VDB
RHSA-2024%3A2728
RHSA-2024%3A2728
PUBLISHED
CVSS 5.300000190734863 MEDIUM
A flaw was found in the Golang net/http/internal package. This issue may allow a malicious user to send an HTTP request and cause the receiver to read more bytes from network than are in the body (up to 1GiB), causing the receiver to fail reading the response, possibly leading to a Denial of Service (DoS).
Risk Scores
CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | rhosp-rhel9/osp-director-downloader@sha256:e702392f6f8bde5a93b9f90d94ec3fab1fc905b97fdc495cd1710118206f7c29_amd64 as a component of Red Hat OpenStack Platform 17.1 | *, rhosp-rhel9/osp-director-downloader@sha256:e702392f6f8bde5a93b9f90d94ec3fab1fc905b97fdc495cd1710118206f7c29_amd64, rhosp-rhel9/osp-director-downloader@sha256:e702392f6f8bde5a93b9f90d94ec3fab1fc905b97fdc495cd1710118206f7c29_amd64 |
| Red Hat | rhosp-rhel9/osp-director-downloader@sha256:e702392f6f8bde5a93b9f90d94ec3fab1fc905b97fdc495cd1710118206f7c29_amd64 as a component of Red Hat OpenStack Platform 17.1 | rhosp-rhel9/osp-director-downloader@sha256:e702392f6f8bde5a93b9f90d94ec3fab1fc905b97fdc495cd1710118206f7c29_amd64, *, rhosp-rhel9/osp-director-downloader@sha256:e702392f6f8bde5a93b9f90d94ec3fab1fc905b97fdc495cd1710118206f7c29_amd64 |
| Red Hat | rhosp-rhel9/osp-director-operator@sha256:35affb25a019adfaf3c4dc5f3a4da21b30eae321f0138d75be5ab9fc88da0141_amd64 as a component of Red Hat OpenStack Platform 17.1 | *, rhosp-rhel9/osp-director-operator@sha256:35affb25a019adfaf3c4dc5f3a4da21b30eae321f0138d75be5ab9fc88da0141_amd64, * |
| Red Hat | rhosp-rhel9/osp-director-operator-bundle@sha256:6747f43ab7ffa76b852b0d0f7b625dcc47a7cbfb3d9af12d8d2efd84feb0822d_amd64 as a component of Red Hat OpenStack Platform 17.1 | rhosp-rhel9/osp-director-operator-bundle@sha256:6747f43ab7ffa76b852b0d0f7b625dcc47a7cbfb3d9af12d8d2efd84feb0822d_amd64, rhosp-rhel9/osp-director-operator-bundle@sha256:6747f43ab7ffa76b852b0d0f7b625dcc47a7cbfb3d9af12d8d2efd84feb0822d_amd64, * |
| Red Hat | rhosp-rhel9/osp-director-agent@sha256:436915008c0b272b20fb5fbf64fc6b4f65ae869ecdd70248066b36a120ab53d0_amd64 as a component of Red Hat OpenStack Platform 17.1 | rhosp-rhel9/osp-director-agent@sha256:436915008c0b272b20fb5fbf64fc6b4f65ae869ecdd70248066b36a120ab53d0_amd64, *, rhosp-rhel9/osp-director-agent@sha256:436915008c0b272b20fb5fbf64fc6b4f65ae869ecdd70248066b36a120ab53d0_amd64 |
| Red Hat | rhosp-rhel9/osp-director-operator@sha256:35affb25a019adfaf3c4dc5f3a4da21b30eae321f0138d75be5ab9fc88da0141_amd64 as a component of Red Hat OpenStack Platform 17.1 | *, rhosp-rhel9/osp-director-operator@sha256:35affb25a019adfaf3c4dc5f3a4da21b30eae321f0138d75be5ab9fc88da0141_amd64, * |
| Red Hat | rhosp-rhel9/osp-director-agent@sha256:436915008c0b272b20fb5fbf64fc6b4f65ae869ecdd70248066b36a120ab53d0_amd64 as a component of Red Hat OpenStack Platform 17.1 | rhosp-rhel9/osp-director-agent@sha256:436915008c0b272b20fb5fbf64fc6b4f65ae869ecdd70248066b36a120ab53d0_amd64, rhosp-rhel9/osp-director-agent@sha256:436915008c0b272b20fb5fbf64fc6b4f65ae869ecdd70248066b36a120ab53d0_amd64, rhosp-rhel9/osp-director-agent@sha256:436915008c0b272b20fb5fbf64fc6b4f65ae869ecdd70248066b36a120ab53d0_amd64 |
| Red Hat | rhosp-rhel9/osp-director-operator-bundle@sha256:6747f43ab7ffa76b852b0d0f7b625dcc47a7cbfb3d9af12d8d2efd84feb0822d_amd64 as a component of Red Hat OpenStack Platform 17.1 | *, rhosp-rhel9/osp-director-operator-bundle@sha256:6747f43ab7ffa76b852b0d0f7b625dcc47a7cbfb3d9af12d8d2efd84feb0822d_amd64, rhosp-rhel9/osp-director-operator-bundle@sha256:6747f43ab7ffa76b852b0d0f7b625dcc47a7cbfb3d9af12d8d2efd84feb0822d_amd64 |
Timeline
- May 29, 2024 CVE Published
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- May 13, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2024:2728 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2253330 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2254210 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2256449 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2258578 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2268273 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2272054 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2273947 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2728.json advisory
- https://access.redhat.com/security/cve/CVE-2023-39326 advisory
- https://www.cve.org/CVERecord?id=CVE-2023-39326 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-39326 advisory
- https://pkg.go.dev/vuln/GO-2023-2382 advisory
- https://access.redhat.com/security/cve/CVE-2023-45288 advisory
- https://www.cve.org/CVERecord?id=CVE-2023-45288 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-45288 advisory
- https://nowotarski.info/http2-continuation-flood/ advisory
- https://pkg.go.dev/vuln/GO-2024-2687 advisory
- https://www.kb.cert.org/vuls/id/421644 advisory
…and 5 more