RHSA-2023:7335HighCVSS 7.5

Red Hat Security Advisory: Updated Red Hat Process Automation Manager 7.13.4 SP2 Images

Published
November 16, 2023
Last Modified
July 30, 2026

🔗 CVE IDs covered (1)

CVE-2023-44487 →

📋 Description

CVE-2023-44487 — HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

🎯 Affected products19

  • Middleware Containers for OpenShift
  • rhpam-7-tech-preview/rhpam-kogito-runtime-native-rhel8@sha256:f100720059d7a0d35ff776e5b928486708b420b7a70652e82b815e4dc654b1f5_amd64 as a component of Middleware Containers for OpenShift
  • rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:878b83b28bf3b7dcfcb710c70ff06268477dddfa6a3df21b7dbe52f53ca3ca40_amd64 as a component of Middleware Containers for OpenShift
  • rhpam-7/rhpam-businesscentral-rhel8@sha256:52e746b99d6a15be91dc7c4e74fb0a58c27ca1d08151d456336e26b0cbcb54fe_amd64 as a component of Middleware Containers for OpenShift
  • rhpam-7/rhpam-controller-rhel8@sha256:c570297daff9ae813db39b27b4604f56cfcfa32a27e81d339da06dd33c13254f_amd64 as a component of Middleware Containers for OpenShift
  • rhpam-7/rhpam-dashbuilder-rhel8@sha256:b787d57beb85e6098033b8c26789d2cc7a29faf7463fa8607d962382752f0883_amd64 as a component of Middleware Containers for OpenShift
  • rhpam-7/rhpam-kieserver-rhel8@sha256:62a457fc1595ed3e534ef9c792cb2bdf3c1712642d370b450a2f341bdd118eda_amd64 as a component of Middleware Containers for OpenShift
  • rhpam-7/rhpam-kogito-builder-rhel8@sha256:2caadb26d1a4ed774bdfa67664d11210b02a143b741cd4068b1654d51ed80c61_amd64 as a component of Middleware Containers for OpenShift
  • rhpam-7/rhpam-kogito-builder-rhel8@sha256:eeb33a9caf57c04f021eea1aba0c87f8d4e70c1a804fbe1c8adc68859e7c4424_ppc64le as a component of Middleware Containers for OpenShift
  • rhpam-7/rhpam-kogito-rhel8-operator-bundle@sha256:056cc42012b5da9581c8d6f347a1693d6d3d904f76954fc1aafe12a6601994aa_ppc64le as a component of Middleware Containers for OpenShift
  • rhpam-7/rhpam-kogito-rhel8-operator-bundle@sha256:4553c12fa6f1a41b098efb333ce15d062eeea289b2bed5b2fd3075f5d4bb8cc8_amd64 as a component of Middleware Containers for OpenShift
  • rhpam-7/rhpam-kogito-rhel8-operator@sha256:52c4c3483cbcd0552730311a21cd4f32902de01b0efbaca2420a96dae6ad6b59_amd64 as a component of Middleware Containers for OpenShift
  • rhpam-7/rhpam-kogito-rhel8-operator@sha256:6ea8b56d752f98a1dd48d8e91f00f49a8f40124b6ec4464209e2e8554de7c93e_ppc64le as a component of Middleware Containers for OpenShift
  • rhpam-7/rhpam-kogito-runtime-jvm-rhel8@sha256:cbddd58758ac980a75e007808225feb9e65c280bbdc4727330acfa639474b808_amd64 as a component of Middleware Containers for OpenShift
  • rhpam-7/rhpam-kogito-runtime-jvm-rhel8@sha256:ccb049dd64523e98d0e7a0f7cf99e2171f17917532f4d10ab5893b24c1b19698_ppc64le as a component of Middleware Containers for OpenShift
  • rhpam-7/rhpam-operator-bundle@sha256:d5d8ae9b97b00623af7c4c85a15966bf4de7bc53b767634d6e8e33ba4167d9d3_amd64 as a component of Middleware Containers for OpenShift
  • rhpam-7/rhpam-process-migration-rhel8@sha256:193ff45f398332ecb2af83f7c6bd1e729ca64e5bbb757ce6623b75a448bfaf55_amd64 as a component of Middleware Containers for OpenShift
  • rhpam-7/rhpam-rhel8-operator@sha256:a7a20aed601d9a2ff38788dc773f821c1f68132de83fb1c36cc534a4f0d3468c_amd64 as a component of Middleware Containers for OpenShift
  • rhpam-7/rhpam-smartrouter-rhel8@sha256:91b1516edf464d7f67b9f97062629d0e1beb1c3023d94871db577c392a2df2a8_amd64 as a component of Middleware Containers for OpenShift

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Users are strongly urged to update their software as soon as fixes are available. There are several mitigation approaches for this flaw. 1. If circumstances permit, users may disable http2 endpoints to circumvent the flaw altogether until a fix is available. 2. IP-based blocking or flood protection and rate control tools may be used at network endpoints to filter incoming traffic. 3. Several package specific mitigations are also available. a. nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ b. netty: https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p c. haproxy: https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487 d. nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg e. golang: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (5)