RHSA-2023:6115HighCVSS 7.5

Red Hat Security Advisory: OpenShift API for Data Protection security update

Published
October 25, 2023
Last Modified
September 22, 2026

🔗 CVE IDs covered (8)

CVE-2023-39321 →CVE-2023-39322 →CVE-2023-39325 →CVE-2023-44487 →CVE-2023-29406 →CVE-2023-29409 →CVE-2023-39318 →CVE-2023-39319 →

📋 Description

CVE-2023-29406 — golang: net/http: insufficient sanitization of Host header CVE-2023-29409 — golang: crypto/tls: slow verification of certificate chains containing large RSA keys CVE-2023-39318 — golang: html/template: improper handling of HTML-like comments within script contexts CVE-2023-39319 — golang: html/template: improper handling of special tags within script contexts CVE-2023-39321 — golang: crypto/tls: panic when processing post-handshake message on QUIC connections CVE-2023-39322 — golang: crypto/tls: lack of a limit on buffered post-handshake CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) CVE-2023-44487 — HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

🎯 Affected products37

  • 8Base-OADP-1.1
  • oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:1d9eb04551c7629c1c955a83f56c9950af52cf507a960673fbbb71bc53a45d42_amd64 as a component of 8Base-OADP-1.1
  • oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:a107558ebc95b2d1c57a3571491bbf6ec88921ca8e6e45419dbec9bf47d505b9_ppc64le as a component of 8Base-OADP-1.1
  • oadp/oadp-kubevirt-velero-plugin-rhel8@sha256:ca91eab699f97705c3e696150446582caab5b97db9230c0a2a7d0b9e09a7c571_s390x as a component of 8Base-OADP-1.1
  • oadp/oadp-mustgather-rhel8@sha256:2d68a7b0030a673d88d59d712352614f136704fc95a5523484eea11eeeb76619_s390x as a component of 8Base-OADP-1.1
  • oadp/oadp-mustgather-rhel8@sha256:d2ea8cc469b9bc2cb99dc81ef1c8c043ef7d4c320b588f7bf1e221807767a21c_amd64 as a component of 8Base-OADP-1.1
  • oadp/oadp-mustgather-rhel8@sha256:f4db0cbe93b098c3e73e65bf83cdd73214e6eb9894a5d1d42d0f5fd58162a750_ppc64le as a component of 8Base-OADP-1.1
  • oadp/oadp-operator-bundle@sha256:7381cf4462e525945055a1b2b0bf168d469d2bd3f67bb10f6c8cb13e58fa9569_ppc64le as a component of 8Base-OADP-1.1
  • oadp/oadp-operator-bundle@sha256:a709259c3a6d923485ed217e9dd74f11c02a32c113f017ebbd8c49d60c83c47b_amd64 as a component of 8Base-OADP-1.1
  • oadp/oadp-operator-bundle@sha256:f6e549d662f01f8ccf0c1ab9016b1aadcd417096bc49133a536292c55049c13a_s390x as a component of 8Base-OADP-1.1
  • oadp/oadp-rhel8-operator@sha256:0f7a9f47f67af388ebebb7ef28a775857ac37d35e234ee228a4ea25bfc64c3e3_ppc64le as a component of 8Base-OADP-1.1
  • oadp/oadp-rhel8-operator@sha256:2d3e387f50011ea9496e7524624100afb1e5eb9aeb220c971ac850e3d3fb3ecd_s390x as a component of 8Base-OADP-1.1
  • oadp/oadp-rhel8-operator@sha256:bf0607d865944a9011852bcbd92d2f289f4086aba2186331ab4a65c7bd065604_amd64 as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-plugin-for-aws-rhel8@sha256:9bc0630106402a86da33e4a21c5d64c6379125f6a446519f5a659ba1ed110b76_amd64 as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-plugin-for-aws-rhel8@sha256:ec6dd5b1b4a9382b86ae970240e25f11a4eb8e2ba42a2f6f727a984cf79f0cdb_ppc64le as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-plugin-for-aws-rhel8@sha256:fbef5cf169028b7e2c16c00ab699bcdb5733e2368ead683639495c2c584e08d7_s390x as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-plugin-for-csi-rhel8@sha256:57e64b3f70a5d06d68b2dfa3dfd329474ee39354e1ff3730742ae5869ffe9242_amd64 as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-plugin-for-csi-rhel8@sha256:9535d60aeca08fbcb35f5ddecc455fbf8fd240b185b0359fcf15db088beed93b_ppc64le as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-plugin-for-csi-rhel8@sha256:a68d39f20190d5dd35cb799b02ad3ff4fdaf52ab22f7785ba4be4d20c95a09af_s390x as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:4a509a9562f941a6eb85e29db424080204172cfcee21b2cbbe066efb5c60198c_amd64 as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:7933617816babdf5e6da973b7ffbf54a2c280a66fc6a9861e2dc731f01043d80_s390x as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-plugin-for-gcp-rhel8@sha256:c8e99a08d99db02bb8a5f3fde5ff77108b4699fa710c12b257e411e1f3014f7b_ppc64le as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:209ccbbf81de2154f620e3dc690a053d7110bc805fc148cff668bcab43674894_ppc64le as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:7b4c2fbf7ae8c859bfc976a1e07ef02e430792b16f36fd7fe9e447c7427d5003_s390x as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-plugin-for-microsoft-azure-rhel8@sha256:7bc516a3dc31d5675989c253dfc5d4f5b6e5675ed0dcd99aeabcf45748cfb82a_amd64 as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-plugin-rhel8@sha256:569d29f6abf7e47afa87dc786028dd1b3b25c703f03bb72f0cdb56fa9fd8322e_amd64 as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-plugin-rhel8@sha256:c2e022362052875f262fc082268fe1093d1a7a60aa51479b05346f5fc857864c_ppc64le as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-plugin-rhel8@sha256:c521866aa8677b189bfe5b07f38b640e5fe5f392bcf6af9a25cda0daab393cd9_s390x as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-restic-restore-helper-rhel8@sha256:27b11e8db2a414fdbc1cf7d0844db973f3f23c2d47af1c6890f42b1e7627efda_ppc64le as a component of 8Base-OADP-1.1
  • oadp/oadp-velero-restic-restore-helper-rhel8@sha256:2ced4f24ae6649bdeda3d075841b77c2171193e882c5559ec1d6f3cad6f94a8b_amd64 as a component of 8Base-OADP-1.1
  • +7 more not shown

✅ Remediation

For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2. Workaround: Users are strongly urged to update their software as soon as fixes are available. There are several mitigation approaches for this flaw. 1. If circumstances permit, users may disable http2 endpoints to circumvent the flaw altogether until a fix is available. 2. IP-based blocking or flood protection and rate control tools may be used at network endpoints to filter incoming traffic. 3. Several package specific mitigations are also available. a. nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ b. netty: https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p c. haproxy: https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487 d. nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg e. golang: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (12)