RHSA-2023:6202HighCVSS 7.5

Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.6.8 security and bug fix updates

Published
October 30, 2023
Last Modified
September 22, 2026

🔗 CVE IDs covered (6)

CVE-2023-39322 →CVE-2023-39325 →CVE-2023-44487 →CVE-2023-39318 →CVE-2023-39319 →CVE-2023-39321 →

📋 Description

CVE-2023-39318 — golang: html/template: improper handling of HTML-like comments within script contexts CVE-2023-39319 — golang: html/template: improper handling of special tags within script contexts CVE-2023-39321 — golang: crypto/tls: panic when processing post-handshake message on QUIC connections CVE-2023-39322 — golang: crypto/tls: lack of a limit on buffered post-handshake CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) CVE-2023-44487 — HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

🎯 Affected products192

  • Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8
  • rhacm2/acm-governance-policy-addon-controller-rhel8@sha256:22041df5bf50628fd8fb62127f84c6ce8d77cb2821b0f41e1e809cf3bc2ab434_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8
  • rhacm2/acm-governance-policy-addon-controller-rhel8@sha256:25c5c77fe79b72f805eba0e183bbca799f6f11266585fd9a24acb0aee4a4ee44_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8
  • rhacm2/acm-governance-policy-addon-controller-rhel8@sha256:39a3531a490d9d7a2528dca7efbbfe3742e7b02d3d7b139c47eacd0fb3398478_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8
  • rhacm2/acm-governance-policy-addon-controller-rhel8@sha256:41f8bcf3a01621f4df736db053571c6fdbe3bdc5be731b3f196d0b999b578bd8_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8
  • rhacm2/acm-grafana-rhel8@sha256:4b9c090d9361d711f400ecae06bfb685d4b14ecdd2c04d1dad1c21aeffe1a7c7_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8
  • rhacm2/acm-grafana-rhel8@sha256:593eeebb93cf18d65214d810f0803e1d03689a4b662c375e00056786e25bb2b5_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8
  • rhacm2/acm-grafana-rhel8@sha256:a3af2c5b71c4b4eeed51fc1e7da1ba150ffcea62b633bc3dcbb8bb2c5b91fa76_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8
  • rhacm2/acm-grafana-rhel8@sha256:f867f63c7dd11ecf5ccf7af55de55bbedd46349aee79170b3dbacac47fcbd596_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8
  • rhacm2/acm-must-gather-rhel8@sha256:73707cce9f52bca40994ae5dc64d39512f86c2fad089cc6a98fad35600714884_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8
  • rhacm2/acm-must-gather-rhel8@sha256:a5ce4bb1fbfa9e0ac1e0011d5d6e1fcbdcc716784384d9cb415f91b75c68adfd_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8
  • rhacm2/acm-must-gather-rhel8@sha256:f0a55d80c693cf5a618d809a27e906e258f66bcb7e3d93fe78b542c084bf7624_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8
  • rhacm2/acm-must-gather-rhel8@sha256:f251e9013b44c544d23a2572fcecf9b6494043ddd668c873552b7da7bc2fc922_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8
  • rhacm2/acm-operator-bundle@sha256:099e7ab081724937eabcda3fa30f892d3375f2188e95930ee8960933b09c92ae_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8
  • rhacm2/acm-operator-bundle@sha256:1b1117268e33a09d03a7f0d7a3a586b5bd0c3e2fccd4974c3ab6c697ad21ab13_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8
  • rhacm2/acm-operator-bundle@sha256:a61b13ac0e071e213ada0a2288b81a4317e28cd5eeec7b6e78d952d06cd59c7c_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8
  • rhacm2/acm-prometheus-config-reloader-rhel8@sha256:3016d37cf969a94314aaaa295c0b1309f4bbfbc50d7d0789e1b875783e2904e4_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8
  • rhacm2/acm-prometheus-config-reloader-rhel8@sha256:45efadc157d6d364d84ab040cfb327b9ff27aa3f5e3848a3fe19d75aec0b5e45_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8
  • rhacm2/acm-prometheus-config-reloader-rhel8@sha256:56c3a6164c4da09aca7b487f282b3dc1ac6aeb236970afa5b2aadcb8b3d2d5c6_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8
  • rhacm2/acm-prometheus-config-reloader-rhel8@sha256:dde63fb84d127d01ad6e3a76646e9d9b385b0a4695e7b056f55418323f70b5c0_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8
  • rhacm2/acm-prometheus-rhel8@sha256:17bc1745c0f54763585ad6da8d4117b471be9aeaf545c3c748d8aa963fbd46cd_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8
  • rhacm2/acm-prometheus-rhel8@sha256:71c105c0d3b7507efed5a5b792611cc5022dd97293da4ecfa16a593524f51f22_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8
  • rhacm2/acm-prometheus-rhel8@sha256:b3d2553e8f5a36382229ace49e395e7471b644663e629e87bfa007efa698e559_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8
  • rhacm2/acm-prometheus-rhel8@sha256:ea2ee7c76c6bce72ee098fae5a86ce6f8b68baa04cc0072f9833718ad8f84456_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8
  • rhacm2/acm-volsync-addon-controller-rhel8@sha256:6a09d93786436b8e8fadb9cacb23488caf1a131ba587da51a574dea176289ee2_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8
  • rhacm2/acm-volsync-addon-controller-rhel8@sha256:ad7289555a0aa835de14f9158a166ce503f6cf13b1a5bea2c8098fb156e03e9d_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8
  • rhacm2/acm-volsync-addon-controller-rhel8@sha256:e797cb581b5d0508da0c8e14bd7aa3a49376d3c2ccaa643fd9f3b2ba858236a6_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8
  • rhacm2/acm-volsync-addon-controller-rhel8@sha256:f8f219b28fc4eb3ba76064c94b8618a185e51f701e870d773de0022e53fdec67_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8
  • rhacm2/cert-policy-controller-rhel8@sha256:51e31d2ddfa55f1f1113f3a3df84326ec5bcf8fff1cf542747b6b2ad920c227d_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8
  • rhacm2/cert-policy-controller-rhel8@sha256:9512de5254c8a20e465dcad117ec2f195f38eaf1b1369b42188d9bface8134a4_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8
  • +162 more not shown

✅ Remediation

For Red Hat Advanced Cluster Management for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.6/html/install/installing#installing-while-connected-online Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2. Workaround: Users are strongly urged to update their software as soon as fixes are available. There are several mitigation approaches for this flaw. 1. If circumstances permit, users may disable http2 endpoints to circumvent the flaw altogether until a fix is available. 2. IP-based blocking or flood protection and rate control tools may be used at network endpoints to filter incoming traffic. 3. Several package specific mitigations are also available. a. nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ b. netty: https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p c. haproxy: https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487 d. nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg e. golang: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (10)