RHSA-2024:0273HighCVSS 7.5

Red Hat Security Advisory: OpenShift Virtualization 4.12.9 Images security and bug fix update

Published
January 17, 2024
Last Modified
July 31, 2026

🔗 CVE IDs covered (1)

CVE-2023-39325 →

📋 Description

CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

🎯 Affected products44

  • CNV 4.12 for RHEL 8
  • container-native-virtualization/bridge-marker@sha256:302f7b8ed01ed6fa7990507a8c8648af5a5607e6bb6dab8d8b2ce95c93c5a4d2_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/cluster-network-addons-operator@sha256:0f32a09e0a6b9097102543b4a21c92d66679a7e9bd773b15d71fe4b1119f4579_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/cnv-containernetworking-plugins@sha256:42eb5beab2327ff9263f3f43ab6b1fab8c8474676ff032823e3e9dc9af03ef15_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/cnv-must-gather-rhel8@sha256:7cc48d1e0ef5d3ed1287d3ece0ac306e3eac1eaf283fe354eee905f721cba7d4_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/hco-bundle-registry@sha256:a8cc033664e7c193f3ed7369924d467ef6caa27e734f683fd5eda4aaeb3f5d71_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/hostpath-csi-driver@sha256:431eddb3927178f6a7b39b5b8937d4d39c7863bdfcd8227cd3e0b47af79c737d_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/hostpath-provisioner-rhel8-operator@sha256:3cef15dbedca3ebb5f8e3ec1443344aadedaded73c3900334d4230d6819d4fed_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/hostpath-provisioner-rhel8@sha256:844491b180e24c24ce6a1fc49cbef5399fbc044c544dbcbdf6a31c30f77c3235_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/hyperconverged-cluster-operator@sha256:1c734396bbae0bd259cd3b5bdc1121323531d3a78ca5905d55ab14f092588104_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/hyperconverged-cluster-webhook-rhel8@sha256:045151b2e55c0ba748b1ffe23e33cd3a230208bbf1b66ec2d514d9a73d6899b8_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/kubemacpool@sha256:e8f9d6d66f03ee04a617ccfbc89b9f45f005cffa72106168bd402925fc3b3a8a_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/kubevirt-console-plugin@sha256:4b6cd3523f8368c82f4be0fba90118491a3c5330e4f082551a9924c5b96aa290_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/kubevirt-ssp-operator@sha256:1efc679921cd7fe1f191064d88d84cc057ca908b2daab88208e64911fe483159_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/kubevirt-tekton-tasks-cleanup-vm@sha256:fe19a7f39bb1b0da5f181391da7416a77280dd0c0492a1759de9f11fbced512a_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/kubevirt-tekton-tasks-copy-template@sha256:810016684887e31612770417cc14633f923202d5dc6215fa256a8a5bee92597b_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/kubevirt-tekton-tasks-create-datavolume@sha256:944f1c609d14bdf705e3d76c7181f8e7ec25c309097aeafd843055f972b3aca5_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/kubevirt-tekton-tasks-create-vm-from-template@sha256:8bd7f4eccdf2f54f7bf5b74a348c3a3eb2e7a75557f82b9f77db2b67dc1d6a24_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/kubevirt-tekton-tasks-disk-virt-customize@sha256:4516d5b8ceda084f548d4f63d7597bf8094a73b81cbd37141ef530631cbb4ac9_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/kubevirt-tekton-tasks-disk-virt-sysprep@sha256:223a95d2396f5f35fad5daab2f75b4c412020a03c7b7c117f1433f8f64509692_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/kubevirt-tekton-tasks-modify-vm-template@sha256:edf380ac51005edd536c828f1cb1b0d8a6795c68fffe5b4e0d545b83c10776b9_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/kubevirt-tekton-tasks-operator@sha256:3e3a9796a01fb606528231603c17a253854f6db1fd1ac5d5132f846d7d264dcd_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/kubevirt-tekton-tasks-wait-for-vmi-status@sha256:caf5a64456741e60557f87440cbdf9a61305da07e9b42726517ff72e1041e3bb_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/kubevirt-template-validator@sha256:9a2ffe17b78578d7a2a43974d553cde190689a792fef3394dbaffc0503310db7_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/libguestfs-tools@sha256:207b0b99175a8264c623fefc959780941da4f143762c1962686d8c31d7c7f0da_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/ovs-cni-marker@sha256:1543ee3d9b3cc4f8037f6924d48613d1cbda112455e484654d3b4a6f97f3116a_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/ovs-cni-plugin@sha256:d943058669971f14a8e2a38387bc689ed1c0f8a34c749c2fbdab4122ff261bab_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/virt-api@sha256:6331782585fd9c71d27d87fabf54583b56cbdb577c8826a97394956c08a2b457_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/virt-artifacts-server@sha256:24c3dd085416026c64c4c6ca89c9b3c61625137f61ea281d19c32aaec67924b0_amd64 as a component of CNV 4.12 for RHEL 8
  • container-native-virtualization/virt-cdi-apiserver@sha256:50e2478a24a64d2a7e46d699475646efd92455228fe8ebcf648bfcbfe4e15a7e_amd64 as a component of CNV 4.12 for RHEL 8
  • +14 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (7)