Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (etcd) security update

Fixed packages 3

Vulnerabilities 5

• High 7.5
  CVE-2023-45288 Public exploit EPSS 89%

  HTTP/2 CONTINUATION flood in net/http

  An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a reques…

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 4, 2024
• High 7.5
  CVE-2024-1394

  Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads

  A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs​. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Azure Linux Go
  Mar 21, 2024
• High 7.5
  CVE-2024-4438

  Etcd: incomplete fix for cve-2023-39325/cve-2023-44487 in openstack platform

  The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2023-39325/CVE-2023-44487, known as Rapid Reset. This issue occurs because the etcd package in the Red Hat OpenStack platform is using http://golang.org/x/net/http2…

  Red Hat Red Hat OpenStack Platform 16.2 Red Hat OpenStack Platform 18.0 Red Hat OpenStack Platform 16.1
  May 8, 2024
• Unscored —
  CVE-2023-39326

  Denial of service via chunk extensions in net/http

  A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically rea…

  Go standard library net/http/internal katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Dec 6, 2023
• Unscored —
  CVE-2023-45287

  Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel

  Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of…

  Go standard library crypto/tls katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi Go
  Dec 5, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2253193
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2253330
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2262921
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268273
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2279365
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2729.json
• report
  https://access.redhat.com/security/cve/CVE-2023-39326
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-39326
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-39326
• advisory
  https://pkg.go.dev/vuln/GO-2023-2382
• report
  https://access.redhat.com/security/cve/CVE-2023-45287
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-45287
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-45287
• advisory
  https://pkg.go.dev/vuln/GO-2023-2375
• report
  https://access.redhat.com/security/cve/CVE-2023-45288
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-45288
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-45288
• article
  https://nowotarski.info/http2-continuation-flood/
• advisory
  https://pkg.go.dev/vuln/GO-2024-2687
• advisory
  https://www.kb.cert.org/vuls/id/421644
• report
  https://access.redhat.com/security/cve/CVE-2024-1394
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-1394
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-1394
• article
  https://github.com/golang-fips/openssl/commit/85d31d0d257ce842c8a1e63c4d230ae850348136
• article
  https://github.com/golang-fips/openssl/security/advisories/GHSA-78hx-gp6g-7mj6
• article
  https://github.com/microsoft/go-crypto-openssl/commit/104fe7f6912788d2ad44602f77a0a0a62f1f259f
• advisory
  https://pkg.go.dev/vuln/GO-2024-2660
• article
  https://vuln.go.dev/ID/GO-2024-2660.json
• report
  https://access.redhat.com/security/cve/CVE-2024-4438
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-4438
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-4438