RHSA-2024:2633HighCVSS 8.1

Red Hat Security Advisory: updated rhceph-6.1 container image

Published
May 1, 2024
Last Modified
September 14, 2026

🔗 CVE IDs covered (3)

CVE-2023-49569 →CVE-2024-1442 →CVE-2023-44487 →

📋 Description

CVE-2023-44487 — HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) CVE-2023-49569 — go-git: Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients CVE-2024-1442 — grafana: Improper priviledge managent for users with data source permissions

🎯 Affected products19

  • Red Hat Ceph Storage 6.1 Tools
  • rhceph/keepalived-rhel9@sha256:2468c33f5af3403df5801d95667767dada47d2a4bfeb8aeda4e920a8e6142fb4_amd64 as a component of Red Hat Ceph Storage 6.1 Tools
  • rhceph/keepalived-rhel9@sha256:ecdabdca39cb872d0cef52b0e5c41b370eb04bd982fdb1b711de9003418a30f2_ppc64le as a component of Red Hat Ceph Storage 6.1 Tools
  • rhceph/keepalived-rhel9@sha256:f6fc1dd62eaa7a09e878d2fde3f39f6c32db399d14554412ec09c2eb09a65c7b_s390x as a component of Red Hat Ceph Storage 6.1 Tools
  • rhceph/rhceph-6-dashboard-rhel9@sha256:077eed7e75034ed98d1d47854031e9f99277d6445165b4256c52ba3116c78a99_ppc64le as a component of Red Hat Ceph Storage 6.1 Tools
  • rhceph/rhceph-6-dashboard-rhel9@sha256:ac73cc9d02509b10de7a49a54762c6ad249aaf079fbd4720e97a2892bb342110_s390x as a component of Red Hat Ceph Storage 6.1 Tools
  • rhceph/rhceph-6-dashboard-rhel9@sha256:fe54e5bfb8d49393d1fac21755ad1017c5b7c34c23dec18563170396f81d15a9_amd64 as a component of Red Hat Ceph Storage 6.1 Tools
  • rhceph/rhceph-6-rhel9@sha256:0e8fcaf340946dd2881027da80d977066726f5f2bdd454c2b61bcb8ce5aba58b_amd64 as a component of Red Hat Ceph Storage 6.1 Tools
  • rhceph/rhceph-6-rhel9@sha256:402140159dc4c78dca690a44491a10c51a33fed587d1855b8a781a5e8cf99dfc_ppc64le as a component of Red Hat Ceph Storage 6.1 Tools
  • rhceph/rhceph-6-rhel9@sha256:fba5014ee58c3a8f39bb7967c4a6793e96382f946aff07a0d73038c36db8c1c6_s390x as a component of Red Hat Ceph Storage 6.1 Tools
  • rhceph/rhceph-haproxy-rhel9@sha256:6f8c1edbe9702894290cd87044c1a2965d5b70bd534b19dcae6ade98c5c2b0fd_amd64 as a component of Red Hat Ceph Storage 6.1 Tools
  • rhceph/rhceph-haproxy-rhel9@sha256:7a5642eb5fe90cf6a1b73bedce8afc61f9d7c1d3a45e82ccc56c8ca79a455c45_s390x as a component of Red Hat Ceph Storage 6.1 Tools
  • rhceph/rhceph-haproxy-rhel9@sha256:b497b8004a2057c813d95cb35ba30980ef8b40f94d31b9307aa1fc4bbbe35542_ppc64le as a component of Red Hat Ceph Storage 6.1 Tools
  • rhceph/rhceph-promtail-rhel9@sha256:2cfe8ff27053b918fb4d7bd9d0e393eaed4df688206559dd98ffa604a28bf15c_amd64 as a component of Red Hat Ceph Storage 6.1 Tools
  • rhceph/rhceph-promtail-rhel9@sha256:4f37df3ad28df39a044c0e4575299acaed7301c4bdccd6f608b8775a4a0ad513_ppc64le as a component of Red Hat Ceph Storage 6.1 Tools
  • rhceph/rhceph-promtail-rhel9@sha256:d1b5e1feef37c5212c73fb3ffb4ed51ccafcb1bd9fa99cefc65f937f998852fb_s390x as a component of Red Hat Ceph Storage 6.1 Tools
  • rhceph/snmp-notifier-rhel9@sha256:414bfdfdd4af59dd1388a407e40e4b523180bac9266088650a63b96a4b70b391_s390x as a component of Red Hat Ceph Storage 6.1 Tools
  • rhceph/snmp-notifier-rhel9@sha256:9a84f9e7a9999fadd11fd4091f0e29c99742177a71b360cf930b3ff202bfcc2f_ppc64le as a component of Red Hat Ceph Storage 6.1 Tools
  • rhceph/snmp-notifier-rhel9@sha256:da2298ff218ec5a827501ef8de531d00e00358c9b1a34a55752fd328fae61b5a_amd64 as a component of Red Hat Ceph Storage 6.1 Tools

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 and https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/6 For supported configurations, refer to: https://access.redhat.com/articles/1548993 Workaround: Users are strongly urged to update their software as soon as fixes are available. There are several mitigation approaches for this flaw. 1. If circumstances permit, users may disable http2 endpoints to circumvent the flaw altogether until a fix is available. 2. IP-based blocking or flood protection and rate control tools may be used at network endpoints to filter incoming traffic. 3. Several package specific mitigations are also available. a. nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ b. netty: https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p c. haproxy: https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487 d. nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg e. golang: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2. Workaround: In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (7)