RHSA-2023:6248HighCVSS 7.5

Red Hat Security Advisory: OpenShift Virtualization 4.12.8 Images security update

Published
November 1, 2023
Last Modified
September 22, 2026

🔗 CVE IDs covered (3)

CVE-2023-44487 →CVE-2022-41723 →CVE-2023-39325 →

📋 Description

CVE-2022-41723 — golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) CVE-2023-44487 — HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

🎯 Affected products44

  • CNV 4.12 for RHEL 8
  • container-native-virtualization/bridge-marker@sha256:23d0f2055443e81079ef82573ff23539ff03bc0a57912638b80fdf24d6e74b4f_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/cluster-network-addons-operator@sha256:c9106a0cdf723043ad2e94fe746d084ffb4cdf50292763922389acafb6d1abf7_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/cnv-containernetworking-plugins@sha256:b60bc0fd0988c23c1224280c9b63e98d5b77998f0ed24e12a55158da8971ae4d_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/cnv-must-gather-rhel8@sha256:74ff80f2d32a0d1dd58c7ac63cc2c5792146e3bc2a65b57727e172e0da8ed994_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/hco-bundle-registry@sha256:dddf77c42a60a2837388448d294a65719281984009708a1d90ce328c3d95aa28_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/hostpath-csi-driver@sha256:6b9c72bfb44b3ed66ffbe7785bfa44d81bed9b5c802e8f664d5bd129789a108a_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/hostpath-provisioner-rhel8-operator@sha256:97a53da9d0aa186d8120558b071c8a609db2e9fdf55e88780c4df4a96d1e7fb9_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/hostpath-provisioner-rhel8@sha256:a6c27e3bdbf23952f0eacb1be73c14eabb02b9e6ed12ac2f1fa3f386de11ed8c_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/hyperconverged-cluster-operator@sha256:5fbe17bcbbf20acae781c4fbdde81d1d53469f276b217a9a0339baae8c28a442_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/hyperconverged-cluster-webhook-rhel8@sha256:3b73aae81279eb9fc9354a141230a2ae2ffaf767ec430653ceef9e8a6f5b2578_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/kubemacpool@sha256:a63b4835f1e1afc3d5da3b80526e494ace5fe6917a51526648b9b1228168f552_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/kubevirt-console-plugin@sha256:861fb3b8d3b009f5dda71338f5dc340081e4501cc38af55c8d03a1c00378c6a3_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/kubevirt-ssp-operator@sha256:8218a9b29aaa5bdcddc4b67256c802fc555fc2b96fc2045671d9a62faa0517e5_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/kubevirt-tekton-tasks-cleanup-vm@sha256:a530fcc39c11350dabf592c52288a44521f639a91716afe40c31f676a0287eb2_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/kubevirt-tekton-tasks-copy-template@sha256:b9f5f854305f631dd893995365e92ecb6a20085c84cab124bd5a1f715bbf110b_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/kubevirt-tekton-tasks-create-datavolume@sha256:1fbad55cf897a63ba992609d0b966d1a15ea33c65772a89d3ed03cc565c88ff3_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/kubevirt-tekton-tasks-create-vm-from-template@sha256:420a2f4a5ccf17d354945725efd872ce48042afb02f9446348d95086f6c074e6_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/kubevirt-tekton-tasks-disk-virt-customize@sha256:aa24caef43563243aa45e2146a9be4ebe15a55e7d47cd043d0a2e1094d4662bb_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/kubevirt-tekton-tasks-disk-virt-sysprep@sha256:0cb042eb4f9f6c8d1436d010eb9691ceb5c02f0f273ae458780ad92727f45908_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/kubevirt-tekton-tasks-modify-vm-template@sha256:6337cb6e7978d8622f6948f81bd927ba97265baaedf3c527bf2b0bc9d33fd7af_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/kubevirt-tekton-tasks-operator@sha256:108b0a434e22eb7837b225f711d63303a08193d8af3883522c992d6486c26353_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/kubevirt-tekton-tasks-wait-for-vmi-status@sha256:4b393bbab7a0da4574a285ec365da0559e137e55c28b88ec9f4c7b75a0bde133_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/kubevirt-template-validator@sha256:053df4781a11f4353e06fcc7b12e8fb81a52b7bccab5f8a6c98f56947d05c270_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/libguestfs-tools@sha256:9b0649921289b2484e05760c81890262cae75d9cbac2764ec258b57fa3b7e605_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/ovs-cni-marker@sha256:43a216c37d6ff86c2ac963f64022e1b4c475a64cb681bb504879caf70f8688df_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/ovs-cni-plugin@sha256:dc55c6e82516b8fc6b80b858cc9c308384998b8bb578252ca25e919e3fcf7c08_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/virt-api@sha256:8a8079e2bed79b5d18796db8ba44d56610b68544974e55c851b0116997b82414_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/virt-artifacts-server@sha256:383022adea0838abf0e7394b95059b995e616427eed4fff1e65d125c14c0a7e5_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/virt-cdi-apiserver@sha256:10c4bb9ad748bac9b04ef16f542941a67a4c78d8dd4069c8f5cbade859ae3dba_amd64 as a component of CNV 4.12 for RHEL 8
  • +14 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2. Workaround: Users are strongly urged to update their software as soon as fixes are available. There are several mitigation approaches for this flaw. 1. If circumstances permit, users may disable http2 endpoints to circumvent the flaw altogether until a fix is available. 2. IP-based blocking or flood protection and rate control tools may be used at network endpoints to filter incoming traffic. 3. Several package specific mitigations are also available. a. nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ b. netty: https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p c. haproxy: https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487 d. nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg e. golang: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (7)