VDB
RHSA-2023%3A1181
RHSA-2023%3A1181
PUBLISHED
CVSS 5.300000190734863 MEDIUM
A flaw was found in the net/http library of the golang package. This flaw allows an attacker to cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.
Risk Scores
CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift-serverless-1/eventing-kafka-broker-receiver-rhel8@sha256:4145c6887f1dbdc9fec9009409359ce1825d9b3a1dd943fa0d9cb61ca9b17884_s390x as a component of Red Hat OpenShift Serverless 1.27 | * |
| Red Hat | openshift-serverless-1/knative-rhel8-operator@sha256:99f30bae7f82cb97002cab5a43e71fce3ec974949b9fdc68ce555a37b80633c1_ppc64le as a component of Red Hat OpenShift Serverless 1.27 | openshift-serverless-1/knative-rhel8-operator@sha256:99f30bae7f82cb97002cab5a43e71fce3ec974949b9fdc68ce555a37b80633c1_ppc64le |
| Red Hat | openshift-serverless-1/eventing-mtping-rhel8@sha256:6fdf8cd6badf82aa533a3cd60eae73c60a4a664a93a022d7726c666d82a509d4_ppc64le as a component of Red Hat OpenShift Serverless 1.27 | * |
| Red Hat | openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8@sha256:6c60257df788dc2d94f5f2d6b68267ce9ef836174f729923c07a3b4cf2892fb4_ppc64le as a component of Red Hat OpenShift Serverless 1.27 | openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8@sha256:6c60257df788dc2d94f5f2d6b68267ce9ef836174f729923c07a3b4cf2892fb4_ppc64le |
| Red Hat | openshift-serverless-1/serving-activator-rhel8@sha256:22ff7fe636bbf3de0f0b5fa3995f15a28495ac676972232eebdddcdd57ff5b20_amd64 as a component of Red Hat OpenShift Serverless 1.27 | openshift-serverless-1/serving-activator-rhel8@sha256:22ff7fe636bbf3de0f0b5fa3995f15a28495ac676972232eebdddcdd57ff5b20_amd64 |
| Red Hat | openshift-serverless-1/eventing-kafka-broker-dispatcher-rhel8@sha256:5a349d3547164e6d547c3d6fae4fb28f2943a25293bb83d069347713aa665229_ppc64le as a component of Red Hat OpenShift Serverless 1.27 | openshift-serverless-1/eventing-kafka-broker-dispatcher-rhel8@sha256:5a349d3547164e6d547c3d6fae4fb28f2943a25293bb83d069347713aa665229_ppc64le |
| Red Hat | openshift-serverless-1/eventing-in-memory-channel-controller-rhel8@sha256:74f0fd3eb861035bbbddcda6545f353146973dcea6edfc2fd1c57c03a4f35c07_amd64 as a component of Red Hat OpenShift Serverless 1.27 | openshift-serverless-1/eventing-in-memory-channel-controller-rhel8@sha256:74f0fd3eb861035bbbddcda6545f353146973dcea6edfc2fd1c57c03a4f35c07_amd64 |
| Red Hat | openshift-serverless-1/svls-must-gather-rhel8@sha256:fb0a7b07b8ad7a8b522a4f8f6d8c6ecc3299aeb14abeaabd9111cad9556b27b5_ppc64le as a component of Red Hat OpenShift Serverless 1.27 | openshift-serverless-1/svls-must-gather-rhel8@sha256:fb0a7b07b8ad7a8b522a4f8f6d8c6ecc3299aeb14abeaabd9111cad9556b27b5_ppc64le |
| Red Hat | openshift-serverless-1/serverless-rhel8-operator@sha256:36bef14733dd8a330434f98a15bf4e67a991370ebd811a0ac5c2878ba14214ce_amd64 as a component of Red Hat OpenShift Serverless 1.27 | openshift-serverless-1/serverless-rhel8-operator@sha256:36bef14733dd8a330434f98a15bf4e67a991370ebd811a0ac5c2878ba14214ce_amd64 |
| Red Hat | openshift-serverless-1/kn-cli-artifacts-rhel8@sha256:2b1c564c323ef08ddce0eb253cfebda173b74182f418e505ffda57bd1fe12801_ppc64le as a component of Red Hat OpenShift Serverless 1.27 | openshift-serverless-1/kn-cli-artifacts-rhel8@sha256:2b1c564c323ef08ddce0eb253cfebda173b74182f418e505ffda57bd1fe12801_ppc64le |
| Red Hat | openshift-serverless-1/eventing-kafka-broker-controller-rhel8@sha256:05ca44d8ecda9923be00c34f0828b9009911de1f63c05f2e7fb02fd9c0723b94_ppc64le as a component of Red Hat OpenShift Serverless 1.27 | * |
| Red Hat | openshift-serverless-1/client-kn-rhel8@sha256:ac48a7428a93f159939e574b9eed11af2eae9199f0e31d4d198dc4c9589fc236_s390x as a component of Red Hat OpenShift Serverless 1.27 | openshift-serverless-1/client-kn-rhel8@sha256:ac48a7428a93f159939e574b9eed11af2eae9199f0e31d4d198dc4c9589fc236_s390x |
| Red Hat | openshift-serverless-1/serving-autoscaler-rhel8@sha256:93e77a7268bfc7d23d103ca213d144d525527a4a8e499d8584e04e6229a9b6a7_amd64 as a component of Red Hat OpenShift Serverless 1.27 | openshift-serverless-1/serving-autoscaler-rhel8@sha256:93e77a7268bfc7d23d103ca213d144d525527a4a8e499d8584e04e6229a9b6a7_amd64 |
| Red Hat | openshift-serverless-1/client-kn-rhel8@sha256:e4ac2b8953d5550fa27879ec78a8f4b475ef6c13639fe827329a228bb475ee02_amd64 as a component of Red Hat OpenShift Serverless 1.27 | * |
| Red Hat | openshift-serverless-1/func-utils-rhel8@sha256:9bcbfbd1ad910111a6bf7c0967dbe8b0b844685c7c9ab8c985f20dc408c24bf1_amd64 as a component of Red Hat OpenShift Serverless 1.27 | * |
| Red Hat | openshift-serverless-1/eventing-mtbroker-ingress-rhel8@sha256:c7470047ca9fea07d9782ef9426b744dbfe749c6cefc96d301957a91630f156d_s390x as a component of Red Hat OpenShift Serverless 1.27 | openshift-serverless-1/eventing-mtbroker-ingress-rhel8@sha256:c7470047ca9fea07d9782ef9426b744dbfe749c6cefc96d301957a91630f156d_s390x |
| Red Hat | openshift-serverless-1/func-utils-rhel8@sha256:aed5ab696c239c92eed6341eafaf74f55ed0a6773cab2244d48664a655784a73_ppc64le as a component of Red Hat OpenShift Serverless 1.27 | * |
| Red Hat | openshift-serverless-1/eventing-mtbroker-ingress-rhel8@sha256:c7470047ca9fea07d9782ef9426b744dbfe749c6cefc96d301957a91630f156d_s390x as a component of Red Hat OpenShift Serverless 1.27 | * |
| Red Hat | openshift-serverless-1/serverless-rhel8-operator@sha256:d78b7c4441f5fe4f80153d43de794de84d9be9e7c9fcfc1db0046764cf1c9add_s390x as a component of Red Hat OpenShift Serverless 1.27 | openshift-serverless-1/serverless-rhel8-operator@sha256:d78b7c4441f5fe4f80153d43de794de84d9be9e7c9fcfc1db0046764cf1c9add_s390x |
| Red Hat | openshift-serverless-1/ingress-rhel8-operator@sha256:b5e05c2024fcc38ec9b5ae5d53e8b16b34ef0bf028eb5fe7b60c65e30dadbf92_amd64 as a component of Red Hat OpenShift Serverless 1.27 | * |
…and 192 more
Timeline
- Mar 9, 2023 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 30, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2023:1181 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index advisory
- https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index advisory
- https://access.redhat.com/documentation/en-us/openshift_container_platform/4.11/html/serverless/index advisory
- https://access.redhat.com/documentation/en-us/openshift_container_platform/4.12/html/serverless/index advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2161274 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1181.json advisory
- https://access.redhat.com/security/cve/CVE-2022-41717 advisory
- https://www.cve.org/CVERecord?id=CVE-2022-41717 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-41717 advisory
- https://go.dev/cl/455635 advisory
- https://go.dev/cl/455717 advisory
- https://go.dev/issue/56350 advisory
- https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ advisory
- https://pkg.go.dev/vuln/GO-2022-1144 advisory