VDB
RHSA-2023:7691
RHSA-2023:7691
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RST_STREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any server-side limit for the maximum number of active streams per connection, resulting in a denial of service due to server resource consumption. Red Hat has rated the severity of this flaw as 'Important' as the US Cybersecurity and Infrastructure Security Agency (CISA) declared this vulnerability an active exploit. CVE-2023-39325 was assigned for the `Rapid Reset Attack` in the Go language packages.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift4/ose-alibaba-cloud-controller-manager-rhel8@sha256:06c04f8625d82cf9e21d0d7c300438aed73ec78d675086a861383a86f74c8400_amd64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-alibaba-cloud-controller-manager-rhel8@sha256:06c04f8625d82cf9e21d0d7c300438aed73ec78d675086a861383a86f74c8400_amd64, openshift4/ose-alibaba-cloud-controller-manager-rhel8@sha256:06c04f8625d82cf9e21d0d7c300438aed73ec78d675086a861383a86f74c8400_amd64, openshift4/ose-alibaba-cloud-controller-manager-rhel8@sha256:06c04f8625d82cf9e21d0d7c300438aed73ec78d675086a861383a86f74c8400_amd64 |
| Red Hat | openshift4/ose-operator-marketplace@sha256:c6022ff2d19f30caf5c18a92f8a3b21df9a9d9152491af5dd1a0b31557123c6b_s390x as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-operator-marketplace@sha256:c6022ff2d19f30caf5c18a92f8a3b21df9a9d9152491af5dd1a0b31557123c6b_s390x, openshift4/ose-operator-marketplace@sha256:c6022ff2d19f30caf5c18a92f8a3b21df9a9d9152491af5dd1a0b31557123c6b_s390x, openshift4/ose-operator-marketplace@sha256:c6022ff2d19f30caf5c18a92f8a3b21df9a9d9152491af5dd1a0b31557123c6b_s390x |
| Red Hat | openshift4/ose-kube-rbac-proxy@sha256:c802fbed684595b350c390f418209197d2a05025f3d58ff61df222fa2ef6dcc8_amd64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-kube-rbac-proxy@sha256:c802fbed684595b350c390f418209197d2a05025f3d58ff61df222fa2ef6dcc8_amd64, *, openshift4/ose-kube-rbac-proxy@sha256:c802fbed684595b350c390f418209197d2a05025f3d58ff61df222fa2ef6dcc8_amd64 |
| Red Hat | openshift4/network-tools-rhel8@sha256:8a7b48ad3e1f603297ee0e397d82a57e5d52395f8bd2520aec75fe477cb6d475_ppc64le as a component of Red Hat OpenShift Container Platform 4.11 | *, openshift4/network-tools-rhel8@sha256:8a7b48ad3e1f603297ee0e397d82a57e5d52395f8bd2520aec75fe477cb6d475_ppc64le, * |
| Red Hat | openshift4/ose-cluster-autoscaler@sha256:98d2dc71c2407f784ea22bf053a760c495b55039c639559031c769e5965066b2_ppc64le as a component of Red Hat OpenShift Container Platform 4.11 | *, openshift4/ose-cluster-autoscaler@sha256:98d2dc71c2407f784ea22bf053a760c495b55039c639559031c769e5965066b2_ppc64le, openshift4/ose-cluster-autoscaler@sha256:98d2dc71c2407f784ea22bf053a760c495b55039c639559031c769e5965066b2_ppc64le |
| Red Hat | openshift4/ose-csi-external-snapshotter@sha256:f9abd99a5b54c02c03604bd359904b3612d63c9ea2ef9f7445c433bca931ceb5_s390x as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-csi-external-snapshotter@sha256:f9abd99a5b54c02c03604bd359904b3612d63c9ea2ef9f7445c433bca931ceb5_s390x, openshift4/ose-csi-external-snapshotter@sha256:f9abd99a5b54c02c03604bd359904b3612d63c9ea2ef9f7445c433bca931ceb5_s390x, * |
| Red Hat | openshift4/ose-alibaba-machine-controllers-rhel8@sha256:18860b11365c235a069cb235dd507aa991875ee79bd5e7c671738ca40581568b_amd64 as a component of Red Hat OpenShift Container Platform 4.11 | *, *, openshift4/ose-alibaba-machine-controllers-rhel8@sha256:18860b11365c235a069cb235dd507aa991875ee79bd5e7c671738ca40581568b_amd64 |
| Red Hat | openshift4/ose-csi-snapshot-controller@sha256:cbec3349204e0c87462ca02d44fb5949eb93d89367ed51810c8afa25a23e0942_amd64 as a component of Red Hat OpenShift Container Platform 4.11 | *, *, openshift4/ose-csi-snapshot-controller@sha256:cbec3349204e0c87462ca02d44fb5949eb93d89367ed51810c8afa25a23e0942_amd64 |
| Red Hat | openshift4/ose-agent-installer-csr-approver-rhel8@sha256:dfe25ca4e5230971074dc6a54ccd74ec477c72b82133e98275a3a30db2c27cbe_ppc64le as a component of Red Hat OpenShift Container Platform 4.11 | *, openshift4/ose-agent-installer-csr-approver-rhel8@sha256:dfe25ca4e5230971074dc6a54ccd74ec477c72b82133e98275a3a30db2c27cbe_ppc64le, * |
| Red Hat | openshift4/ose-multus-route-override-cni-rhel8@sha256:1bbc905441ce45ed230153309acb639cfa67dc2a7e50996c9da0c849ec0b6212_arm64 as a component of Red Hat OpenShift Container Platform 4.11 | *, *, * |
| Red Hat | openshift4/ose-ovirt-machine-controllers-rhel8@sha256:4f55d8ca8e8bf0e0e7273ae0d3f12da491b65c2e558ca4f5901d6b4d5261cf96_s390x as a component of Red Hat OpenShift Container Platform 4.11 | *, openshift4/ose-ovirt-machine-controllers-rhel8@sha256:4f55d8ca8e8bf0e0e7273ae0d3f12da491b65c2e558ca4f5901d6b4d5261cf96_s390x, openshift4/ose-ovirt-machine-controllers-rhel8@sha256:4f55d8ca8e8bf0e0e7273ae0d3f12da491b65c2e558ca4f5901d6b4d5261cf96_s390x |
| Red Hat | openshift4/ose-image-customization-controller-rhel8@sha256:e8cfa022415198cbd3b301f36895dc1483e7dfe17f6a9a7a673a729d5da42172_arm64 as a component of Red Hat OpenShift Container Platform 4.11 | *, openshift4/ose-image-customization-controller-rhel8@sha256:e8cfa022415198cbd3b301f36895dc1483e7dfe17f6a9a7a673a729d5da42172_arm64, openshift4/ose-image-customization-controller-rhel8@sha256:e8cfa022415198cbd3b301f36895dc1483e7dfe17f6a9a7a673a729d5da42172_arm64 |
| Red Hat | openshift4/ose-cluster-authentication-operator@sha256:bb118d79ebe5d6bb16bf99f18b34a70016f9919ca4890163a36589270d55bd6b_ppc64le as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-cluster-authentication-operator@sha256:bb118d79ebe5d6bb16bf99f18b34a70016f9919ca4890163a36589270d55bd6b_ppc64le, openshift4/ose-cluster-authentication-operator@sha256:bb118d79ebe5d6bb16bf99f18b34a70016f9919ca4890163a36589270d55bd6b_ppc64le, * |
| Red Hat | openshift4/ose-aws-cloud-controller-manager-rhel8@sha256:5892d7f0a4fa456d5006026648a5daddf5a5c18656ce072198fa86a7b24cfc0d_arm64 as a component of Red Hat OpenShift Container Platform 4.11 | *, openshift4/ose-aws-cloud-controller-manager-rhel8@sha256:5892d7f0a4fa456d5006026648a5daddf5a5c18656ce072198fa86a7b24cfc0d_arm64, openshift4/ose-aws-cloud-controller-manager-rhel8@sha256:5892d7f0a4fa456d5006026648a5daddf5a5c18656ce072198fa86a7b24cfc0d_arm64 |
| Red Hat | openshift4/ose-cluster-kube-cluster-api-rhel8-operator@sha256:82e507c11cf4b8a546626378235ee33eb0b40bd298d368e6ac14dd4ec70b0f30_amd64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-cluster-kube-cluster-api-rhel8-operator@sha256:82e507c11cf4b8a546626378235ee33eb0b40bd298d368e6ac14dd4ec70b0f30_amd64, openshift4/ose-cluster-kube-cluster-api-rhel8-operator@sha256:82e507c11cf4b8a546626378235ee33eb0b40bd298d368e6ac14dd4ec70b0f30_amd64, openshift4/ose-cluster-kube-cluster-api-rhel8-operator@sha256:82e507c11cf4b8a546626378235ee33eb0b40bd298d368e6ac14dd4ec70b0f30_amd64 |
| Red Hat | openshift4/ose-operator-registry@sha256:cc1aac5b11f5ab9a07839f766985f164fb856405049d9b8ddbc3be30d2fe0357_amd64 as a component of Red Hat OpenShift Container Platform 4.11 | *, openshift4/ose-operator-registry@sha256:cc1aac5b11f5ab9a07839f766985f164fb856405049d9b8ddbc3be30d2fe0357_amd64, openshift4/ose-operator-registry@sha256:cc1aac5b11f5ab9a07839f766985f164fb856405049d9b8ddbc3be30d2fe0357_amd64 |
| Red Hat | openshift4/ose-insights-rhel8-operator@sha256:2303cbe33f38b6cab2321f779b30ea48859a0d18f925f57b9843556a40b043c3_ppc64le as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-insights-rhel8-operator@sha256:2303cbe33f38b6cab2321f779b30ea48859a0d18f925f57b9843556a40b043c3_ppc64le, openshift4/ose-insights-rhel8-operator@sha256:2303cbe33f38b6cab2321f779b30ea48859a0d18f925f57b9843556a40b043c3_ppc64le, * |
| Red Hat | openshift4/ose-prometheus@sha256:eeecc0d4245ba90329ce66a79e8f8810aa37fbf75eb782a704a5126d1fca7ace_s390x as a component of Red Hat OpenShift Container Platform 4.11 | *, *, * |
| Red Hat | openshift4/ose-csi-driver-shared-resource-webhook-rhel8@sha256:dbfb7382a855f9636b1aca6e6038698cd16abc480be34350c3408ece966b2921_arm64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-csi-driver-shared-resource-webhook-rhel8@sha256:dbfb7382a855f9636b1aca6e6038698cd16abc480be34350c3408ece966b2921_arm64, openshift4/ose-csi-driver-shared-resource-webhook-rhel8@sha256:dbfb7382a855f9636b1aca6e6038698cd16abc480be34350c3408ece966b2921_arm64, openshift4/ose-csi-driver-shared-resource-webhook-rhel8@sha256:dbfb7382a855f9636b1aca6e6038698cd16abc480be34350c3408ece966b2921_arm64 |
| Red Hat | openshift4/ose-cluster-openshift-controller-manager-operator@sha256:066a7dd17331fa03e41ecf0021ff038b0a4bcabae6d36ed5dda076a71be12194_arm64 as a component of Red Hat OpenShift Container Platform 4.11 | *, *, * |
…and 1209 more
Timeline
- Dec 13, 2023 CVE Published
- May 3, 2026 Security Advisory
- May 9, 2026 Distribution Patch
- May 9, 2026 Security Advisory
- May 15, 2026 Distribution Patch
- May 21, 2026 CVE Updated
References
- https://access.redhat.com/security/updates/classification/#important advisory
- https://access.redhat.com/security/vulnerabilities/RHSB-2023-003 advisory
- https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-39325 advisory
- https://pkg.go.dev/vuln/GO-2023-2102 advisory
- https://issues.redhat.com/browse/OCPBUGS-20122 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2243296 issue
- https://issues.redhat.com/browse/OCPBUGS-23574 advisory
- https://access.redhat.com/security/cve/CVE-2023-39325 advisory
- https://access.redhat.com/errata/RHSA-2023:7691 advisory
- https://go.dev/issue/63417 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7691.json advisory
- https://www.cve.org/CVERecord?id=CVE-2023-39325 advisory
- https://access.redhat.com/security/cve/CVE-2023-44487 advisory