RHSA-2023:7215HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift Service Mesh Containers for 2.2.12

Published
November 15, 2023
Last Modified
September 15, 2026

🔗 CVE IDs covered (2)

CVE-2023-39325 →CVE-2023-44487 →

📋 Description

CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) CVE-2023-44487 — HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

🎯 Affected products25

  • RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/grafana-rhel8@sha256:2ac0267f703527a6af7cf822ac8dc33f8e27a8784c2091c6894ea9d4faeff290_s390x as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/grafana-rhel8@sha256:c9462389f5c148c9fa855aa54786ab28e0a522c2576e139f254c72f3135e824c_amd64 as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/grafana-rhel8@sha256:dcfa0e73a89d2ad273720c209dd94fe3b652c5606d196d4962a2f662ed834612_ppc64le as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/istio-cni-rhel8@sha256:a0f0fcdf2d1be20c4b483d338803b4f968ed6a51ee842bae3f2539aaea660b36_amd64 as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/istio-cni-rhel8@sha256:ef9adad3d6ccc52944aa6a7be7537a3fd2cef1984c09f4b57a32d5670903b679_ppc64le as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/istio-cni-rhel8@sha256:fcc2034b3448c92e1ac6c3848def79942238733d4acf03ae2e5a2b84be0c6545_s390x as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/istio-must-gather-rhel8@sha256:3061637ecdeac036dc9171f5b079daa0a4a193589161e90920c681abb27c5ce3_ppc64le as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/istio-must-gather-rhel8@sha256:7834412d7ae6f8d1b4610a373245a675904f141534211e56657f47be68ff35a2_s390x as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/istio-must-gather-rhel8@sha256:a3031870bd2199c28e754585b57363f953818bd20bf9ad04f5545e0eb4ae4793_amd64 as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/kiali-rhel8@sha256:081d9b91f85a9fa135ddaf993b67ba01282205b5e87d31cffa1a9e659a430a61_ppc64le as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/kiali-rhel8@sha256:63ce7982aa4fe759dbe7acc497105da41f6426268678df4c8407ef7da94f5965_amd64 as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/kiali-rhel8@sha256:b426bab535c9417d2ed4951153ef03c06d95060a3378f8621b5eb3436995aa8e_s390x as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/pilot-rhel8@sha256:6851a60e3242789f67637d596959580c96fcd5221d71ad83e21ead53f0ba9856_ppc64le as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/pilot-rhel8@sha256:818fc5474a2bea0400b6b022cca31f522ea05b58bfa57fca1f6cb20efeb140f7_amd64 as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/pilot-rhel8@sha256:b654048f91103418e1c503a9b45b9890c868892e746218fb26a6768a842a6310_s390x as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/prometheus-rhel8@sha256:681efb513c3eb27dce5e1225964fb1f076e7f5d5951ea0fcbf12ebe633df0602_s390x as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/prometheus-rhel8@sha256:b2e2fbd17082d59a1fbf9e55c04b767763d968747e232bfb4789376ed1bb08cc_ppc64le as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/prometheus-rhel8@sha256:dbcf658a5354b9b7d412826a77cfb0ce889c4704634f5d13325161021feff81e_amd64 as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/proxyv2-rhel8@sha256:208a5000e943fb68e2c2cfea0ac6223fdc6a43363b19fb3ac3e6c19326afa464_ppc64le as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/proxyv2-rhel8@sha256:4abe159e450801e062a3afceff661ab25dc57ea122ce58269b2f3566a55c8dc2_amd64 as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/proxyv2-rhel8@sha256:7cc28d4baf68ca0902d7dc44d9fc2a9ac626268fd4320d17caa3f22cc08618c1_s390x as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/ratelimit-rhel8@sha256:096bf95cdba671943bb9f7ec5f804201c1cf06607a164c7b76ef745c26c82d73_s390x as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/ratelimit-rhel8@sha256:8a5a8bc6a54cd64330926478ac29f568ac5c83cc9550852d439ccc4cbd0b5ab5_amd64 as a component of RHOSSM 2.2 for RHEL 8
  • openshift-service-mesh/ratelimit-rhel8@sha256:cc5d972cb2ba30e147c76202dc315a08bdba41906f808e95d8b134bfe446fc89_ppc64le as a component of RHOSSM 2.2 for RHEL 8

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2. Workaround: Users are strongly urged to update their software as soon as fixes are available. There are several mitigation approaches for this flaw. 1. If circumstances permit, users may disable http2 endpoints to circumvent the flaw altogether until a fix is available. 2. IP-based blocking or flood protection and rate control tools may be used at network endpoints to filter incoming traffic. 3. Several package specific mitigations are also available. a. nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ b. netty: https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p c. haproxy: https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487 d. nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg e. golang: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (6)