RHSA-2023:6085HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift distributed tracing security update

Published
October 24, 2023
Last Modified
September 22, 2026

🔗 CVE IDs covered (8)

CVE-2023-39322 →CVE-2023-39325 →CVE-2023-44487 →CVE-2023-29406 →CVE-2023-29409 →CVE-2023-39318 →CVE-2023-39319 →CVE-2023-39321 →

📋 Description

CVE-2023-29406 — golang: net/http: insufficient sanitization of Host header CVE-2023-29409 — golang: crypto/tls: slow verification of certificate chains containing large RSA keys CVE-2023-39318 — golang: html/template: improper handling of HTML-like comments within script contexts CVE-2023-39319 — golang: html/template: improper handling of special tags within script contexts CVE-2023-39321 — golang: crypto/tls: panic when processing post-handshake message on QUIC connections CVE-2023-39322 — golang: crypto/tls: lack of a limit on buffered post-handshake CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) CVE-2023-44487 — HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

🎯 Affected products55

  • Red Hat OpenShift distributed tracing 2.9
  • rhosdt/jaeger-agent-rhel8@sha256:075e5a497bd37954221774f3b0e97a86f87bf9a8564a87fa8269b2acb01a5fdf_s390x as a component of Red Hat OpenShift distributed tracing 2.9
  • rhosdt/jaeger-agent-rhel8@sha256:5667bbe8cdf5ef5b93fe2eb51af1b03ac25db50ee7f13a35e97c67968f70d9bc_amd64 as a component of Red Hat OpenShift distributed tracing 2.9
  • rhosdt/jaeger-agent-rhel8@sha256:b57f6bbb0fd714828d0b9bf4759a04cad8ba98db394dbb79d8a5a9d2c48a8383_ppc64le as a component of Red Hat OpenShift distributed tracing 2.9
  • rhosdt/jaeger-all-in-one-rhel8@sha256:21de0110a12e568d4fa9a814b1f3fb79b132be34770f795c6f43922a454bba34_ppc64le as a component of Red Hat OpenShift distributed tracing 2.9
  • rhosdt/jaeger-all-in-one-rhel8@sha256:3555c97e1edbc18ecc7ad756dae043a55215bcacd31e70a41c3e444a4b5bac98_s390x as a component of Red Hat OpenShift distributed tracing 2.9
  • rhosdt/jaeger-all-in-one-rhel8@sha256:dd221ad03daa551a30a5b3631b9a489ab29147f4d0d380f317ee6e8999c5638f_amd64 as a component of Red Hat OpenShift distributed tracing 2.9
  • rhosdt/jaeger-collector-rhel8@sha256:20dfc6ffe41e4dceb854a2fa99cad5d6a9b48e8bfc51329fed767f47b7cb461f_ppc64le as a component of Red Hat OpenShift distributed tracing 2.9
  • rhosdt/jaeger-collector-rhel8@sha256:9551931c00cc1052ddb32310153352d56c70a50826c29bcee53fc048c6995399_amd64 as a component of Red Hat OpenShift distributed tracing 2.9
  • rhosdt/jaeger-collector-rhel8@sha256:a3224c5e1b39ca4a33f806a5930dd37304578420f382c43158ee290fffd21533_s390x as a component of Red Hat OpenShift distributed tracing 2.9
  • rhosdt/jaeger-es-index-cleaner-rhel8@sha256:699727f91948e7a870cdae3f8d3cf88cdf1df934ea6c4e5e1a86467b7ea62da3_amd64 as a component of Red Hat OpenShift distributed tracing 2.9
  • rhosdt/jaeger-es-index-cleaner-rhel8@sha256:6c1435712a36384a562448ec972ac39378b1e976490146cda1c98b510c76d849_s390x as a component of Red Hat OpenShift distributed tracing 2.9
  • rhosdt/jaeger-es-index-cleaner-rhel8@sha256:c53876745a6ae8a8ca6ec74d22f8cae148cf4b99e45c3efdcca323b6fbb4ad0e_ppc64le as a component of Red Hat OpenShift distributed tracing 2.9
  • rhosdt/jaeger-es-rollover-rhel8@sha256:0b0b4bb1d943449bbfe99653eb918583b38e6e7fc9317653acf487bb33715fcf_amd64 as a component of Red Hat OpenShift distributed tracing 2.9
  • rhosdt/jaeger-es-rollover-rhel8@sha256:8bfdcdb4432975726865d321037b600260c4df1b3a1811d1c85523d61e91bccc_ppc64le as a component of Red Hat OpenShift distributed tracing 2.9
  • rhosdt/jaeger-es-rollover-rhel8@sha256:fbce2ceb4a0c5231823c931b87726b7a6a5e5f0c87ba93abad09acb11661a675_s390x as a component of Red Hat OpenShift distributed tracing 2.9
  • rhosdt/jaeger-ingester-rhel8@sha256:0d7c0ff5a6c0e645856e1550bfb8acea763d013e4b706b7da972094c26d8a3ba_ppc64le as a component of Red Hat OpenShift distributed tracing 2.9
  • rhosdt/jaeger-ingester-rhel8@sha256:27b6554e746eae26692298e78d623b3b7dc6ba53330c5e398beacd8d41512732_amd64 as a component of Red Hat OpenShift distributed tracing 2.9
  • rhosdt/jaeger-ingester-rhel8@sha256:498a6186790b5e8dc2ff8bc49f5a163a51b19ee36c5030b6ae44fd0c1dbe4139_s390x as a component of Red Hat OpenShift distributed tracing 2.9
  • rhosdt/jaeger-operator-bundle@sha256:1a5c829466a50a4ed1b509fa83b1ffacb5290840e64c1f805e462c533a26c075_s390x as a component of Red Hat OpenShift distributed tracing 2.9
  • rhosdt/jaeger-operator-bundle@sha256:1bbbe479ae64cb639bde227e52bb60c55a855fed9109c0ba850e2b1474c8cf5d_ppc64le as a component of Red Hat OpenShift distributed tracing 2.9
  • rhosdt/jaeger-operator-bundle@sha256:f2ebe6b3b913ae5d0df0b985d4c2a93fc0f9dd90e97cdc2d39fdbb40a92c494a_amd64 as a component of Red Hat OpenShift distributed tracing 2.9
  • rhosdt/jaeger-query-rhel8@sha256:40183936d78c62c1b34807bf21c6fa3570ab5a4c3fdcf2c708b6e2225addf88d_ppc64le as a component of Red Hat OpenShift distributed tracing 2.9
  • rhosdt/jaeger-query-rhel8@sha256:db25d6492ba18bf18fe8f63c86a9d565938da15c7c639b77d6b9285db0174094_amd64 as a component of Red Hat OpenShift distributed tracing 2.9
  • rhosdt/jaeger-query-rhel8@sha256:ebc33a6ada6c578e6b113bdfa3e0a9570f15e75cb3e87fa99a3ec23056d58f02_s390x as a component of Red Hat OpenShift distributed tracing 2.9
  • rhosdt/jaeger-rhel8-operator@sha256:17b698d2b2bde4985346b6ffe28c4b0a71e0a6fec4937144aef5db4ca20f60e4_s390x as a component of Red Hat OpenShift distributed tracing 2.9
  • rhosdt/jaeger-rhel8-operator@sha256:c3b11d9f4e98457310bd5a2a782ef02c85dabd0a97e954a5c385f648e168b9ba_amd64 as a component of Red Hat OpenShift distributed tracing 2.9
  • rhosdt/jaeger-rhel8-operator@sha256:e4722e3dbb65c43212e1f86bf5b24779879288a9044d57f2c33aed5baf1b2d33_ppc64le as a component of Red Hat OpenShift distributed tracing 2.9
  • rhosdt/opentelemetry-collector-rhel8@sha256:97a23c3fdf791b59df6bc6e6f9311599ba2f3900aebe64ce4eaf8f77a7f76336_ppc64le as a component of Red Hat OpenShift distributed tracing 2.9
  • rhosdt/opentelemetry-collector-rhel8@sha256:b9f94f8023b1e904e874ff67b5829c3c0e0a44aaeda6e88f8f34fa92d5f8a62c_amd64 as a component of Red Hat OpenShift distributed tracing 2.9
  • +25 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2. Workaround: Users are strongly urged to update their software as soon as fixes are available. There are several mitigation approaches for this flaw. 1. If circumstances permit, users may disable http2 endpoints to circumvent the flaw altogether until a fix is available. 2. IP-based blocking or flood protection and rate control tools may be used at network endpoints to filter incoming traffic. 3. Several package specific mitigations are also available. a. nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ b. netty: https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p c. haproxy: https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487 d. nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg e. golang: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (12)