VDB
RHSA-2023%3A1816
RHSA-2023%3A1816
PUBLISHED
CVSS 5.300000190734863 MEDIUM
A flaw was found in the net/http library of the golang package. This flaw allows an attacker to cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.
Risk Scores
CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | odf4/mcg-rhel8-operator@sha256:6e707cf70c75e3ffe056c741e8f8a743f9274c31136e1e6b0d54849f97f9e839_s390x as a component of RHODF 4.12 for RHEL 8 | odf4/mcg-rhel8-operator@sha256:6e707cf70c75e3ffe056c741e8f8a743f9274c31136e1e6b0d54849f97f9e839_s390x |
| Red Hat | odf4/odf-csi-addons-rhel8-operator@sha256:34c31af6bc9075c1e87707424bbd73b2cd958a60a66c6ab2b0b9d0dd5cf43d71_amd64 as a component of RHODF 4.12 for RHEL 8 | odf4/odf-csi-addons-rhel8-operator@sha256:34c31af6bc9075c1e87707424bbd73b2cd958a60a66c6ab2b0b9d0dd5cf43d71_amd64 |
| Red Hat | odf4/odr-rhel8-operator@sha256:120ed6dbb7c2001e81ba53ec2a64f5ee8e5108ff65ffbda481cb37b8c548e40f_s390x as a component of RHODF 4.12 for RHEL 8 | odf4/odr-rhel8-operator@sha256:120ed6dbb7c2001e81ba53ec2a64f5ee8e5108ff65ffbda481cb37b8c548e40f_s390x |
| Red Hat | odf4/ocs-operator-bundle@sha256:5a7eb94cbe7c3c3beb5b0b578a594db5b21952a917b80d5d144fd131983136f6_amd64 as a component of RHODF 4.12 for RHEL 8 | odf4/ocs-operator-bundle@sha256:5a7eb94cbe7c3c3beb5b0b578a594db5b21952a917b80d5d144fd131983136f6_amd64 |
| Red Hat | odf4/mcg-core-rhel8@sha256:b6259101dd506a40cf2ada869a74c6dfee70c962ef33059beb93a566fc6a7352_s390x as a component of RHODF 4.12 for RHEL 8 | odf4/mcg-core-rhel8@sha256:b6259101dd506a40cf2ada869a74c6dfee70c962ef33059beb93a566fc6a7352_s390x |
| Red Hat | odf4/odf-multicluster-console-rhel8@sha256:f91d25a2921acf5dd00c1e02d5004369fb774ac35e74d2ca700707463abc3de9_amd64 as a component of RHODF 4.12 for RHEL 8 | odf4/odf-multicluster-console-rhel8@sha256:f91d25a2921acf5dd00c1e02d5004369fb774ac35e74d2ca700707463abc3de9_amd64 |
| Red Hat | odf4/odf-multicluster-console-rhel8@sha256:f91d25a2921acf5dd00c1e02d5004369fb774ac35e74d2ca700707463abc3de9_amd64 as a component of RHODF 4.12 for RHEL 8 | odf4/odf-multicluster-console-rhel8@sha256:f91d25a2921acf5dd00c1e02d5004369fb774ac35e74d2ca700707463abc3de9_amd64 |
| Red Hat | odf4/odf-operator-bundle@sha256:ed4edaaa3aff9484ad8edf73b79674239b08e46b47783a32c2cdd30580a76f65_amd64 as a component of RHODF 4.12 for RHEL 8 | * |
| Red Hat | odf4/ocs-must-gather-rhel8@sha256:f8bb8fc209169c07136bf564d008dc945022d91a2b9701a2c26a8c9e119e48ae_s390x as a component of RHODF 4.12 for RHEL 8 | * |
| Red Hat | odf4/odf-csi-addons-sidecar-rhel8@sha256:279143d15ee81346544f3d349c31ceca4a961b7a0335ef244897b6f9539b0853_ppc64le as a component of RHODF 4.12 for RHEL 8 | * |
| Red Hat | odf4/odf-multicluster-rhel8-operator@sha256:457dc81080a0b9eb0920edf2f4b485b004bd052b2aed5f67271deeface6d5bcb_ppc64le as a component of RHODF 4.12 for RHEL 8 | odf4/odf-multicluster-rhel8-operator@sha256:457dc81080a0b9eb0920edf2f4b485b004bd052b2aed5f67271deeface6d5bcb_ppc64le |
| Red Hat | odf4/odr-cluster-operator-bundle@sha256:ea93d88a9abce4772f7fea2e1833d708f70261c99e4954fd1917d8ee8af3105e_s390x as a component of RHODF 4.12 for RHEL 8 | odf4/odr-cluster-operator-bundle@sha256:ea93d88a9abce4772f7fea2e1833d708f70261c99e4954fd1917d8ee8af3105e_s390x |
| Red Hat | odf4/odf-rhel8-operator@sha256:93687d26b46bc7de5341a5e11a8040fcf47faaf8a21ce6dfd2128a00ede4ba40_amd64 as a component of RHODF 4.12 for RHEL 8 | odf4/odf-rhel8-operator@sha256:93687d26b46bc7de5341a5e11a8040fcf47faaf8a21ce6dfd2128a00ede4ba40_amd64 |
| Red Hat | odf4/odf-csi-addons-rhel8-operator@sha256:81d995804e8323c5d3f8d97e4cfe3994f8557a570d95ef54d3a3fdb92983e36a_ppc64le as a component of RHODF 4.12 for RHEL 8 | odf4/odf-csi-addons-rhel8-operator@sha256:81d995804e8323c5d3f8d97e4cfe3994f8557a570d95ef54d3a3fdb92983e36a_ppc64le |
| Red Hat | odf4/odf-csi-addons-operator-bundle@sha256:eb9a4f71876b95ae09ff265bd775213e5ab5a0a52df72b0e81a235ef9b4dfa0c_ppc64le as a component of RHODF 4.12 for RHEL 8 | odf4/odf-csi-addons-operator-bundle@sha256:eb9a4f71876b95ae09ff265bd775213e5ab5a0a52df72b0e81a235ef9b4dfa0c_ppc64le |
| Red Hat | odf4/ocs-must-gather-rhel8@sha256:d9869214ad82dbe0822c6d2fc6e68d3cc5f136eea360c6aa35ef80fc042e0e4f_ppc64le as a component of RHODF 4.12 for RHEL 8 | odf4/ocs-must-gather-rhel8@sha256:d9869214ad82dbe0822c6d2fc6e68d3cc5f136eea360c6aa35ef80fc042e0e4f_ppc64le |
| Red Hat | odf4/ocs-metrics-exporter-rhel8@sha256:0c16859624d28c4ead088206ffe90a931950846a3f468ffe4180384fafb2e914_amd64 as a component of RHODF 4.12 for RHEL 8 | odf4/ocs-metrics-exporter-rhel8@sha256:0c16859624d28c4ead088206ffe90a931950846a3f468ffe4180384fafb2e914_amd64 |
| Red Hat | odf4/odr-cluster-operator-bundle@sha256:34a6065837c1298716257cf0d393d2976d617442690ef476d18f582d179f933f_ppc64le as a component of RHODF 4.12 for RHEL 8 | odf4/odr-cluster-operator-bundle@sha256:34a6065837c1298716257cf0d393d2976d617442690ef476d18f582d179f933f_ppc64le |
| Red Hat | odf4/odf-rhel8-operator@sha256:ab710ac2f356c8328dddbd1471b0952ffd529de61630dd0d3702e8f9ab17834a_s390x as a component of RHODF 4.12 for RHEL 8 | odf4/odf-rhel8-operator@sha256:ab710ac2f356c8328dddbd1471b0952ffd529de61630dd0d3702e8f9ab17834a_s390x |
| Red Hat | odf4/cephcsi-rhel8@sha256:02a45a4526c44cd9723abb0e155a627cd0d7e827dc11e4679ddab1067cf82239_amd64 as a component of RHODF 4.12 for RHEL 8 | odf4/cephcsi-rhel8@sha256:02a45a4526c44cd9723abb0e155a627cd0d7e827dc11e4679ddab1067cf82239_amd64 |
…and 106 more
Timeline
- Apr 17, 2023 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 30, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2023:1816 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2161274 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2171968 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2174335 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2175365 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2179978 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2183198 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2186455 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1816.json advisory
- https://access.redhat.com/security/cve/CVE-2022-41717 advisory
- https://www.cve.org/CVERecord?id=CVE-2022-41717 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-41717 advisory
- https://go.dev/cl/455635 advisory
- https://go.dev/cl/455717 advisory
- https://go.dev/issue/56350 advisory
- https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ advisory
- https://pkg.go.dev/vuln/GO-2022-1144 advisory