RHSA-2024:4118MediumCVSS 8.1

Red Hat Security Advisory: Red Hat Ceph Storage 5.3 security, bug fix, and enhancement update

Published
June 26, 2024
Last Modified
August 24, 2026

🔗 CVE IDs covered (4)

CVE-2023-39325 →CVE-2023-44487 →CVE-2023-45142 →CVE-2023-49569 →

📋 Description

CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) CVE-2023-44487 — HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) CVE-2023-45142 — opentelemetry: DoS vulnerability in otelhttp CVE-2023-49569 — go-git: Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients

🎯 Affected products200

  • Red Hat Ceph Storage 5.3 MON
  • Red Hat Ceph Storage 5.3 OSD
  • Red Hat Ceph Storage 5.3 Tools
  • ceph-2:16.2.10-266.el8cp.src as a component of Red Hat Ceph Storage 5.3 MON
  • ceph-2:16.2.10-266.el8cp.src as a component of Red Hat Ceph Storage 5.3 OSD
  • ceph-2:16.2.10-266.el8cp.src as a component of Red Hat Ceph Storage 5.3 Tools
  • ceph-2:16.2.10-266.el9cp.src as a component of Red Hat Ceph Storage 5.3 Tools
  • ceph-ansible-0:6.0.28.8-1.el8cp.noarch as a component of Red Hat Ceph Storage 5.3 Tools
  • ceph-ansible-0:6.0.28.8-1.el8cp.src as a component of Red Hat Ceph Storage 5.3 Tools
  • ceph-base-2:16.2.10-266.el8cp.ppc64le as a component of Red Hat Ceph Storage 5.3 MON
  • ceph-base-2:16.2.10-266.el8cp.ppc64le as a component of Red Hat Ceph Storage 5.3 OSD
  • ceph-base-2:16.2.10-266.el8cp.ppc64le as a component of Red Hat Ceph Storage 5.3 Tools
  • ceph-base-2:16.2.10-266.el8cp.s390x as a component of Red Hat Ceph Storage 5.3 MON
  • ceph-base-2:16.2.10-266.el8cp.s390x as a component of Red Hat Ceph Storage 5.3 OSD
  • ceph-base-2:16.2.10-266.el8cp.s390x as a component of Red Hat Ceph Storage 5.3 Tools
  • ceph-base-2:16.2.10-266.el8cp.x86_64 as a component of Red Hat Ceph Storage 5.3 MON
  • ceph-base-2:16.2.10-266.el8cp.x86_64 as a component of Red Hat Ceph Storage 5.3 OSD
  • ceph-base-2:16.2.10-266.el8cp.x86_64 as a component of Red Hat Ceph Storage 5.3 Tools
  • ceph-base-2:16.2.10-266.el9cp.ppc64le as a component of Red Hat Ceph Storage 5.3 Tools
  • ceph-base-2:16.2.10-266.el9cp.s390x as a component of Red Hat Ceph Storage 5.3 Tools
  • ceph-base-2:16.2.10-266.el9cp.x86_64 as a component of Red Hat Ceph Storage 5.3 Tools
  • ceph-base-debuginfo-2:16.2.10-266.el8cp.ppc64le as a component of Red Hat Ceph Storage 5.3 MON
  • ceph-base-debuginfo-2:16.2.10-266.el8cp.ppc64le as a component of Red Hat Ceph Storage 5.3 OSD
  • ceph-base-debuginfo-2:16.2.10-266.el8cp.ppc64le as a component of Red Hat Ceph Storage 5.3 Tools
  • ceph-base-debuginfo-2:16.2.10-266.el8cp.s390x as a component of Red Hat Ceph Storage 5.3 MON
  • ceph-base-debuginfo-2:16.2.10-266.el8cp.s390x as a component of Red Hat Ceph Storage 5.3 OSD
  • ceph-base-debuginfo-2:16.2.10-266.el8cp.s390x as a component of Red Hat Ceph Storage 5.3 Tools
  • ceph-base-debuginfo-2:16.2.10-266.el8cp.x86_64 as a component of Red Hat Ceph Storage 5.3 MON
  • ceph-base-debuginfo-2:16.2.10-266.el8cp.x86_64 as a component of Red Hat Ceph Storage 5.3 OSD
  • ceph-base-debuginfo-2:16.2.10-266.el8cp.x86_64 as a component of Red Hat Ceph Storage 5.3 Tools
  • +170 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 For supported configurations, refer to: https://access.redhat.com/articles/1548993 Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2. Workaround: Users are strongly urged to update their software as soon as fixes are available. There are several mitigation approaches for this flaw. 1. If circumstances permit, users may disable http2 endpoints to circumvent the flaw altogether until a fix is available. 2. IP-based blocking or flood protection and rate control tools may be used at network endpoints to filter incoming traffic. 3. Several package specific mitigations are also available. a. nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ b. netty: https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p c. haproxy: https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487 d. nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg e. golang: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2. Workaround: As a workaround to stop being affected otelhttp.WithFilter() can be used. For convenience and safe usage of this library, it should by default mark with the label unknown non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it. The other possibility is to disable HTTP metrics instrumentation by passing otelhttp.WithMeterProvider option with noop.NewMeterProvider. Workaround: In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.

🔗 References (19)