VDB
RHBA-2023%3A5806
RHBA-2023%3A5806
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RST_STREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any server-side limit for the maximum number of active streams per connection, resulting in a denial of service due to server resource consumption. Red Hat has rated the severity of this flaw as 'Important' as the US Cybersecurity and Infrastructure Security Agency (CISA) declared this vulnerability an active exploit. CVE-2023-39325 was assigned for the `Rapid Reset Attack` in the Go language packages.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | ansible-automation-platform-24/ansible-python-toolkit-rhel9@sha256:bc376892f777fade4e725e140ae195ee94bd2f3c8e97b86a2705cbe23fa1875e_amd64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9 | ansible-automation-platform-24/ansible-python-toolkit-rhel9@sha256:bc376892f777fade4e725e140ae195ee94bd2f3c8e97b86a2705cbe23fa1875e_amd64, ansible-automation-platform-24/ansible-python-toolkit-rhel9@sha256:bc376892f777fade4e725e140ae195ee94bd2f3c8e97b86a2705cbe23fa1875e_amd64, ansible-automation-platform-24/ansible-python-toolkit-rhel9@sha256:bc376892f777fade4e725e140ae195ee94bd2f3c8e97b86a2705cbe23fa1875e_amd64 |
| Red Hat | ansible-automation-platform-24/controller-rhel8-operator@sha256:07a798fdc9b88ce7332a1300475e3a56d439b55a7ad5e10fd8d4e036661841cd_amd64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8 | *, *, * |
| Red Hat | ansible-automation-platform-24/ee-dellemc-openmanage-rhel8@sha256:628f7596505a9ab111cfcd1d3a1eb11e537dbf663d9b802e3cc94af8dbfa05d6_arm64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8 | ansible-automation-platform-24/ee-dellemc-openmanage-rhel8@sha256:628f7596505a9ab111cfcd1d3a1eb11e537dbf663d9b802e3cc94af8dbfa05d6_arm64, ansible-automation-platform-24/ee-dellemc-openmanage-rhel8@sha256:628f7596505a9ab111cfcd1d3a1eb11e537dbf663d9b802e3cc94af8dbfa05d6_arm64, ansible-automation-platform-24/ee-dellemc-openmanage-rhel8@sha256:628f7596505a9ab111cfcd1d3a1eb11e537dbf663d9b802e3cc94af8dbfa05d6_arm64 |
| Red Hat | ansible-automation-platform-24/hub-rhel8-operator@sha256:f38fcf5efc4501f3111484cd9c5216f4014fcfd0088d4dd3ad6c14ad76dbe83a_amd64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8 | ansible-automation-platform-24/hub-rhel8-operator@sha256:f38fcf5efc4501f3111484cd9c5216f4014fcfd0088d4dd3ad6c14ad76dbe83a_amd64, *, ansible-automation-platform-24/hub-rhel8-operator@sha256:f38fcf5efc4501f3111484cd9c5216f4014fcfd0088d4dd3ad6c14ad76dbe83a_amd64 |
| Red Hat | ansible-automation-platform-24/eda-controller-ui-rhel8@sha256:88f5e52c33ca6ff00cb1fd37753a2b1f9e4b6b2a07977e68b71262a8d7a4c58b_ppc64le as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8 | ansible-automation-platform-24/eda-controller-ui-rhel8@sha256:88f5e52c33ca6ff00cb1fd37753a2b1f9e4b6b2a07977e68b71262a8d7a4c58b_ppc64le, *, * |
| Red Hat | ansible-automation-platform-24/hub-web-rhel8@sha256:0b7d67480c6a15e5a655573f2ac885d34df441978f8f595f8c4d9f5e93c052d1_arm64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8 | *, *, * |
| Red Hat | ansible-automation-platform-24/de-minimal-rhel9@sha256:f28e22e5da55ea626890aceb7ae4c391e192055a60a1beba9a98ac70ee1353ce_arm64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9 | *, ansible-automation-platform-24/de-minimal-rhel9@sha256:f28e22e5da55ea626890aceb7ae4c391e192055a60a1beba9a98ac70ee1353ce_arm64, * |
| Red Hat | ansible-automation-platform-24/platform-resource-runner-rhel8@sha256:38bc442a6181a739b4c232d25abd7018dbce05083f3bf09ab7a071a3d2a4c7b4_ppc64le as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8 | *, ansible-automation-platform-24/platform-resource-runner-rhel8@sha256:38bc442a6181a739b4c232d25abd7018dbce05083f3bf09ab7a071a3d2a4c7b4_ppc64le, ansible-automation-platform-24/platform-resource-runner-rhel8@sha256:38bc442a6181a739b4c232d25abd7018dbce05083f3bf09ab7a071a3d2a4c7b4_ppc64le |
| Red Hat | ansible-automation-platform-24/aap-must-gather-rhel8@sha256:ba77e7f17865da4d59f91b69ab58cbeafaa86debe50d2d6fb89e9812f4aed1c7_s390x as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8 | ansible-automation-platform-24/aap-must-gather-rhel8@sha256:ba77e7f17865da4d59f91b69ab58cbeafaa86debe50d2d6fb89e9812f4aed1c7_s390x, *, * |
| Red Hat | ansible-automation-platform-24/eda-controller-rhel8@sha256:7d75552ba2d42b0f85695e9a71ff71dd781bce0452590d89c12a8fc9f1a501ff_s390x as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8 | *, *, * |
| Red Hat | ansible-automation-platform-24/ee-supported-rhel9@sha256:23ed9a9439c4651417dd96d62776ca40582b54fc5da2955a72b047608c0d6c42_amd64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9 | ansible-automation-platform-24/ee-supported-rhel9@sha256:23ed9a9439c4651417dd96d62776ca40582b54fc5da2955a72b047608c0d6c42_amd64, ansible-automation-platform-24/ee-supported-rhel9@sha256:23ed9a9439c4651417dd96d62776ca40582b54fc5da2955a72b047608c0d6c42_amd64, ansible-automation-platform-24/ee-supported-rhel9@sha256:23ed9a9439c4651417dd96d62776ca40582b54fc5da2955a72b047608c0d6c42_amd64 |
| Red Hat | ansible-automation-platform/platform-operator-bundle@sha256:5825e694ae618fd41f495a7d5b9f911da004a9649aa09ca66ad64d3812a884d9_amd64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8 | *, *, ansible-automation-platform/platform-operator-bundle@sha256:5825e694ae618fd41f495a7d5b9f911da004a9649aa09ca66ad64d3812a884d9_amd64 |
| Red Hat | ansible-automation-platform-24/aap-must-gather-rhel8@sha256:53a9a6779f8569b03faec060888f39d2d3f071d3a4af8269f66490abd8bfad7e_arm64 | |
| Red Hat | ansible-automation-platform-24/eda-controller-rhel8-operator@sha256:683b9705958bb94e2f3fa8901c19ffd4d2a3967104fec3a969a46fa7e5702507_arm64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8 | ansible-automation-platform-24/eda-controller-rhel8-operator@sha256:683b9705958bb94e2f3fa8901c19ffd4d2a3967104fec3a969a46fa7e5702507_arm64, *, * |
| Red Hat | ansible-automation-platform-24/ee-supported-rhel9@sha256:e49a3d2b7456a55b603e78b8ddec27665b6a957f5ac479aad50123f3f9bb1d42_s390x as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9 | ansible-automation-platform-24/ee-supported-rhel9@sha256:e49a3d2b7456a55b603e78b8ddec27665b6a957f5ac479aad50123f3f9bb1d42_s390x, *, * |
| Red Hat | ansible-automation-platform-24/controller-rhel8@sha256:c8fdd92c3c2c497ab1d4ba8c96759e8f2dfe7f023df6c5021dfed672c98d0621_arm64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8 | *, ansible-automation-platform-24/controller-rhel8@sha256:c8fdd92c3c2c497ab1d4ba8c96759e8f2dfe7f023df6c5021dfed672c98d0621_arm64, * |
| Red Hat | ansible-automation-platform-24/platform-resource-rhel8-operator@sha256:964337aac284059c1abde17a9bd2c0d13fd5a149a91af19eb56944728f7f5584_arm64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8 | ansible-automation-platform-24/platform-resource-rhel8-operator@sha256:964337aac284059c1abde17a9bd2c0d13fd5a149a91af19eb56944728f7f5584_arm64, *, ansible-automation-platform-24/platform-resource-rhel8-operator@sha256:964337aac284059c1abde17a9bd2c0d13fd5a149a91af19eb56944728f7f5584_arm64 |
| Red Hat | ansible-automation-platform-24/ansible-python-base-rhel9@sha256:7ecc021d626a20acc20f73b28005c16a8d20c7640ec51dffdaff236440702172_amd64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9 | *, *, * |
| Red Hat | ansible-automation-platform-24/eda-controller-ui-rhel8@sha256:88f5e52c33ca6ff00cb1fd37753a2b1f9e4b6b2a07977e68b71262a8d7a4c58b_ppc64le as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8 | ansible-automation-platform-24/eda-controller-ui-rhel8@sha256:88f5e52c33ca6ff00cb1fd37753a2b1f9e4b6b2a07977e68b71262a8d7a4c58b_ppc64le, *, * |
| Red Hat | ansible-automation-platform-24/hub-web-rhel8@sha256:ff2db93490c489562bb8c37a247daf01e10c871e628b24cc4006dd2bd14473bb_s390x as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8 | *, *, * |
…and 213 more
Timeline
- Oct 17, 2023 CVE Published
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Jun 19, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHBA-2023:5806 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhba-2023_5806.json advisory
- https://access.redhat.com/security/cve/CVE-2023-39325 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2243296 issue
- https://access.redhat.com/security/vulnerabilities/RHSB-2023-003 advisory
- https://www.cve.org/CVERecord?id=CVE-2023-39325 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-39325 advisory
- https://access.redhat.com/security/cve/CVE-2023-44487 advisory
- https://go.dev/issue/63417 advisory
- https://pkg.go.dev/vuln/GO-2023-2102 advisory
- https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2242803 issue
- https://www.cve.org/CVERecord?id=CVE-2023-44487 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-44487 advisory
- https://github.com/dotnet/announcements/issues/277 advisory
- https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog exploit