VDB
RHSA-2024%3A0273
RHSA-2024%3A0273
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RST_STREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any server-side limit for the maximum number of active streams per connection, resulting in a denial of service due to server resource consumption. Red Hat has rated the severity of this flaw as 'Important' as the US Cybersecurity and Infrastructure Security Agency (CISA) declared this vulnerability an active exploit. CVE-2023-39325 was assigned for the `Rapid Reset Attack` in the Go language packages.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | container-native-virtualization/virt-cdi-operator@sha256:a9489e302737cd6b453eb03e39c5d2f94fae6a25e3b42c73cd9c1a942ee72e5f_amd64 as a component of CNV 4.12 for RHEL 8 | container-native-virtualization/virt-cdi-operator@sha256:a9489e302737cd6b453eb03e39c5d2f94fae6a25e3b42c73cd9c1a942ee72e5f_amd64, container-native-virtualization/virt-cdi-operator@sha256:a9489e302737cd6b453eb03e39c5d2f94fae6a25e3b42c73cd9c1a942ee72e5f_amd64, container-native-virtualization/virt-cdi-operator@sha256:a9489e302737cd6b453eb03e39c5d2f94fae6a25e3b42c73cd9c1a942ee72e5f_amd64 |
| Red Hat | container-native-virtualization/virt-exportproxy@sha256:b5834b9c826e7ea42600f350b3c4767a18f2c90d317f12d3f8956f201214a325_amd64 as a component of CNV 4.12 for RHEL 8 | *, container-native-virtualization/virt-exportproxy@sha256:b5834b9c826e7ea42600f350b3c4767a18f2c90d317f12d3f8956f201214a325_amd64, * |
| Red Hat | container-native-virtualization/kubevirt-tekton-tasks-disk-virt-sysprep@sha256:223a95d2396f5f35fad5daab2f75b4c412020a03c7b7c117f1433f8f64509692_amd64 as a component of CNV 4.12 for RHEL 8 | container-native-virtualization/kubevirt-tekton-tasks-disk-virt-sysprep@sha256:223a95d2396f5f35fad5daab2f75b4c412020a03c7b7c117f1433f8f64509692_amd64, container-native-virtualization/kubevirt-tekton-tasks-disk-virt-sysprep@sha256:223a95d2396f5f35fad5daab2f75b4c412020a03c7b7c117f1433f8f64509692_amd64, * |
| Red Hat | container-native-virtualization/kubevirt-tekton-tasks-create-vm-from-template@sha256:8bd7f4eccdf2f54f7bf5b74a348c3a3eb2e7a75557f82b9f77db2b67dc1d6a24_amd64 as a component of CNV 4.12 for RHEL 8 | container-native-virtualization/kubevirt-tekton-tasks-create-vm-from-template@sha256:8bd7f4eccdf2f54f7bf5b74a348c3a3eb2e7a75557f82b9f77db2b67dc1d6a24_amd64, *, container-native-virtualization/kubevirt-tekton-tasks-create-vm-from-template@sha256:8bd7f4eccdf2f54f7bf5b74a348c3a3eb2e7a75557f82b9f77db2b67dc1d6a24_amd64 |
| Red Hat | container-native-virtualization/cnv-must-gather-rhel8@sha256:7cc48d1e0ef5d3ed1287d3ece0ac306e3eac1eaf283fe354eee905f721cba7d4_amd64 as a component of CNV 4.12 for RHEL 8 | container-native-virtualization/cnv-must-gather-rhel8@sha256:7cc48d1e0ef5d3ed1287d3ece0ac306e3eac1eaf283fe354eee905f721cba7d4_amd64, *, container-native-virtualization/cnv-must-gather-rhel8@sha256:7cc48d1e0ef5d3ed1287d3ece0ac306e3eac1eaf283fe354eee905f721cba7d4_amd64 |
| Red Hat | container-native-virtualization/virt-exportserver@sha256:85c866c4d48e4347f39eb23528ec8f75a2db0a16e1c754463ae66706d03348ef_amd64 as a component of CNV 4.12 for RHEL 8 | *, container-native-virtualization/virt-exportserver@sha256:85c866c4d48e4347f39eb23528ec8f75a2db0a16e1c754463ae66706d03348ef_amd64, container-native-virtualization/virt-exportserver@sha256:85c866c4d48e4347f39eb23528ec8f75a2db0a16e1c754463ae66706d03348ef_amd64 |
| Red Hat | container-native-virtualization/bridge-marker@sha256:302f7b8ed01ed6fa7990507a8c8648af5a5607e6bb6dab8d8b2ce95c93c5a4d2_amd64 as a component of CNV 4.12 for RHEL 8 | container-native-virtualization/bridge-marker@sha256:302f7b8ed01ed6fa7990507a8c8648af5a5607e6bb6dab8d8b2ce95c93c5a4d2_amd64, *, * |
| Red Hat | container-native-virtualization/virtio-win@sha256:2ba15ef027ffef470e267cded5a3c087bd1942036920f85dbd06be68e4f59fb6_amd64 as a component of CNV 4.12 for RHEL 8 | *, container-native-virtualization/virtio-win@sha256:2ba15ef027ffef470e267cded5a3c087bd1942036920f85dbd06be68e4f59fb6_amd64, * |
| Red Hat | container-native-virtualization/vm-network-latency-checkup@sha256:c8a0fe956d24ba21ef5ade499ffc860c40dda98c6fabed4e5d81ed3bebc8ac1c_amd64 as a component of CNV 4.12 for RHEL 8 | *, container-native-virtualization/vm-network-latency-checkup@sha256:c8a0fe956d24ba21ef5ade499ffc860c40dda98c6fabed4e5d81ed3bebc8ac1c_amd64, * |
| Red Hat | container-native-virtualization/virt-controller@sha256:1caaf37a802ecdea65dff964c292e31a33fa119928edb7b57c4de7657315a989_amd64 as a component of CNV 4.12 for RHEL 8 | *, *, container-native-virtualization/virt-controller@sha256:1caaf37a802ecdea65dff964c292e31a33fa119928edb7b57c4de7657315a989_amd64 |
| Red Hat | container-native-virtualization/hostpath-csi-driver@sha256:431eddb3927178f6a7b39b5b8937d4d39c7863bdfcd8227cd3e0b47af79c737d_amd64 as a component of CNV 4.12 for RHEL 8 | container-native-virtualization/hostpath-csi-driver@sha256:431eddb3927178f6a7b39b5b8937d4d39c7863bdfcd8227cd3e0b47af79c737d_amd64, *, container-native-virtualization/hostpath-csi-driver@sha256:431eddb3927178f6a7b39b5b8937d4d39c7863bdfcd8227cd3e0b47af79c737d_amd64 |
| Red Hat | container-native-virtualization/virt-cdi-uploadproxy@sha256:449ef03e2ec6b468ecdc37679d7057083bb50d3923af7e141b6c3b44f8a006df_amd64 as a component of CNV 4.12 for RHEL 8 | *, container-native-virtualization/virt-cdi-uploadproxy@sha256:449ef03e2ec6b468ecdc37679d7057083bb50d3923af7e141b6c3b44f8a006df_amd64, container-native-virtualization/virt-cdi-uploadproxy@sha256:449ef03e2ec6b468ecdc37679d7057083bb50d3923af7e141b6c3b44f8a006df_amd64 |
| Red Hat | container-native-virtualization/virt-exportproxy@sha256:b5834b9c826e7ea42600f350b3c4767a18f2c90d317f12d3f8956f201214a325_amd64 as a component of CNV 4.12 for RHEL 8 | *, *, container-native-virtualization/virt-exportproxy@sha256:b5834b9c826e7ea42600f350b3c4767a18f2c90d317f12d3f8956f201214a325_amd64 |
| Red Hat | container-native-virtualization/kubevirt-tekton-tasks-create-datavolume@sha256:944f1c609d14bdf705e3d76c7181f8e7ec25c309097aeafd843055f972b3aca5_amd64 as a component of CNV 4.12 for RHEL 8 | container-native-virtualization/kubevirt-tekton-tasks-create-datavolume@sha256:944f1c609d14bdf705e3d76c7181f8e7ec25c309097aeafd843055f972b3aca5_amd64, *, * |
| Red Hat | container-native-virtualization/virt-artifacts-server@sha256:24c3dd085416026c64c4c6ca89c9b3c61625137f61ea281d19c32aaec67924b0_amd64 as a component of CNV 4.12 for RHEL 8 | *, container-native-virtualization/virt-artifacts-server@sha256:24c3dd085416026c64c4c6ca89c9b3c61625137f61ea281d19c32aaec67924b0_amd64, container-native-virtualization/virt-artifacts-server@sha256:24c3dd085416026c64c4c6ca89c9b3c61625137f61ea281d19c32aaec67924b0_amd64 |
| Red Hat | container-native-virtualization/virt-cdi-apiserver@sha256:50e2478a24a64d2a7e46d699475646efd92455228fe8ebcf648bfcbfe4e15a7e_amd64 as a component of CNV 4.12 for RHEL 8 | *, *, container-native-virtualization/virt-cdi-apiserver@sha256:50e2478a24a64d2a7e46d699475646efd92455228fe8ebcf648bfcbfe4e15a7e_amd64 |
| Red Hat | container-native-virtualization/hyperconverged-cluster-webhook-rhel8@sha256:045151b2e55c0ba748b1ffe23e33cd3a230208bbf1b66ec2d514d9a73d6899b8_amd64 as a component of CNV 4.12 for RHEL 8 | *, container-native-virtualization/hyperconverged-cluster-webhook-rhel8@sha256:045151b2e55c0ba748b1ffe23e33cd3a230208bbf1b66ec2d514d9a73d6899b8_amd64, * |
| Red Hat | container-native-virtualization/cluster-network-addons-operator@sha256:0f32a09e0a6b9097102543b4a21c92d66679a7e9bd773b15d71fe4b1119f4579_amd64 as a component of CNV 4.12 for RHEL 8 | container-native-virtualization/cluster-network-addons-operator@sha256:0f32a09e0a6b9097102543b4a21c92d66679a7e9bd773b15d71fe4b1119f4579_amd64, *, * |
| Red Hat | container-native-virtualization/hyperconverged-cluster-operator@sha256:1c734396bbae0bd259cd3b5bdc1121323531d3a78ca5905d55ab14f092588104_amd64 as a component of CNV 4.12 for RHEL 8 | container-native-virtualization/hyperconverged-cluster-operator@sha256:1c734396bbae0bd259cd3b5bdc1121323531d3a78ca5905d55ab14f092588104_amd64, container-native-virtualization/hyperconverged-cluster-operator@sha256:1c734396bbae0bd259cd3b5bdc1121323531d3a78ca5905d55ab14f092588104_amd64, container-native-virtualization/hyperconverged-cluster-operator@sha256:1c734396bbae0bd259cd3b5bdc1121323531d3a78ca5905d55ab14f092588104_amd64 |
| Red Hat | container-native-virtualization/kubevirt-tekton-tasks-operator@sha256:3e3a9796a01fb606528231603c17a253854f6db1fd1ac5d5132f846d7d264dcd_amd64 as a component of CNV 4.12 for RHEL 8 | container-native-virtualization/kubevirt-tekton-tasks-operator@sha256:3e3a9796a01fb606528231603c17a253854f6db1fd1ac5d5132f846d7d264dcd_amd64, container-native-virtualization/kubevirt-tekton-tasks-operator@sha256:3e3a9796a01fb606528231603c17a253854f6db1fd1ac5d5132f846d7d264dcd_amd64, container-native-virtualization/kubevirt-tekton-tasks-operator@sha256:3e3a9796a01fb606528231603c17a253854f6db1fd1ac5d5132f846d7d264dcd_amd64 |
…and 67 more
Timeline
- Jan 17, 2024 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- May 21, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2024:0273 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://access.redhat.com/security/vulnerabilities/RHSB-2023-003 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2243296 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2247667 issue
- https://issues.redhat.com/browse/CNV-34790 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0273.json advisory
- https://access.redhat.com/security/cve/CVE-2023-39325 advisory
- https://www.cve.org/CVERecord?id=CVE-2023-39325 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-39325 advisory
- https://access.redhat.com/security/cve/CVE-2023-44487 advisory
- https://go.dev/issue/63417 advisory
- https://pkg.go.dev/vuln/GO-2023-2102 advisory
- https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487 advisory