RHSA-2023:6817HighCVSS 7.5

Red Hat Security Advisory: OpenShift Virtualization 4.14.0 Images security and bug fix update

Published
November 8, 2023
Last Modified
August 24, 2026

🔗 CVE IDs covered (7)

CVE-2022-41725 →CVE-2023-25153 →CVE-2023-25173 →CVE-2023-39325 →CVE-2023-44487 →CVE-2021-20329 →CVE-2022-41724 →

📋 Description

CVE-2021-20329 — mongo-go-driver: specific cstrings input may not be properly validated CVE-2022-41724 — golang: crypto/tls: large handshake records may cause panics CVE-2022-41725 — golang: net/http, mime/multipart: denial of service from excessive resource consumption CVE-2023-25153 — containerd: OCI image importer memory exhaustion CVE-2023-25173 — containerd: Supplementary groups are not set up properly CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) CVE-2023-44487 — HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

🎯 Affected products89

  • CNV 4.14 for RHEL 9
  • container-native-virtualization/bridge-marker-rhel9@sha256:1148cc4caaf2a5eb2a39dc8255f209522fcbd206567af25508c4bce1884b44cd_amd64 as a component of CNV 4.14 for RHEL 9
  • container-native-virtualization/bridge-marker-rhel9@sha256:d3734dfcf14530150900ab1a8055e6a75d96f2e1f8bd0e4530b21315de2dfd3d_arm64 as a component of CNV 4.14 for RHEL 9
  • container-native-virtualization/cluster-network-addons-operator-rhel9@sha256:d4164a252eaac07f5f0d34a54189e894bcfe92045dfda7ea3e93c0e836be9b9e_amd64 as a component of CNV 4.14 for RHEL 9
  • container-native-virtualization/cluster-network-addons-operator-rhel9@sha256:f2fa89f69c3f3a1a57c64975d690e42b4b5c49b92309d29b41b903a50f546fb6_arm64 as a component of CNV 4.14 for RHEL 9
  • container-native-virtualization/cnv-containernetworking-plugins-rhel9@sha256:55cc13ec852d0c6819b0be7592b12460c4256f64f5fcba846e1875738868b421_amd64 as a component of CNV 4.14 for RHEL 9
  • container-native-virtualization/cnv-containernetworking-plugins-rhel9@sha256:b2cc636ae0f2a30c04b8fd319b63d7810d49c1945f3a943bec973db3abb8f483_arm64 as a component of CNV 4.14 for RHEL 9
  • container-native-virtualization/cnv-must-gather-rhel9@sha256:2a583fb0a7b1d59f8789787d59b1a17d142024b510b5ad2a95cbac2cdbe2da8c_arm64 as a component of CNV 4.14 for RHEL 9
  • container-native-virtualization/cnv-must-gather-rhel9@sha256:f780a050fa4c92d5d3479d1092dd7973b06e17ef804bb8cee0c7168581eebe13_amd64 as a component of CNV 4.14 for RHEL 9
  • container-native-virtualization/hco-bundle-registry-rhel9@sha256:d3cbd39d4c6fb4d3c46b5155a73842827484b4ea9663751882c8e23085bcbf00_amd64 as a component of CNV 4.14 for RHEL 9
  • container-native-virtualization/hco-bundle-registry-rhel9@sha256:fc33136c9eff3e5d92207ce2c153a152fba46bc2b1927caa4957f0c5015bf440_arm64 as a component of CNV 4.14 for RHEL 9
  • container-native-virtualization/hostpath-csi-driver-rhel9@sha256:23c604deb6d175f03678f20296346cb46c7e0635fc5d7cbf737a035dd556eb0d_amd64 as a component of CNV 4.14 for RHEL 9
  • container-native-virtualization/hostpath-csi-driver-rhel9@sha256:8f8d482499a71ff0d2711daeaee7bcaa05e316a003a14b2d119c2358f35de9b9_arm64 as a component of CNV 4.14 for RHEL 9
  • container-native-virtualization/hostpath-provisioner-operator-rhel9@sha256:82d7a5229c9b23a11c392de2cebab5a3e20b87d92da0a2c93f8aa2f25b5d5f44_amd64 as a component of CNV 4.14 for RHEL 9
  • container-native-virtualization/hostpath-provisioner-operator-rhel9@sha256:8d08f900b73b9a409cc9813966ecc6c4a5674bcae247f68375aed2db5523e350_arm64 as a component of CNV 4.14 for RHEL 9
  • container-native-virtualization/hostpath-provisioner-rhel9@sha256:5511e156acd677d58698f1511578752ffb74da39c41773817b1a8df6bb3356dd_amd64 as a component of CNV 4.14 for RHEL 9
  • container-native-virtualization/hostpath-provisioner-rhel9@sha256:5e9d32996733067f4dcbab40c9dd4f7dab25f03b985f63a393fbbd52c3de2141_arm64 as a component of CNV 4.14 for RHEL 9
  • container-native-virtualization/hyperconverged-cluster-operator-rhel9@sha256:02e19daebdfa5ac0bb8d2d9dd99a58c53ba93d9b2f7ac8889d4c3083a68858b4_arm64 as a component of CNV 4.14 for RHEL 9
  • container-native-virtualization/hyperconverged-cluster-operator-rhel9@sha256:f0b69c20e4d42a53d1b9a68dd90e919487d9d047d2186ad8ea217b8e29884ae9_amd64 as a component of CNV 4.14 for RHEL 9
  • container-native-virtualization/hyperconverged-cluster-webhook-rhel9@sha256:46d6153c2da86702d06701c5c95e36bb06df03d982771d6791c92c559664bac7_amd64 as a component of CNV 4.14 for RHEL 9
  • container-native-virtualization/hyperconverged-cluster-webhook-rhel9@sha256:61ffc93edbe34fda8103dffb5c910cac8653eec650f4029bfcddedd4a9f1ba74_arm64 as a component of CNV 4.14 for RHEL 9
  • container-native-virtualization/kubemacpool-rhel9@sha256:0a0265375b10ff7c60397a5d486b2f48f524af9a57aa9ba7ae3775f1626fe724_arm64 as a component of CNV 4.14 for RHEL 9
  • container-native-virtualization/kubemacpool-rhel9@sha256:33a0e10a204f44c05169e78a852a8916d5c1cf4e7268b66a661795183d19aa40_amd64 as a component of CNV 4.14 for RHEL 9
  • container-native-virtualization/kubesecondarydns-rhel9@sha256:6421fe0e7601c9d0ba2df1af37e584e9c623fb9956809cf5de35273497574f83_amd64 as a component of CNV 4.14 for RHEL 9
  • container-native-virtualization/kubesecondarydns-rhel9@sha256:f51800af171fb90a4e613dfafb035dd31c4d20ddc1f49e2c3f9fd1da22f777a4_arm64 as a component of CNV 4.14 for RHEL 9
  • container-native-virtualization/kubevirt-apiserver-proxy-rhel9@sha256:ab7992cc6f352add0162556c33516425e61058e90caa0d7f776061bd4fddafdc_amd64 as a component of CNV 4.14 for RHEL 9
  • container-native-virtualization/kubevirt-apiserver-proxy-rhel9@sha256:df49bba89e997fbd4d86d6ae199ecaa19304e99556520fab02e710d06fb77a5d_arm64 as a component of CNV 4.14 for RHEL 9
  • container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:1e08ddf153a2c70f68b8eeb4efbb5c385ac06ef4765012652507e9422c64e4e4_arm64 as a component of CNV 4.14 for RHEL 9
  • container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:5ff50d5e496d9fba3996430eaa2584b7522307753f61438081f7718a905f8985_amd64 as a component of CNV 4.14 for RHEL 9
  • container-native-virtualization/kubevirt-dpdk-checkup-rhel9@sha256:1ebeabc2e5712960eed6a19cf56e4610de875bf718576a53ad3885c373a419d2_amd64 as a component of CNV 4.14 for RHEL 9
  • +59 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2. Workaround: Users are strongly urged to update their software as soon as fixes are available. There are several mitigation approaches for this flaw. 1. If circumstances permit, users may disable http2 endpoints to circumvent the flaw altogether until a fix is available. 2. IP-based blocking or flood protection and rate control tools may be used at network endpoints to filter incoming traffic. 3. Several package specific mitigations are also available. a. nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ b. netty: https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p c. haproxy: https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487 d. nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg e. golang: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (319)