RHSA-2023:7486HighCVSS 7.5

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.6 for OpenShift image enhancement and security update

Published
November 24, 2023
Last Modified
August 18, 2026

🔗 CVE IDs covered (3)

CVE-2023-44487 →CVE-2023-0105 →CVE-2023-33201 →

📋 Description

CVE-2023-0105 — keycloak: impersonation and lockout possible through incorrect handling of email trust CVE-2023-33201 — bouncycastle: potential blind LDAP injection attack using a self-signed certificate CVE-2023-44487 — HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

🎯 Affected products4

  • Middleware Containers for OpenShift
  • rh-sso-7/sso76-openshift-rhel8@sha256:16c055e14341e0373dc090196b3bfb1c962da11343e1322bd7dc59eb9df3b514_amd64 as a component of Middleware Containers for OpenShift
  • rh-sso-7/sso76-openshift-rhel8@sha256:42eacda40b19a10366ebf98e8db9b7f14f09e567a66beb454c8c50c2ac7827bf_ppc64le as a component of Middleware Containers for OpenShift
  • rh-sso-7/sso76-openshift-rhel8@sha256:da370ba2e4eb8b5af4876defc3a05437e01d224240aff7e0129bc0b96c99124d_s390x as a component of Middleware Containers for OpenShift

✅ Remediation

To update to the latest Red Hat Single Sign-On 7.6.6 for OpenShift image, follow these steps to pull in the content: 1. On your main hosts, ensure you are logged into the CLI as a cluster administrator or user with project administrator access to the global "openshift" project. For example: $ oc login -u system:admin 2. Update the core set of Red Hat Single Sign-On resources for OpenShift in the "openshift" project by running the following commands: $ for resource in sso76-image-stream.json \ sso76-https.json \ sso76-mysql.json \ sso76-mysql-persistent.json \ sso76-postgresql.json \ sso76-postgresql-persistent.json \ sso76-x509-https.json \ sso76-x509-mysql-persistent.json \ sso76-x509-postgresql-persistent.json do oc replace -n openshift --force -f \ https://raw.githubusercontent.com/jboss-container-images/redhat-sso-7-openshift-image/v7.6.6.GA/templates/${resource} done 3. Install the Red Hat Single Sign-On 7.6.6 for OpenShift streams in the "openshift" project by running the following command: $ oc -n openshift import-image redhat-sso76-openshift:1.0 Workaround: Users are strongly urged to update their software as soon as fixes are available. There are several mitigation approaches for this flaw. 1. If circumstances permit, users may disable http2 endpoints to circumvent the flaw altogether until a fix is available. 2. IP-based blocking or flood protection and rate control tools may be used at network endpoints to filter incoming traffic. 3. Several package specific mitigations are also available. a. nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ b. netty: https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p c. haproxy: https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487 d. nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg e. golang: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (7)