VDB
RHSA-2024%3A2901
RHSA-2024%3A2901
PUBLISHED
CVSS 7.5 HIGH
A vulnerability was discovered with the implementation of the HTTP/2 protocol in the Go programming language. There were insufficient limitations on the amount of CONTINUATION frames sent within a single stream. An attacker could potentially exploit this to cause a Denial of Service (DoS) attack.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8@sha256:0a3f76360bc53346024baad729ee588e5bf8f616bfcdc31ebbe7772060ecd380_amd64 as a component of OpenShift Custom Metrics Autoscaler 2 | custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8@sha256:0a3f76360bc53346024baad729ee588e5bf8f616bfcdc31ebbe7772060ecd380_amd64, custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8@sha256:0a3f76360bc53346024baad729ee588e5bf8f616bfcdc31ebbe7772060ecd380_amd64, custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8@sha256:0a3f76360bc53346024baad729ee588e5bf8f616bfcdc31ebbe7772060ecd380_amd64 |
| Red Hat | custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8@sha256:0a3f76360bc53346024baad729ee588e5bf8f616bfcdc31ebbe7772060ecd380_amd64 as a component of OpenShift Custom Metrics Autoscaler 2 | custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8@sha256:0a3f76360bc53346024baad729ee588e5bf8f616bfcdc31ebbe7772060ecd380_amd64, custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8@sha256:0a3f76360bc53346024baad729ee588e5bf8f616bfcdc31ebbe7772060ecd380_amd64, custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8@sha256:0a3f76360bc53346024baad729ee588e5bf8f616bfcdc31ebbe7772060ecd380_amd64 |
| Red Hat | custom-metrics-autoscaler/custom-metrics-autoscaler-operator-bundle@sha256:b37be6f77b561de87de3a1678ac59edf6fc56fac6eabb86d767013ba5beca423_amd64 as a component of OpenShift Custom Metrics Autoscaler 2 | *, *, * |
| Red Hat | custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8-operator@sha256:de412b59e51684011b87900b31c46b04ef7b3f82b17ec65c9606b5d493aa8a69_amd64 as a component of OpenShift Custom Metrics Autoscaler 2 | custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8-operator@sha256:de412b59e51684011b87900b31c46b04ef7b3f82b17ec65c9606b5d493aa8a69_amd64, *, custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8-operator@sha256:de412b59e51684011b87900b31c46b04ef7b3f82b17ec65c9606b5d493aa8a69_amd64 |
| Red Hat | custom-metrics-autoscaler/custom-metrics-autoscaler-operator-bundle@sha256:b37be6f77b561de87de3a1678ac59edf6fc56fac6eabb86d767013ba5beca423_amd64 as a component of OpenShift Custom Metrics Autoscaler 2 | *, custom-metrics-autoscaler/custom-metrics-autoscaler-operator-bundle@sha256:b37be6f77b561de87de3a1678ac59edf6fc56fac6eabb86d767013ba5beca423_amd64, custom-metrics-autoscaler/custom-metrics-autoscaler-operator-bundle@sha256:b37be6f77b561de87de3a1678ac59edf6fc56fac6eabb86d767013ba5beca423_amd64 |
| Red Hat | custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel8@sha256:cd17032a683ebcdee0a8566e9427cc4e20eaa7413489dc2f9739bb1338c4c4a1_amd64 as a component of OpenShift Custom Metrics Autoscaler 2 | custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel8@sha256:cd17032a683ebcdee0a8566e9427cc4e20eaa7413489dc2f9739bb1338c4c4a1_amd64, custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel8@sha256:cd17032a683ebcdee0a8566e9427cc4e20eaa7413489dc2f9739bb1338c4c4a1_amd64, custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel8@sha256:cd17032a683ebcdee0a8566e9427cc4e20eaa7413489dc2f9739bb1338c4c4a1_amd64 |
| Red Hat | custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel8@sha256:1b0955076b99b7b240ef4baf55c079a8bba0d779fff6828e9acae70f4c71ad2b_amd64 as a component of OpenShift Custom Metrics Autoscaler 2 | *, custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel8@sha256:1b0955076b99b7b240ef4baf55c079a8bba0d779fff6828e9acae70f4c71ad2b_amd64, * |
| Red Hat | custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel8@sha256:1b0955076b99b7b240ef4baf55c079a8bba0d779fff6828e9acae70f4c71ad2b_amd64 as a component of OpenShift Custom Metrics Autoscaler 2 | custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel8@sha256:1b0955076b99b7b240ef4baf55c079a8bba0d779fff6828e9acae70f4c71ad2b_amd64, custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel8@sha256:1b0955076b99b7b240ef4baf55c079a8bba0d779fff6828e9acae70f4c71ad2b_amd64, custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel8@sha256:1b0955076b99b7b240ef4baf55c079a8bba0d779fff6828e9acae70f4c71ad2b_amd64 |
| Red Hat | custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8-operator@sha256:de412b59e51684011b87900b31c46b04ef7b3f82b17ec65c9606b5d493aa8a69_amd64 as a component of OpenShift Custom Metrics Autoscaler 2 | *, *, * |
| Red Hat | custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel8@sha256:cd17032a683ebcdee0a8566e9427cc4e20eaa7413489dc2f9739bb1338c4c4a1_amd64 as a component of OpenShift Custom Metrics Autoscaler 2 | custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel8@sha256:cd17032a683ebcdee0a8566e9427cc4e20eaa7413489dc2f9739bb1338c4c4a1_amd64, custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel8@sha256:cd17032a683ebcdee0a8566e9427cc4e20eaa7413489dc2f9739bb1338c4c4a1_amd64, * |
Timeline
- May 23, 2024 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- May 16, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2024:2901 advisory
- https://access.redhat.com/security/updates/classification/#low advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2901.json advisory
- https://access.redhat.com/security/cve/CVE-2023-45288 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2268273 issue
- https://www.cve.org/CVERecord?id=CVE-2023-45288 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-45288 advisory
- https://nowotarski.info/http2-continuation-flood/ advisory
- https://pkg.go.dev/vuln/GO-2024-2687 advisory
- https://www.kb.cert.org/vuls/id/421644 advisory
- https://access.redhat.com/security/cve/CVE-2023-45289 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2268018 issue
- https://www.cve.org/CVERecord?id=CVE-2023-45289 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-45289 advisory
- https://access.redhat.com/security/cve/CVE-2023-45290 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2268017 issue
- https://www.cve.org/CVERecord?id=CVE-2023-45290 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-45290 advisory
- http://www.openwall.com/lists/oss-security/2024/03/08/4 advisory
- https://go.dev/cl/569341 advisory
…and 27 more