Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.2.2 Product Security and Bug Fix Update

Fixed packages 4

Vulnerabilities 1

• High 7.5
  CVE-2023-39325 Public exploit

  HTTP/2 rapid reset can cause excessive work in net/http

  A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress requ…

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 11, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2243296
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5809.json
• report
  https://access.redhat.com/security/cve/CVE-2023-39325
• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2023-003
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-39325
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-39325
• article
  https://access.redhat.com/security/cve/CVE-2023-44487
• article
  https://go.dev/issue/63417
• advisory
  https://pkg.go.dev/vuln/GO-2023-2102
• article
  https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487