RHSA-2023:6200HighCVSS 7.5

Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.1.9 security updates and bug fixes

Published
October 30, 2023
Last Modified
September 22, 2026

🔗 CVE IDs covered (6)

CVE-2023-39325 →CVE-2023-44487 →CVE-2023-39318 →CVE-2023-39319 →CVE-2023-39321 →CVE-2023-39322 →

📋 Description

CVE-2023-39318 — golang: html/template: improper handling of HTML-like comments within script contexts CVE-2023-39319 — golang: html/template: improper handling of special tags within script contexts CVE-2023-39321 — golang: crypto/tls: panic when processing post-handshake message on QUIC connections CVE-2023-39322 — golang: crypto/tls: lack of a limit on buffered post-handshake CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) CVE-2023-44487 — HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

🎯 Affected products153

  • multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/agent-service-rhel8@sha256:41ae6255dcf7ad8801dbf72a61f8f64d598f5874b2354accc6861d0603bdfe25_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/agent-service-rhel8@sha256:a77b10111911aebbcbc8aefc27b151b7e5a277474c7e3071c7a312bc37cae914_amd64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/agent-service-rhel8@sha256:e4d2f2baebb2b65def3cd0570b7801c73e9b9e7fd6d42597458c0b68873a2879_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/agent-service-rhel8@sha256:fe5cae48399563b7eb7cbd897869a999eb9ccd36da28f07c4cbfe874a9d8913f_s390x as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/apiserver-network-proxy-rhel8@sha256:0b474adf2f6795b621d70c5a345930c52c6eacd11646a9984e21176feb97c3a1_amd64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/apiserver-network-proxy-rhel8@sha256:13cc6b3b939bcd0c3bfb4ffbecc87bcb2354896da5138a6cc8660e54830206a5_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/apiserver-network-proxy-rhel8@sha256:1c497a7794e13760261ee52abc3c49d0f584e75e72ab6dbb0c407c0c3bb7a8f4_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/apiserver-network-proxy-rhel8@sha256:5178c528b0953ad89d279130f41ebe8fa06d505d9c946817869ece5a9077f7bc_s390x as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-image-service-rhel8@sha256:3ab9697d0cac9495e52aaf5e89dae7e62817d96c79220809689bb04043a19905_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-image-service-rhel8@sha256:74ee62db42c41d4f1883481277fcd0e3738b5a4c07c7dabd5dac992efc1d043a_s390x as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-image-service-rhel8@sha256:7ddb10c1ef2e49abf596c521ce9a18f974d927b4a83896958a0590d2b9672bc4_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-image-service-rhel8@sha256:cc3875215b233b9b08d10e3dbc2189702949a7be146f7d58f61588b068301811_amd64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-installer-agent-rhel8@sha256:9c088afd107df296a4865fa33448cd96a675b944168a02cdc07847f054ad82bd_amd64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-installer-agent-rhel8@sha256:eee64a2c454d28bf2465cbaeb54778a4666cba45d3aadeb19eb4a2a126316536_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-installer-reporter-rhel8@sha256:73af5120518876a9eb414678c5b8dd6bfd98046ef9f5973aa2876a480508d421_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-installer-reporter-rhel8@sha256:c1ced260adffac6d22ce06cc826ba4588f0923a0167391871662415fd238b89b_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-installer-reporter-rhel8@sha256:cad72ecc092c649e897c48b964e32777ef256bdaaac07d90bcda478f9136bc08_amd64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-installer-rhel8@sha256:1192df127493322bbc055859e8b157a3ebdb145079b463a69c86cef7935bb60b_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-installer-rhel8@sha256:39439025c6113fd48927d3442986213527d5f3bd84f3d5a794a4db1b593a4d33_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/assisted-installer-rhel8@sha256:99e9ed31dfaaa6c0cadbfc7ad377bcb42e8e1e43f5646a46e182a22055fc8f8d_amd64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/aws-encryption-provider-rhel8@sha256:10ab26d7fe754d22e2f1d210a058b1d77719f0af3195e188124136652edfc1e9_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/aws-encryption-provider-rhel8@sha256:2f598aa58045c5acab400701e453d19a045b0efe432bce36e53ef11be22d2446_amd64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/aws-encryption-provider-rhel8@sha256:6c1c16758e303952426bd5d434a1838270f6ebaec041e3dc769379a0d36a7115_s390x as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/aws-encryption-provider-rhel8@sha256:ff2bb5b6f1b5b91c958fdcb80a12710ea45b3edcf62be302fe895f85ed66aae0_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/backplane-rhel8-operator@sha256:656660c28979a40abc61e4f24fcd9234b0aa503c49ee987a01ce0fa10622ddfd_s390x as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/backplane-rhel8-operator@sha256:67e5b872516775d3df0393ccd49088e45bc3f5ac09a35887469476d581097900_amd64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/backplane-rhel8-operator@sha256:ad72ff95216c8c349357716e0aa467b6b960639e066678ed70b0ecd98207c794_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/backplane-rhel8-operator@sha256:b49964f8fb3889c10d79c91253ae877e27bc1b9d69b75c9298fb8bf320d3fc2c_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • multicluster-engine/cluster-api-provider-agent-rhel8@sha256:4091ee0eb09fbb381799968fe7bb2469e7b962b7f1caa534cff3b8b11b14317d_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8
  • +123 more not shown

✅ Remediation

For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.6/html/multicluster_engine/multicluster_engine_overview#installing-while-connected-online-mce Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2. Workaround: Users are strongly urged to update their software as soon as fixes are available. There are several mitigation approaches for this flaw. 1. If circumstances permit, users may disable http2 endpoints to circumvent the flaw altogether until a fix is available. 2. IP-based blocking or flood protection and rate control tools may be used at network endpoints to filter incoming traffic. 3. Several package specific mitigations are also available. a. nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ b. netty: https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p c. haproxy: https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487 d. nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg e. golang: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (10)