VDB
RHSA-2023%3A7345
RHSA-2023%3A7345
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RST_STREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any server-side limit for the maximum number of active streams per connection, resulting in a denial of service due to server resource consumption. Red Hat has rated the severity of this flaw as 'Important' as the US Cybersecurity and Infrastructure Security Agency (CISA) declared this vulnerability an active exploit. CVE-2023-39325 was assigned for the `Rapid Reset Attack` in the Go language packages.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift-gitops-1/kam-delivery-rhel8@sha256:b6864990dd11208362570ff7642baf33d96690a9547ddb71403f5deb5578a761_s390x as a component of Red Hat OpenShift GitOps 1.9 | openshift-gitops-1/kam-delivery-rhel8@sha256:b6864990dd11208362570ff7642baf33d96690a9547ddb71403f5deb5578a761_s390x, openshift-gitops-1/kam-delivery-rhel8@sha256:b6864990dd11208362570ff7642baf33d96690a9547ddb71403f5deb5578a761_s390x, openshift-gitops-1/kam-delivery-rhel8@sha256:b6864990dd11208362570ff7642baf33d96690a9547ddb71403f5deb5578a761_s390x |
| Red Hat | openshift-gitops-1/console-plugin-rhel8@sha256:21bff8ab1b76db1507a96432d49df4e537ed66d1fed1c96434bde10bfdd62059_ppc64le as a component of Red Hat OpenShift GitOps 1.9 | *, openshift-gitops-1/console-plugin-rhel8@sha256:21bff8ab1b76db1507a96432d49df4e537ed66d1fed1c96434bde10bfdd62059_ppc64le, openshift-gitops-1/console-plugin-rhel8@sha256:21bff8ab1b76db1507a96432d49df4e537ed66d1fed1c96434bde10bfdd62059_ppc64le |
| Red Hat | openshift-gitops-1/gitops-rhel8@sha256:1e4441c4b21af05b97b4f4d5fdae767721ecc645a43f63611d18d3de87498805_arm64 as a component of Red Hat OpenShift GitOps 1.9 | *, openshift-gitops-1/gitops-rhel8@sha256:1e4441c4b21af05b97b4f4d5fdae767721ecc645a43f63611d18d3de87498805_arm64, openshift-gitops-1/gitops-rhel8@sha256:1e4441c4b21af05b97b4f4d5fdae767721ecc645a43f63611d18d3de87498805_arm64 |
| Red Hat | openshift-gitops-1/gitops-operator-bundle@sha256:d8725149c57d5de6c5c10d472cfd54721e8f8bf12e66e34c0311103a835a3081_amd64 as a component of Red Hat OpenShift GitOps 1.9 | openshift-gitops-1/gitops-operator-bundle@sha256:d8725149c57d5de6c5c10d472cfd54721e8f8bf12e66e34c0311103a835a3081_amd64, openshift-gitops-1/gitops-operator-bundle@sha256:d8725149c57d5de6c5c10d472cfd54721e8f8bf12e66e34c0311103a835a3081_amd64, openshift-gitops-1/gitops-operator-bundle@sha256:d8725149c57d5de6c5c10d472cfd54721e8f8bf12e66e34c0311103a835a3081_amd64 |
| Red Hat | openshift-gitops-1/dex-rhel8@sha256:14b1e455f6ba59777aec0298b64a21cf40d89429dcbc3dd59ad2f30c649d6f5f_ppc64le as a component of Red Hat OpenShift GitOps 1.9 | openshift-gitops-1/dex-rhel8@sha256:14b1e455f6ba59777aec0298b64a21cf40d89429dcbc3dd59ad2f30c649d6f5f_ppc64le, *, openshift-gitops-1/dex-rhel8@sha256:14b1e455f6ba59777aec0298b64a21cf40d89429dcbc3dd59ad2f30c649d6f5f_ppc64le |
| Red Hat | openshift-gitops-1/kam-delivery-rhel8@sha256:6bdef15c447107069382c76cbf89faccbc116ec62c9be9231b0a8edc0e63c0a5_ppc64le as a component of Red Hat OpenShift GitOps 1.9 | *, openshift-gitops-1/kam-delivery-rhel8@sha256:6bdef15c447107069382c76cbf89faccbc116ec62c9be9231b0a8edc0e63c0a5_ppc64le, openshift-gitops-1/kam-delivery-rhel8@sha256:6bdef15c447107069382c76cbf89faccbc116ec62c9be9231b0a8edc0e63c0a5_ppc64le |
| Red Hat | openshift-gitops-1/argocd-rhel8@sha256:bd8aa96326b5c5e649634489941e19bc17cbe04bfeb00d1b362d7afe98277594_arm64 as a component of Red Hat OpenShift GitOps 1.9 | openshift-gitops-1/argocd-rhel8@sha256:bd8aa96326b5c5e649634489941e19bc17cbe04bfeb00d1b362d7afe98277594_arm64, openshift-gitops-1/argocd-rhel8@sha256:bd8aa96326b5c5e649634489941e19bc17cbe04bfeb00d1b362d7afe98277594_arm64, openshift-gitops-1/argocd-rhel8@sha256:bd8aa96326b5c5e649634489941e19bc17cbe04bfeb00d1b362d7afe98277594_arm64 |
| Red Hat | openshift-gitops-1/console-plugin-rhel8@sha256:84dee8a0455dca910bab7407bb8bc3151f788ae991aa9c7d9380e8c7c1a4014c_s390x as a component of Red Hat OpenShift GitOps 1.9 | *, *, * |
| Red Hat | openshift-gitops-1/dex-rhel8@sha256:f58dc92bdffd95385a51ecdff7677b49cc85b0a7718ca5f69301e6711a9bf04c_arm64 as a component of Red Hat OpenShift GitOps 1.9 | openshift-gitops-1/dex-rhel8@sha256:f58dc92bdffd95385a51ecdff7677b49cc85b0a7718ca5f69301e6711a9bf04c_arm64, openshift-gitops-1/dex-rhel8@sha256:f58dc92bdffd95385a51ecdff7677b49cc85b0a7718ca5f69301e6711a9bf04c_arm64, openshift-gitops-1/dex-rhel8@sha256:f58dc92bdffd95385a51ecdff7677b49cc85b0a7718ca5f69301e6711a9bf04c_arm64 |
| Red Hat | openshift-gitops-1/gitops-rhel8@sha256:97acdfe9b2fba3a37f01e91efb4074eadcec204414ae7f2c0a426b71af60288c_amd64 as a component of Red Hat OpenShift GitOps 1.9 | openshift-gitops-1/gitops-rhel8@sha256:97acdfe9b2fba3a37f01e91efb4074eadcec204414ae7f2c0a426b71af60288c_amd64, openshift-gitops-1/gitops-rhel8@sha256:97acdfe9b2fba3a37f01e91efb4074eadcec204414ae7f2c0a426b71af60288c_amd64, * |
| Red Hat | openshift-gitops-1/must-gather-rhel8@sha256:3eb502b1ef4886e5300c5cac0252f9000f1c71bb6c5f1a93758d01d36654be7e_arm64 as a component of Red Hat OpenShift GitOps 1.9 | *, openshift-gitops-1/must-gather-rhel8@sha256:3eb502b1ef4886e5300c5cac0252f9000f1c71bb6c5f1a93758d01d36654be7e_arm64, * |
| Red Hat | openshift-gitops-1/gitops-rhel8-operator@sha256:32da9518faee368da0902ba87c1ed95a03e75ea344a31c9af19a96a436a6ddf3_arm64 as a component of Red Hat OpenShift GitOps 1.9 | openshift-gitops-1/gitops-rhel8-operator@sha256:32da9518faee368da0902ba87c1ed95a03e75ea344a31c9af19a96a436a6ddf3_arm64, openshift-gitops-1/gitops-rhel8-operator@sha256:32da9518faee368da0902ba87c1ed95a03e75ea344a31c9af19a96a436a6ddf3_arm64, openshift-gitops-1/gitops-rhel8-operator@sha256:32da9518faee368da0902ba87c1ed95a03e75ea344a31c9af19a96a436a6ddf3_arm64 |
| Red Hat | openshift-gitops-1/argo-rollouts-rhel8@sha256:5dda4516e7dd63cc711cd18e0569cdac873c2a3ae3bf41fd7645384e1aea0952_arm64 as a component of Red Hat OpenShift GitOps 1.9 | *, *, openshift-gitops-1/argo-rollouts-rhel8@sha256:5dda4516e7dd63cc711cd18e0569cdac873c2a3ae3bf41fd7645384e1aea0952_arm64 |
| Red Hat | openshift-gitops-1/console-plugin-rhel8@sha256:7c05fd1be9aa7427e565544975f7f85d4600c7eabfd22ff4f07e057e566496eb_arm64 as a component of Red Hat OpenShift GitOps 1.9 | openshift-gitops-1/console-plugin-rhel8@sha256:7c05fd1be9aa7427e565544975f7f85d4600c7eabfd22ff4f07e057e566496eb_arm64, *, openshift-gitops-1/console-plugin-rhel8@sha256:7c05fd1be9aa7427e565544975f7f85d4600c7eabfd22ff4f07e057e566496eb_arm64 |
| Red Hat | openshift-gitops-1/kam-delivery-rhel8@sha256:9903bb78e5d0cc39d314e9bdaecf902ac4d24bee3f11b7658caaa381253c81c1_arm64 as a component of Red Hat OpenShift GitOps 1.9 | openshift-gitops-1/kam-delivery-rhel8@sha256:9903bb78e5d0cc39d314e9bdaecf902ac4d24bee3f11b7658caaa381253c81c1_arm64, *, openshift-gitops-1/kam-delivery-rhel8@sha256:9903bb78e5d0cc39d314e9bdaecf902ac4d24bee3f11b7658caaa381253c81c1_arm64 |
| Red Hat | openshift-gitops-1/argocd-rhel8@sha256:fbd5576fa614602b26677e91136d0c9c4722e0eb09672e3784ebdfe71737d3bd_amd64 as a component of Red Hat OpenShift GitOps 1.9 | openshift-gitops-1/argocd-rhel8@sha256:fbd5576fa614602b26677e91136d0c9c4722e0eb09672e3784ebdfe71737d3bd_amd64, openshift-gitops-1/argocd-rhel8@sha256:fbd5576fa614602b26677e91136d0c9c4722e0eb09672e3784ebdfe71737d3bd_amd64, openshift-gitops-1/argocd-rhel8@sha256:fbd5576fa614602b26677e91136d0c9c4722e0eb09672e3784ebdfe71737d3bd_amd64 |
| Red Hat | openshift-gitops-1/gitops-rhel8-operator@sha256:d491c7c8525393b4dc8277fae5639ee41ae4d6bbada83a212742e9683877f0b0_amd64 as a component of Red Hat OpenShift GitOps 1.9 | openshift-gitops-1/gitops-rhel8-operator@sha256:d491c7c8525393b4dc8277fae5639ee41ae4d6bbada83a212742e9683877f0b0_amd64, openshift-gitops-1/gitops-rhel8-operator@sha256:d491c7c8525393b4dc8277fae5639ee41ae4d6bbada83a212742e9683877f0b0_amd64, openshift-gitops-1/gitops-rhel8-operator@sha256:d491c7c8525393b4dc8277fae5639ee41ae4d6bbada83a212742e9683877f0b0_amd64 |
| Red Hat | openshift-gitops-1/gitops-rhel8@sha256:21f03d5337d4177a908f63ce3558bc130a045fc45c6f6a4d2783de4e4b555e21_ppc64le as a component of Red Hat OpenShift GitOps 1.9 | openshift-gitops-1/gitops-rhel8@sha256:21f03d5337d4177a908f63ce3558bc130a045fc45c6f6a4d2783de4e4b555e21_ppc64le, openshift-gitops-1/gitops-rhel8@sha256:21f03d5337d4177a908f63ce3558bc130a045fc45c6f6a4d2783de4e4b555e21_ppc64le, openshift-gitops-1/gitops-rhel8@sha256:21f03d5337d4177a908f63ce3558bc130a045fc45c6f6a4d2783de4e4b555e21_ppc64le |
| Red Hat | openshift-gitops-1/console-plugin-rhel8@sha256:21bff8ab1b76db1507a96432d49df4e537ed66d1fed1c96434bde10bfdd62059_ppc64le as a component of Red Hat OpenShift GitOps 1.9 | *, openshift-gitops-1/console-plugin-rhel8@sha256:21bff8ab1b76db1507a96432d49df4e537ed66d1fed1c96434bde10bfdd62059_ppc64le, openshift-gitops-1/console-plugin-rhel8@sha256:21bff8ab1b76db1507a96432d49df4e537ed66d1fed1c96434bde10bfdd62059_ppc64le |
| Red Hat | openshift-gitops-1/kam-delivery-rhel8@sha256:b6864990dd11208362570ff7642baf33d96690a9547ddb71403f5deb5578a761_s390x as a component of Red Hat OpenShift GitOps 1.9 | *, *, * |
…and 47 more
Timeline
- Nov 20, 2023 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- May 21, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2023:7345 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://access.redhat.com/security/vulnerabilities/RHSB-2023-003 advisory
- https://docs.openshift.com/gitops/1.9/understanding_openshift_gitops/about-redhat-openshift-gitops.html advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2242803 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2243296 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7345.json advisory
- https://access.redhat.com/security/cve/CVE-2023-39325 advisory
- https://www.cve.org/CVERecord?id=CVE-2023-39325 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-39325 advisory
- https://access.redhat.com/security/cve/CVE-2023-44487 advisory
- https://go.dev/issue/63417 advisory
- https://pkg.go.dev/vuln/GO-2023-2102 advisory
- https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487 advisory
- https://www.cve.org/CVERecord?id=CVE-2023-44487 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-44487 advisory
- https://github.com/dotnet/announcements/issues/277 advisory
- https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog exploit