VDB
RHSA-2023%3A7474
RHSA-2023%3A7474
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RST_STREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any server-side limit for the maximum number of active streams per connection, resulting in a denial of service due to server resource consumption. Red Hat has rated the severity of this flaw as 'Important' as the US Cybersecurity and Infrastructure Security Agency (CISA) declared this vulnerability an active exploit. CVE-2023-39325 was assigned for the `Rapid Reset Attack` in the Go language packages.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift4/ose-helm-operator@sha256:0d964bbd6454422caa839101a390582e56644651a9b384beed252fe566a86730_arm64 as a component of Red Hat OpenShift Container Platform 4.13 | *, openshift4/ose-helm-operator@sha256:0d964bbd6454422caa839101a390582e56644651a9b384beed252fe566a86730_arm64, openshift4/ose-helm-operator@sha256:0d964bbd6454422caa839101a390582e56644651a9b384beed252fe566a86730_arm64 |
| Red Hat | openshift4/ose-sriov-network-config-daemon@sha256:2547ec78ad2be04d505c29a1af8101a09af7f02c50c4020d1e01aea303724fe9_amd64 as a component of Red Hat OpenShift Container Platform 4.13 | openshift4/ose-sriov-network-config-daemon@sha256:2547ec78ad2be04d505c29a1af8101a09af7f02c50c4020d1e01aea303724fe9_amd64, *, openshift4/ose-sriov-network-config-daemon@sha256:2547ec78ad2be04d505c29a1af8101a09af7f02c50c4020d1e01aea303724fe9_amd64 |
| Red Hat | openshift4/ose-cloud-event-proxy@sha256:a5e5c6229fc221ddce12634c01e3cc6b26af4e2963ebf6aca083d1a228b562cc_arm64 as a component of Red Hat OpenShift Container Platform 4.13 | openshift4/ose-cloud-event-proxy@sha256:a5e5c6229fc221ddce12634c01e3cc6b26af4e2963ebf6aca083d1a228b562cc_arm64, openshift4/ose-cloud-event-proxy@sha256:a5e5c6229fc221ddce12634c01e3cc6b26af4e2963ebf6aca083d1a228b562cc_arm64, openshift4/ose-cloud-event-proxy@sha256:a5e5c6229fc221ddce12634c01e3cc6b26af4e2963ebf6aca083d1a228b562cc_arm64 |
| Red Hat | openshift4/ose-cluster-kube-descheduler-operator@sha256:8968242ec95e77c1636c9b1ada2107a1660e33d34c90799a65fcd7e072a6f10e_ppc64le as a component of Red Hat OpenShift Container Platform 4.13 | openshift4/ose-cluster-kube-descheduler-operator@sha256:8968242ec95e77c1636c9b1ada2107a1660e33d34c90799a65fcd7e072a6f10e_ppc64le, openshift4/ose-cluster-kube-descheduler-operator@sha256:8968242ec95e77c1636c9b1ada2107a1660e33d34c90799a65fcd7e072a6f10e_ppc64le, openshift4/ose-cluster-kube-descheduler-operator@sha256:8968242ec95e77c1636c9b1ada2107a1660e33d34c90799a65fcd7e072a6f10e_ppc64le |
| Red Hat | openshift4/ose-node-feature-discovery@sha256:7f1e27ab6061154fbb942ef59b05ece288d15a6772671e71bda0ae05e010c537_s390x as a component of Red Hat OpenShift Container Platform 4.13 | openshift4/ose-node-feature-discovery@sha256:7f1e27ab6061154fbb942ef59b05ece288d15a6772671e71bda0ae05e010c537_s390x, openshift4/ose-node-feature-discovery@sha256:7f1e27ab6061154fbb942ef59b05ece288d15a6772671e71bda0ae05e010c537_s390x, openshift4/ose-node-feature-discovery@sha256:7f1e27ab6061154fbb942ef59b05ece288d15a6772671e71bda0ae05e010c537_s390x |
| Red Hat | openshift4/ose-node-feature-discovery@sha256:7f1e27ab6061154fbb942ef59b05ece288d15a6772671e71bda0ae05e010c537_s390x as a component of Red Hat OpenShift Container Platform 4.13 | openshift4/ose-node-feature-discovery@sha256:7f1e27ab6061154fbb942ef59b05ece288d15a6772671e71bda0ae05e010c537_s390x, *, * |
| Red Hat | openshift4/ose-vertical-pod-autoscaler-rhel8-operator@sha256:09161537b3cebd77ad5ffab354ccb54e0eb6fcf29f47ac6f1019e414f139252c_s390x as a component of Red Hat OpenShift Container Platform 4.13 | *, *, openshift4/ose-vertical-pod-autoscaler-rhel8-operator@sha256:09161537b3cebd77ad5ffab354ccb54e0eb6fcf29f47ac6f1019e414f139252c_s390x |
| Red Hat | openshift4/ose-cluster-capacity@sha256:0f9902c09e59ecfe7926ab77e8b95293a38419d48f77429c6155f97d525f903f_ppc64le as a component of Red Hat OpenShift Container Platform 4.13 | *, openshift4/ose-cluster-capacity@sha256:0f9902c09e59ecfe7926ab77e8b95293a38419d48f77429c6155f97d525f903f_ppc64le, * |
| Red Hat | openshift4/ose-local-storage-diskmaker@sha256:2eb3b2b4ab0c71b637d1a360be2dd1e538d53c63992b4f4ba6ab37b964f1506b_s390x as a component of Red Hat OpenShift Container Platform 4.13 | *, openshift4/ose-local-storage-diskmaker@sha256:2eb3b2b4ab0c71b637d1a360be2dd1e538d53c63992b4f4ba6ab37b964f1506b_s390x, openshift4/ose-local-storage-diskmaker@sha256:2eb3b2b4ab0c71b637d1a360be2dd1e538d53c63992b4f4ba6ab37b964f1506b_s390x |
| Red Hat | openshift4/ose-node-problem-detector-rhel8@sha256:8e9ee40c1446786c1262df18810db5a9f434f19ae8156c45ec6a5ddcf69c8273_arm64 as a component of Red Hat OpenShift Container Platform 4.13 | *, openshift4/ose-node-problem-detector-rhel8@sha256:8e9ee40c1446786c1262df18810db5a9f434f19ae8156c45ec6a5ddcf69c8273_arm64, openshift4/ose-node-problem-detector-rhel8@sha256:8e9ee40c1446786c1262df18810db5a9f434f19ae8156c45ec6a5ddcf69c8273_arm64 |
| Red Hat | openshift4/ose-egress-dns-proxy@sha256:33c5df41926d4a45b90daa87244ad947979b0e59d3fdf4584ebe7f22ed9a3075_s390x as a component of Red Hat OpenShift Container Platform 4.13 | openshift4/ose-egress-dns-proxy@sha256:33c5df41926d4a45b90daa87244ad947979b0e59d3fdf4584ebe7f22ed9a3075_s390x, *, * |
| Red Hat | openshift4/ose-egress-router@sha256:feb7d6b2ec1793016340413ace54b6d966265b96608721bf531fea48a79d8631_amd64 as a component of Red Hat OpenShift Container Platform 4.13 | *, *, openshift4/ose-egress-router@sha256:feb7d6b2ec1793016340413ace54b6d966265b96608721bf531fea48a79d8631_amd64 |
| Red Hat | openshift4/ose-cluster-capacity@sha256:c0dd3200852f0b15eb0cf89f5ece37b38bd658f2c27ffa9fde65955a90e6f4de_arm64 as a component of Red Hat OpenShift Container Platform 4.13 | openshift4/ose-cluster-capacity@sha256:c0dd3200852f0b15eb0cf89f5ece37b38bd658f2c27ffa9fde65955a90e6f4de_arm64, *, * |
| Red Hat | openshift4/ingress-node-firewall@sha256:2fa01274966e1fa500d8c361046ee018f8e62d0400fe320a2bff983bd060252e_amd64 as a component of Red Hat OpenShift Container Platform 4.13 | openshift4/ingress-node-firewall@sha256:2fa01274966e1fa500d8c361046ee018f8e62d0400fe320a2bff983bd060252e_amd64, *, * |
| Red Hat | openshift4/ose-cluster-nfd-operator@sha256:7e8d89230678e35781bb0671282d0e67ede32968ab988bfafcd18a41960fe27c_s390x as a component of Red Hat OpenShift Container Platform 4.13 | *, *, openshift4/ose-cluster-nfd-operator@sha256:7e8d89230678e35781bb0671282d0e67ede32968ab988bfafcd18a41960fe27c_s390x |
| Red Hat | openshift4/ose-operator-sdk-rhel8@sha256:7816db56d2ad6b71ec53404448776951e28db3774a0507648f80ac2283ddecac_amd64 as a component of Red Hat OpenShift Container Platform 4.13 | openshift4/ose-operator-sdk-rhel8@sha256:7816db56d2ad6b71ec53404448776951e28db3774a0507648f80ac2283ddecac_amd64, *, * |
| Red Hat | openshift4/ose-csi-driver-shared-resource-mustgather-rhel8@sha256:776010ff732218f27df9f956b19a86b97338aa908833cb1b5c308d2370ad9688_ppc64le as a component of Red Hat OpenShift Container Platform 4.13 | *, openshift4/ose-csi-driver-shared-resource-mustgather-rhel8@sha256:776010ff732218f27df9f956b19a86b97338aa908833cb1b5c308d2370ad9688_ppc64le, openshift4/ose-csi-driver-shared-resource-mustgather-rhel8@sha256:776010ff732218f27df9f956b19a86b97338aa908833cb1b5c308d2370ad9688_ppc64le |
| Red Hat | openshift4/ose-cluster-nfd-operator@sha256:8012755b20b7574adae3e001aee4123d5873fc771bbb6375e5a0665c7d676e6d_arm64 as a component of Red Hat OpenShift Container Platform 4.13 | openshift4/ose-cluster-nfd-operator@sha256:8012755b20b7574adae3e001aee4123d5873fc771bbb6375e5a0665c7d676e6d_arm64, openshift4/ose-cluster-nfd-operator@sha256:8012755b20b7574adae3e001aee4123d5873fc771bbb6375e5a0665c7d676e6d_arm64, * |
| Red Hat | openshift4/ose-ansible-operator@sha256:d31d94d3ac3b9f4323bec26fdd0dfa8c3163e6036dade30ae0230ce695577ab9_ppc64le as a component of Red Hat OpenShift Container Platform 4.13 | *, *, openshift4/ose-ansible-operator@sha256:d31d94d3ac3b9f4323bec26fdd0dfa8c3163e6036dade30ae0230ce695577ab9_ppc64le |
| Red Hat | openshift4/ose-sriov-network-webhook@sha256:b803f9facd39924697c5f1a4cd1626e9f3a361805b804e455993d0fabf287a82_amd64 as a component of Red Hat OpenShift Container Platform 4.13 | *, openshift4/ose-sriov-network-webhook@sha256:b803f9facd39924697c5f1a4cd1626e9f3a361805b804e455993d0fabf287a82_amd64, openshift4/ose-sriov-network-webhook@sha256:b803f9facd39924697c5f1a4cd1626e9f3a361805b804e455993d0fabf287a82_amd64 |
…and 316 more
Timeline
- Nov 29, 2023 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- May 21, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2023:7474 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2243296 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7474.json advisory
- https://access.redhat.com/security/cve/CVE-2023-39325 advisory
- https://access.redhat.com/security/vulnerabilities/RHSB-2023-003 advisory
- https://www.cve.org/CVERecord?id=CVE-2023-39325 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-39325 advisory
- https://access.redhat.com/security/cve/CVE-2023-44487 advisory
- https://go.dev/issue/63417 advisory
- https://pkg.go.dev/vuln/GO-2023-2102 advisory
- https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487 advisory