RHSA-2023:6161HighCVSS 7.5

Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.7.14 security and bug fix update

Published
October 30, 2023
Last Modified
September 22, 2026

🔗 CVE IDs covered (8)

CVE-2023-29409 →CVE-2023-39318 →CVE-2023-39319 →CVE-2023-39321 →CVE-2023-39322 →CVE-2023-39325 →CVE-2023-44487 →CVE-2023-29406 →

📋 Description

CVE-2023-29406 — golang: net/http: insufficient sanitization of Host header CVE-2023-29409 — golang: crypto/tls: slow verification of certificate chains containing large RSA keys CVE-2023-39318 — golang: html/template: improper handling of HTML-like comments within script contexts CVE-2023-39319 — golang: html/template: improper handling of special tags within script contexts CVE-2023-39321 — golang: crypto/tls: panic when processing post-handshake message on QUIC connections CVE-2023-39322 — golang: crypto/tls: lack of a limit on buffered post-handshake CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) CVE-2023-44487 — HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

🎯 Affected products18

  • 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-controller-rhel8@sha256:db6e79aff9c592fe7f27145d01d7444f4dc4e0144cc036ae916d9cf0c95a9cfe_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-hook-runner-rhel8@sha256:c12186c030ce5192c823351ac212c1acf1c85fa574267bc64d2cdf90c5dae87f_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-legacy-rhel8-operator@sha256:ce90e9b7af04340afc72f38cfdf5b64d2a6fcae23f59223e2d510c028823d87f_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-log-reader-rhel8@sha256:58f92f50972a948c40319a5c2c9abfe3d44034ba1538f018b51f9998ee875e90_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-must-gather-rhel8@sha256:cc19dae1824b42b15a8015f6a88f1bc0f85e75a9e7d14f38313a27d93c88f22f_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-openvpn-rhel8@sha256:79006886844f82db986d9778994727cd40943faa77b2740b54f312fca6602950_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-operator-bundle@sha256:34e80eefb9b91a41bc4648e02de37d262347085c4da9bd032f43c8bb59e4459a_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-registry-rhel8@sha256:4dfa0ace1d92a6ae70d08dc3aff621e5f332956f213db987d9862ed2685e6733_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-rhel8-operator@sha256:0dc885972e7035f2c4b31016f4053e2bd73e328ace6aeee07380db5e0b055b02_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:cc4a32d349982a82cee52247627f1fd76b6630a6ddb4523a326e83f99d65826d_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-ui-rhel8@sha256:b3fd7bf0c25ecd110635de6e7d071cfe314cbe50ee0f924f3dfa985fd24ae59e_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-velero-plugin-for-aws-rhel8@sha256:c65d0ecc82eb9ebf2256c599b116e5878e57192caca90a83c1035421be914657_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-velero-plugin-for-gcp-rhel8@sha256:7ab0d93fe306b1baa0ae64a9c859776109f2cb27a0e468dc1d361e72a99d21b9_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-velero-plugin-for-microsoft-azure-rhel8@sha256:c89b222e9e9ae02a505fb6986ef1b6ca4b0e15706e3d44d2f03176af7f0d9b6a_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-velero-restic-restore-helper-rhel8@sha256:06010b3b3c7ad25cf0c122cf49bb7795712eebc47936e3c88db46256e93f0843_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-migration-velero-rhel8@sha256:39ac9f6895b2f71cc699c806df204b10af71f18a28de3d3839b7cde6cde13f64_amd64 as a component of 8Base-RHMTC-1.7
  • rhmtc/openshift-velero-plugin-rhel8@sha256:4aefc874e9869305ec80f46548c5499b4887e29135efb9ecad01dfd5a54b31fa_amd64 as a component of 8Base-RHMTC-1.7

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2. Workaround: Users are strongly urged to update their software as soon as fixes are available. There are several mitigation approaches for this flaw. 1. If circumstances permit, users may disable http2 endpoints to circumvent the flaw altogether until a fix is available. 2. IP-based blocking or flood protection and rate control tools may be used at network endpoints to filter incoming traffic. 3. Several package specific mitigations are also available. a. nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ b. netty: https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p c. haproxy: https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487 d. nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg e. golang: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (12)