎯 Affected products8

  • Service Telemetry Framework 1.5 for RHEL 8
  • stf/prometheus-webhook-snmp-rhel8@sha256:e261f596dc4f13cf45981d4415cb17d0314c66ad105b5aa31898f7364185233b_amd64 as a component of Service Telemetry Framework 1.5 for RHEL 8
  • stf/service-telemetry-operator-bundle@sha256:583b8fc7bd18b79b146274c0b6ca0e8ebc14e7dfb389bd2a01fcf18744ab7d40_amd64 as a component of Service Telemetry Framework 1.5 for RHEL 8
  • stf/service-telemetry-rhel8-operator@sha256:627b664de828007e469d329253e50ff91cea19ead36353d11d313b6692913d07_amd64 as a component of Service Telemetry Framework 1.5 for RHEL 8
  • stf/sg-bridge-rhel8@sha256:1725eae2e4232e99412c73e6e4b6eabab8f8ce7f13e2106701974c5cfeeb5830_amd64 as a component of Service Telemetry Framework 1.5 for RHEL 8
  • stf/sg-core-rhel8@sha256:d870784a543045e6b14519df1658864fa0ea22885465bd6630232aeaa1f9ee7e_amd64 as a component of Service Telemetry Framework 1.5 for RHEL 8
  • stf/smart-gateway-operator-bundle@sha256:f8bb700696897363678fcd0ce466fd9e9ffcddad263476a42673d516724b9767_amd64 as a component of Service Telemetry Framework 1.5 for RHEL 8
  • stf/smart-gateway-rhel8-operator@sha256:9c3256a9e48b535413e4a4633d1404adbea0239c644569032cd63f991c5051ec_amd64 as a component of Service Telemetry Framework 1.5 for RHEL 8

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2. Workaround: Users are strongly urged to update their software as soon as fixes are available. There are several mitigation approaches for this flaw. 1. If circumstances permit, users may disable http2 endpoints to circumvent the flaw altogether until a fix is available. 2. IP-based blocking or flood protection and rate control tools may be used at network endpoints to filter incoming traffic. 3. Several package specific mitigations are also available. a. nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ b. netty: https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p c. haproxy: https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487 d. nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg e. golang: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (11)