RHSA-2023:6279HighCVSS 7.5

Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.11.5

Published
November 15, 2023
Last Modified
September 22, 2026

🔗 CVE IDs covered (2)

CVE-2023-29409 →CVE-2023-39325 →

📋 Description

CVE-2023-29409 — golang: crypto/tls: slow verification of certificate chains containing large RSA keys CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

🎯 Affected products5

  • Cert Manager support for Red Hat OpenShift release
  • cert-manager/cert-manager-operator-bundle@sha256:dc15fb6d2a50e2802d93f35a3ace7304e0472edf3a3c08a432e602ce9232d741_amd64 as a component of Cert Manager support for Red Hat OpenShift release
  • cert-manager/cert-manager-operator-rhel9@sha256:768ab23c17b2b3394e63d7180a964291b53968ed456fe00ffacba0681cc8600c_amd64 as a component of Cert Manager support for Red Hat OpenShift release
  • cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:0e97ef32756520c784389d89d15bf2f3990c064494904dbed1b7b5f4f30a0641_amd64 as a component of Cert Manager support for Red Hat OpenShift release
  • cert-manager/jetstack-cert-manager-rhel9@sha256:adafda1401b765f40a2f9ab109e88e7949f2387bf99b7ea317bf26638399b817_amd64 as a component of Cert Manager support for Red Hat OpenShift release

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (8)