RHSA-2024:2728HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 director Operator container images security update

Published
May 29, 2024
Last Modified
August 22, 2026

🔗 CVE IDs covered (3)

CVE-2023-39326 →CVE-2023-45288 →CVE-2023-48795 →

📋 Description

CVE-2023-39326 — golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests CVE-2023-45288 — golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS CVE-2023-48795 — ssh: Prefix truncation attack on Binary Packet Protocol (BPP)

🎯 Affected products5

  • Red Hat OpenStack Platform 17.1
  • rhosp-rhel9/osp-director-agent@sha256:436915008c0b272b20fb5fbf64fc6b4f65ae869ecdd70248066b36a120ab53d0_amd64 as a component of Red Hat OpenStack Platform 17.1
  • rhosp-rhel9/osp-director-downloader@sha256:e702392f6f8bde5a93b9f90d94ec3fab1fc905b97fdc495cd1710118206f7c29_amd64 as a component of Red Hat OpenStack Platform 17.1
  • rhosp-rhel9/osp-director-operator-bundle@sha256:6747f43ab7ffa76b852b0d0f7b625dcc47a7cbfb3d9af12d8d2efd84feb0822d_amd64 as a component of Red Hat OpenStack Platform 17.1
  • rhosp-rhel9/osp-director-operator@sha256:35affb25a019adfaf3c4dc5f3a4da21b30eae321f0138d75be5ab9fc88da0141_amd64 as a component of Red Hat OpenStack Platform 17.1

✅ Remediation

The container images provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io or registry.access.redhat.com using the 'podman pull' command. For more information about the images, search the image name in the Red Hat Ecosystem Catalog: https://catalog.redhat.com/software/containers/search Workaround: No mitigation is available for this flaw. Workaround: In some environments where http/2 support is not required, it may be possible to disable this feature to reduce risk. Workaround: Update to the last version and check that client and server provide kex pseudo-algorithms indicating usage of the updated version of the protocol which is protected from the attack. If "[email protected]" is provided by clients and "[email protected]" is in the server's reply, no other steps are necessary. Disabling ciphers if necessary: If "[email protected]" is not provided by clients or "[email protected]" is absent in the server's reply, you can disable the following ciphers and HMACs as a workaround on RHEL-8 and RHEL-9: 1. [email protected] 2. [email protected] 3. [email protected] 4. [email protected] 5. [email protected] To do that through crypto-policies, one can apply a subpolicy with the following content: ``` cipher@SSH = -CHACHA20-POLY1305 ssh_etm = 0 ``` e.g., by putting these lines into `/etc/crypto-policies/policies/modules/CVE-2023-48795.pmod`, applying the resulting subpolicy with `update-crypto-policies --set $(update-crypto-policies --show):CVE-2023-48795` and restarting openssh server. One can verify that the changes are in effect by ensuring the ciphers listed above are missing from both `/etc/crypto-policies/back-ends/openssh.config` and `/etc/crypto-policies/back-ends/opensshserver.config`. For more details on using crypto-policies, please refer to https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/security_hardening/using-the-system-wide-cryptographic-policies_security-hardening Note that this procedure does limit the interoperability of the host and is only suggested as a temporary mitigation until the issue is fully resolved with an update. For RHEL-7: We can recommend to use strict MACs and Ciphers on RHEL7 in both files /etc/ssh/ssh_config and /etc/ssh/sshd_config. Below strict set of Ciphers and MACs can be used as mitigation for RHEL 7. ``` Ciphers aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected] MACs [email protected],[email protected],hmac-sha2-256,hmac-sha2-512 ``` - For Openshift Container Platform 4: Please refer the KCS[1] document for verifying the fix in RHCOS. [1] https://access.redhat.com/solutions/7071748

🔗 References (10)