VDB
RHSA-2024%3A0302
RHSA-2024%3A0302
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RST_STREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any server-side limit for the maximum number of active streams per connection, resulting in a denial of service due to server resource consumption. Red Hat has rated the severity of this flaw as 'Important' as the US Cybersecurity and Infrastructure Security Agency (CISA) declared this vulnerability an active exploit. CVE-2023-39325 was assigned for the `Rapid Reset Attack` in the Go language packages.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:8a2f111ca16eae0fc2cd8a99261572e0693d3d062f67ec15b8e1006e30ba6bd3_ppc64le as a component of KDO 5.0 for RHEL 9 | kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:8a2f111ca16eae0fc2cd8a99261572e0693d3d062f67ec15b8e1006e30ba6bd3_ppc64le, *, kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:8a2f111ca16eae0fc2cd8a99261572e0693d3d062f67ec15b8e1006e30ba6bd3_ppc64le |
| Red Hat | kube-descheduler-operator/kube-descheduler-operator-bundle@sha256:ebcc836c3052bebfe7747c18b57ccc3a2870b5907e5ead894d87c8b2e33a12d9_amd64 as a component of KDO 5.0 for RHEL 9 | kube-descheduler-operator/kube-descheduler-operator-bundle@sha256:ebcc836c3052bebfe7747c18b57ccc3a2870b5907e5ead894d87c8b2e33a12d9_amd64, kube-descheduler-operator/kube-descheduler-operator-bundle@sha256:ebcc836c3052bebfe7747c18b57ccc3a2870b5907e5ead894d87c8b2e33a12d9_amd64, kube-descheduler-operator/kube-descheduler-operator-bundle@sha256:ebcc836c3052bebfe7747c18b57ccc3a2870b5907e5ead894d87c8b2e33a12d9_amd64 |
| Red Hat | kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:f22837b5a75ed8c7295440140f986b30cb951fce3b268bdac4defec28b663206_arm64 as a component of KDO 5.0 for RHEL 9 | *, kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:f22837b5a75ed8c7295440140f986b30cb951fce3b268bdac4defec28b663206_arm64, kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:f22837b5a75ed8c7295440140f986b30cb951fce3b268bdac4defec28b663206_arm64 |
| Red Hat | kube-descheduler-operator/descheduler-rhel9@sha256:5d214d8b4827026bb783695f84175b5bd4b1c742b7003174e503cda258bcf0ec_s390x as a component of KDO 5.0 for RHEL 9 | kube-descheduler-operator/descheduler-rhel9@sha256:5d214d8b4827026bb783695f84175b5bd4b1c742b7003174e503cda258bcf0ec_s390x, kube-descheduler-operator/descheduler-rhel9@sha256:5d214d8b4827026bb783695f84175b5bd4b1c742b7003174e503cda258bcf0ec_s390x, kube-descheduler-operator/descheduler-rhel9@sha256:5d214d8b4827026bb783695f84175b5bd4b1c742b7003174e503cda258bcf0ec_s390x |
| Red Hat | kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:a08ab5ee072a334a4e1d730039ddac532d1da6ed30cb33e0a0c479005c5925e9_s390x as a component of KDO 5.0 for RHEL 9 | *, kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:a08ab5ee072a334a4e1d730039ddac532d1da6ed30cb33e0a0c479005c5925e9_s390x, kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:a08ab5ee072a334a4e1d730039ddac532d1da6ed30cb33e0a0c479005c5925e9_s390x |
| Red Hat | kube-descheduler-operator/descheduler-rhel9@sha256:d6d747caebc5dc1bafe605c8790f0520c2bca6220c04b1660d44b3f44e5b67ce_amd64 as a component of KDO 5.0 for RHEL 9 | *, *, * |
| Red Hat | kube-descheduler-operator/descheduler-rhel9@sha256:e5734b5dcb0d09412dada260881b6dca9b6c60d52666808ecdf71b86610b89bc_ppc64le as a component of KDO 5.0 for RHEL 9 | kube-descheduler-operator/descheduler-rhel9@sha256:e5734b5dcb0d09412dada260881b6dca9b6c60d52666808ecdf71b86610b89bc_ppc64le, kube-descheduler-operator/descheduler-rhel9@sha256:e5734b5dcb0d09412dada260881b6dca9b6c60d52666808ecdf71b86610b89bc_ppc64le, kube-descheduler-operator/descheduler-rhel9@sha256:e5734b5dcb0d09412dada260881b6dca9b6c60d52666808ecdf71b86610b89bc_ppc64le |
| Red Hat | kube-descheduler-operator/descheduler-rhel9@sha256:fae36bd3f00aa63a91e80723a656711f377f3bf654fa90189826dc060ac24656_arm64 as a component of KDO 5.0 for RHEL 9 | *, kube-descheduler-operator/descheduler-rhel9@sha256:fae36bd3f00aa63a91e80723a656711f377f3bf654fa90189826dc060ac24656_arm64, kube-descheduler-operator/descheduler-rhel9@sha256:fae36bd3f00aa63a91e80723a656711f377f3bf654fa90189826dc060ac24656_arm64 |
| Red Hat | kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:f22837b5a75ed8c7295440140f986b30cb951fce3b268bdac4defec28b663206_arm64 as a component of KDO 5.0 for RHEL 9 | kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:f22837b5a75ed8c7295440140f986b30cb951fce3b268bdac4defec28b663206_arm64, *, kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:f22837b5a75ed8c7295440140f986b30cb951fce3b268bdac4defec28b663206_arm64 |
| Red Hat | kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:a08ab5ee072a334a4e1d730039ddac532d1da6ed30cb33e0a0c479005c5925e9_s390x as a component of KDO 5.0 for RHEL 9 | |
| Red Hat | kube-descheduler-operator/kube-descheduler-operator-bundle@sha256:ebcc836c3052bebfe7747c18b57ccc3a2870b5907e5ead894d87c8b2e33a12d9_amd64 as a component of KDO 5.0 for RHEL 9 | *, *, kube-descheduler-operator/kube-descheduler-operator-bundle@sha256:ebcc836c3052bebfe7747c18b57ccc3a2870b5907e5ead894d87c8b2e33a12d9_amd64 |
| Red Hat | kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:a08ab5ee072a334a4e1d730039ddac532d1da6ed30cb33e0a0c479005c5925e9_s390x as a component of KDO 5.0 for RHEL 9 | kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:a08ab5ee072a334a4e1d730039ddac532d1da6ed30cb33e0a0c479005c5925e9_s390x, kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:a08ab5ee072a334a4e1d730039ddac532d1da6ed30cb33e0a0c479005c5925e9_s390x, * |
| Red Hat | kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:9ef3e097672d5d7ded62974a66477cecb04112ad541e3baeb94f6519eb5076a0_amd64 as a component of KDO 5.0 for RHEL 9 | *, *, * |
| Red Hat | kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:8a2f111ca16eae0fc2cd8a99261572e0693d3d062f67ec15b8e1006e30ba6bd3_ppc64le as a component of KDO 5.0 for RHEL 9 | *, kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:8a2f111ca16eae0fc2cd8a99261572e0693d3d062f67ec15b8e1006e30ba6bd3_ppc64le, * |
| Red Hat | kube-descheduler-operator/descheduler-rhel9@sha256:5d214d8b4827026bb783695f84175b5bd4b1c742b7003174e503cda258bcf0ec_s390x as a component of KDO 5.0 for RHEL 9 | kube-descheduler-operator/descheduler-rhel9@sha256:5d214d8b4827026bb783695f84175b5bd4b1c742b7003174e503cda258bcf0ec_s390x, *, * |
| Red Hat | kube-descheduler-operator/descheduler-rhel9@sha256:fae36bd3f00aa63a91e80723a656711f377f3bf654fa90189826dc060ac24656_arm64 as a component of KDO 5.0 for RHEL 9 | kube-descheduler-operator/descheduler-rhel9@sha256:fae36bd3f00aa63a91e80723a656711f377f3bf654fa90189826dc060ac24656_arm64, kube-descheduler-operator/descheduler-rhel9@sha256:fae36bd3f00aa63a91e80723a656711f377f3bf654fa90189826dc060ac24656_arm64, kube-descheduler-operator/descheduler-rhel9@sha256:fae36bd3f00aa63a91e80723a656711f377f3bf654fa90189826dc060ac24656_arm64 |
| Red Hat | kube-descheduler-operator/descheduler-rhel9@sha256:e5734b5dcb0d09412dada260881b6dca9b6c60d52666808ecdf71b86610b89bc_ppc64le as a component of KDO 5.0 for RHEL 9 | kube-descheduler-operator/descheduler-rhel9@sha256:e5734b5dcb0d09412dada260881b6dca9b6c60d52666808ecdf71b86610b89bc_ppc64le, kube-descheduler-operator/descheduler-rhel9@sha256:e5734b5dcb0d09412dada260881b6dca9b6c60d52666808ecdf71b86610b89bc_ppc64le, * |
| Red Hat | kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:9ef3e097672d5d7ded62974a66477cecb04112ad541e3baeb94f6519eb5076a0_amd64 as a component of KDO 5.0 for RHEL 9 | kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:9ef3e097672d5d7ded62974a66477cecb04112ad541e3baeb94f6519eb5076a0_amd64, *, kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:9ef3e097672d5d7ded62974a66477cecb04112ad541e3baeb94f6519eb5076a0_amd64 |
| Red Hat | kube-descheduler-operator/descheduler-rhel9@sha256:d6d747caebc5dc1bafe605c8790f0520c2bca6220c04b1660d44b3f44e5b67ce_amd64 as a component of KDO 5.0 for RHEL 9 | *, kube-descheduler-operator/descheduler-rhel9@sha256:d6d747caebc5dc1bafe605c8790f0520c2bca6220c04b1660d44b3f44e5b67ce_amd64, * |
Timeline
- Mar 6, 2024 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Jul 25, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2024:0302 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://access.redhat.com/security/vulnerabilities/RHSB-2023-003 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2242803 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2243296 issue
- https://issues.redhat.com/browse/OCPBUGS-14042 advisory
- https://issues.redhat.com/browse/OCPBUGS-24597 advisory
- https://issues.redhat.com/browse/OCPBUGS-25992 advisory
- https://issues.redhat.com/browse/OCPBUGS-26545 advisory
- https://issues.redhat.com/browse/WRKLDS-884 advisory
- https://issues.redhat.com/browse/WRKLDS-905 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0302.json advisory
- https://access.redhat.com/security/cve/CVE-2023-39325 advisory
- https://www.cve.org/CVERecord?id=CVE-2023-39325 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-39325 advisory
- https://access.redhat.com/security/cve/CVE-2023-44487 advisory
- https://go.dev/issue/63417 advisory
- https://pkg.go.dev/vuln/GO-2023-2102 advisory
- https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487 advisory
- https://www.cve.org/CVERecord?id=CVE-2023-44487 advisory
…and 4 more