RHSA-2023:6296HighCVSS 7.5

Red Hat Security Advisory: Release of OpenShift Serverless 1.30.2

Published
November 2, 2023
Last Modified
September 19, 2026

🔗 CVE IDs covered (4)

CVE-2023-29406 →CVE-2023-29409 →CVE-2023-39325 →CVE-2023-44487 →

📋 Description

CVE-2023-29406 — golang: net/http: insufficient sanitization of Host header CVE-2023-29409 — golang: crypto/tls: slow verification of certificate chains containing large RSA keys CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) CVE-2023-44487 — HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

🎯 Affected products119

  • Red Hat OpenShift Serverless 1.30
  • openshift-serverless-1-tech-preview/eventing-istio-controller-rhel8@sha256:07cd63dc28c59acdf8fffcacd5cee403275b66bb0b36baa94d45335a5ac5c141_s390x as a component of Red Hat OpenShift Serverless 1.30
  • openshift-serverless-1-tech-preview/eventing-istio-controller-rhel8@sha256:8cb5769df87931ae625d20a0983a492a3dd7f6b12b38a4c4cb8e884cb60a4b2a_ppc64le as a component of Red Hat OpenShift Serverless 1.30
  • openshift-serverless-1-tech-preview/eventing-istio-controller-rhel8@sha256:e0e773344db5018233bc9aa5954e6afe0403b2f356866efc7d4dcec60df9282b_amd64 as a component of Red Hat OpenShift Serverless 1.30
  • openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8@sha256:3fe21a55517a7e94fc1ebe2cd7191a48c52b88b68f32a278200b4c9d47d51df7_s390x as a component of Red Hat OpenShift Serverless 1.30
  • openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8@sha256:47d979bf31c3293987b3e891a8053f31a93c65c119b9afe50873654c666b92db_amd64 as a component of Red Hat OpenShift Serverless 1.30
  • openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8@sha256:dc2883e2c901540ee6e1e7247006e2260337cb7fe0477fc02cd029843f0e68a1_ppc64le as a component of Red Hat OpenShift Serverless 1.30
  • openshift-serverless-1-tech-preview/logic-data-index-ephemeral-rhel8@sha256:1543654b069e9cd45b5a0d17c4c4d38c415ae3beebc3cdff45ac22596453e15b_arm64 as a component of Red Hat OpenShift Serverless 1.30
  • openshift-serverless-1-tech-preview/logic-data-index-ephemeral-rhel8@sha256:b86203254be737f9a700f29f85b56d43367442f5fe4a7b3bcefcb0e97d24f982_ppc64le as a component of Red Hat OpenShift Serverless 1.30
  • openshift-serverless-1-tech-preview/logic-data-index-ephemeral-rhel8@sha256:d3e3c4777360289235620c308f57d95219ca66ccb5331a092b1e6bd0f0f90b6e_amd64 as a component of Red Hat OpenShift Serverless 1.30
  • openshift-serverless-1-tech-preview/logic-swf-builder-rhel8@sha256:9254aa62c43241dddd4a0c17dcec57e8521fa5583c70d11133ee5053bd8c6b30_amd64 as a component of Red Hat OpenShift Serverless 1.30
  • openshift-serverless-1-tech-preview/logic-swf-builder-rhel8@sha256:c2c18a5efff4a78203f38b8ca76671fc389c49237b1426d3c9a18e64708c756b_arm64 as a component of Red Hat OpenShift Serverless 1.30
  • openshift-serverless-1-tech-preview/logic-swf-builder-rhel8@sha256:fe8fe8c2cea0f2957fe7ab238c6cf6c86cb480f75fb632b9128a3c5775d3c9c1_ppc64le as a component of Red Hat OpenShift Serverless 1.30
  • openshift-serverless-1-tech-preview/logic-swf-devmode-rhel8@sha256:248a55059ca855ffdce83ea755d7bccd0094ba7ede795ddb892f17a3d360f24a_ppc64le as a component of Red Hat OpenShift Serverless 1.30
  • openshift-serverless-1-tech-preview/logic-swf-devmode-rhel8@sha256:38fe7d3ec137725d6d103603830866f3992608888692f981ca1e16aa03a97df3_arm64 as a component of Red Hat OpenShift Serverless 1.30
  • openshift-serverless-1-tech-preview/logic-swf-devmode-rhel8@sha256:f01f75bfd37282591cbc47907d1f5df57ccffa526a636b9e84b4b8f5f4b78997_amd64 as a component of Red Hat OpenShift Serverless 1.30
  • openshift-serverless-1/client-kn-rhel8@sha256:04552463c9c9ed820a107d16739958aeae2c59e6cbf209673b083716e1831224_amd64 as a component of Red Hat OpenShift Serverless 1.30
  • openshift-serverless-1/client-kn-rhel8@sha256:632be306dc2cdb98c5025447ba6a04758d037ab55c9324f69f9718fe136c006c_s390x as a component of Red Hat OpenShift Serverless 1.30
  • openshift-serverless-1/client-kn-rhel8@sha256:d12dc8841593e2c241d2d0239804292760f65517cb5743c24802e62c02d02abf_ppc64le as a component of Red Hat OpenShift Serverless 1.30
  • openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8@sha256:091f2f92aa0439f7c17d203189e65ab0752c12cd385f6e51b642fd2a595f5128_ppc64le as a component of Red Hat OpenShift Serverless 1.30
  • openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8@sha256:133ef116ff45e4f2997465501cec4a1646d04b7c846a6640bf1a84bf3de115c4_s390x as a component of Red Hat OpenShift Serverless 1.30
  • openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8@sha256:e1bb69c8055e32c298fb44dfd765a9735537406cbbf98c11ab051494e9bbaba3_amd64 as a component of Red Hat OpenShift Serverless 1.30
  • openshift-serverless-1/eventing-controller-rhel8@sha256:4cbea97b553d63340b3943b3f5d22e6582fe4b2f9aa21447d549806528b1f785_ppc64le as a component of Red Hat OpenShift Serverless 1.30
  • openshift-serverless-1/eventing-controller-rhel8@sha256:7a189da6f0de2054ca1a56c4cb1979ab3985b68c0b81be677cd475bdee9929e4_amd64 as a component of Red Hat OpenShift Serverless 1.30
  • openshift-serverless-1/eventing-controller-rhel8@sha256:dbbfef23c109add5e192b2930941c156d0a6d2334650f144975e2d1031f8bcdf_s390x as a component of Red Hat OpenShift Serverless 1.30
  • openshift-serverless-1/eventing-in-memory-channel-controller-rhel8@sha256:08c8f59d5c59885761d6004efdba303609210f7c595c28e8eb0bb0acca8e2313_amd64 as a component of Red Hat OpenShift Serverless 1.30
  • openshift-serverless-1/eventing-in-memory-channel-controller-rhel8@sha256:13506b369c0d8b7a141cfd44f97b08bfbb97d5fbc3a996ead0b73e886cfe3acf_ppc64le as a component of Red Hat OpenShift Serverless 1.30
  • openshift-serverless-1/eventing-in-memory-channel-controller-rhel8@sha256:3efd01822c309d9204e2316874474b142f41704ab1f9e5d9c8a5a069f1bf040a_s390x as a component of Red Hat OpenShift Serverless 1.30
  • openshift-serverless-1/eventing-in-memory-channel-dispatcher-rhel8@sha256:44aff1a5ab3171083d9c46d32425931367c720acb3733aeef4c0d5c1b5321b5d_ppc64le as a component of Red Hat OpenShift Serverless 1.30
  • openshift-serverless-1/eventing-in-memory-channel-dispatcher-rhel8@sha256:dac1e99a50449415c2125440588975100692e76e38140a0cd002e996c8bc19d1_amd64 as a component of Red Hat OpenShift Serverless 1.30
  • +89 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2. Workaround: Users are strongly urged to update their software as soon as fixes are available. There are several mitigation approaches for this flaw. 1. If circumstances permit, users may disable http2 endpoints to circumvent the flaw altogether until a fix is available. 2. IP-based blocking or flood protection and rate control tools may be used at network endpoints to filter incoming traffic. 3. Several package specific mitigations are also available. a. nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ b. netty: https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p c. haproxy: https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487 d. nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg e. golang: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (8)