RHSA-2023:7587HighCVSS 7.5

Red Hat Security Advisory: Updated IBM Business Automation Manager Open Editions 8.0.4 SP1 Images

Published
November 29, 2023
Last Modified
July 30, 2026

🔗 CVE IDs covered (1)

CVE-2023-44487 →

📋 Description

CVE-2023-44487 — HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

🎯 Affected products19

  • Middleware Containers for OpenShift
  • ibm-bamoe-tech-preview/bamoe-kogito-runtime-native-rhel8@sha256:db4267235a69729c0cdc7a8af7d84afeeea6b1cda81e2c9411d5307f11c45bde_amd64 as a component of Middleware Containers for OpenShift
  • ibm-bamoe/bamoe-businesscentral-monitoring-rhel8@sha256:72999c6bcd08c26d15813fa4a813749f1349cafeb7d155ecf262e6cbdf6a0b33_amd64 as a component of Middleware Containers for OpenShift
  • ibm-bamoe/bamoe-businesscentral-rhel8@sha256:bdb79faae81c9624759b0b7acb9825004e377ac5186fefa4be3393c21f41a869_amd64 as a component of Middleware Containers for OpenShift
  • ibm-bamoe/bamoe-controller-rhel8@sha256:4257937e0e3fe3c0dc7b150fb111738c3bf8416781fe15f7245a0b2f9dc604c9_amd64 as a component of Middleware Containers for OpenShift
  • ibm-bamoe/bamoe-dashbuilder-rhel8@sha256:f0efba2fc020c17063ade1ab8860c1f63a6bba74228587ad6c0582001249e6cc_amd64 as a component of Middleware Containers for OpenShift
  • ibm-bamoe/bamoe-kieserver-rhel8@sha256:a02e0a493f8651a31614dc30a3e803df08c9563e9f5da21a9710a7d010dfca2f_amd64 as a component of Middleware Containers for OpenShift
  • ibm-bamoe/bamoe-kogito-builder-rhel8@sha256:53a848ec0126dd74180697bd76d83f02151ce08dcb1ddda59a4b2ebdcae44047_ppc64le as a component of Middleware Containers for OpenShift
  • ibm-bamoe/bamoe-kogito-builder-rhel8@sha256:b212e8d2ee392c732960889369d51c885f5eabd9f76a586189e75d8e54fa12ed_amd64 as a component of Middleware Containers for OpenShift
  • ibm-bamoe/bamoe-kogito-rhel8-operator-bundle@sha256:331ca81863339a0b8d52f127e860209ac3be2cf05fb4d26f3162eb3ee81f605c_amd64 as a component of Middleware Containers for OpenShift
  • ibm-bamoe/bamoe-kogito-rhel8-operator-bundle@sha256:86854b56abee2f78540bd5c3dae1d874ed0281fb756d3d06faa17cb9386b55b8_ppc64le as a component of Middleware Containers for OpenShift
  • ibm-bamoe/bamoe-kogito-rhel8-operator@sha256:1f2f53c48f1d8e997b0a8ec314405ac90126e710cc2f25d4362c250499cc927b_ppc64le as a component of Middleware Containers for OpenShift
  • ibm-bamoe/bamoe-kogito-rhel8-operator@sha256:f883b2a9cfb1516222e86f3994a7560233f1b96ae25d0421922bfcfe6935fa16_amd64 as a component of Middleware Containers for OpenShift
  • ibm-bamoe/bamoe-kogito-runtime-jvm-rhel8@sha256:1a3a50a1af4d78bc70a9c11a42f059bd372454ce84913c3b78021180ec4d0bdf_ppc64le as a component of Middleware Containers for OpenShift
  • ibm-bamoe/bamoe-kogito-runtime-jvm-rhel8@sha256:db94353ed91569bacb79c0f434deff478e01469671ef3af6804940cef31c7492_amd64 as a component of Middleware Containers for OpenShift
  • ibm-bamoe/bamoe-operator-bundle@sha256:f4d8d5f8bde0fdd607b889da98e039610f306f45e05074435db0e00d4c62785e_amd64 as a component of Middleware Containers for OpenShift
  • ibm-bamoe/bamoe-process-migration-rhel8@sha256:fdfeda38dd932c4aa9f63b4f5e758b823eb079c90f068a482f92c4aa8e880664_amd64 as a component of Middleware Containers for OpenShift
  • ibm-bamoe/bamoe-rhel8-operator@sha256:76a66069057cc21cc1476e0b20defaf78178343c8c16de5b5af7c5d3be846474_amd64 as a component of Middleware Containers for OpenShift
  • ibm-bamoe/bamoe-smartrouter-rhel8@sha256:90dae7252e3c285e1b1d318dd0831f851a7be4608b8f8b82384c7236049b6442_amd64 as a component of Middleware Containers for OpenShift

✅ Remediation

Updated IBM Business Automation Manager Open Editions 8.0.4 OpenShift images can be found in the Red Hat Container Catalog. Workaround: Users are strongly urged to update their software as soon as fixes are available. There are several mitigation approaches for this flaw. 1. If circumstances permit, users may disable http2 endpoints to circumvent the flaw altogether until a fix is available. 2. IP-based blocking or flood protection and rate control tools may be used at network endpoints to filter incoming traffic. 3. Several package specific mitigations are also available. a. nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ b. netty: https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p c. haproxy: https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487 d. nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg e. golang: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (5)