Red Hat Security Advisory: Red Hat Service Interconnect 1.4.5 Release security update

Fixed packages 2

Vulnerabilities 2

• High 7.5
  CVE-2023-45288 Public exploit EPSS 89%

  HTTP/2 CONTINUATION flood in net/http

  An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a reques…

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 4, 2024
• Medium 5.9
  CVE-2024-24783

  Verify panics on certificates with an unknown public key algorithm in crypto/x509

  Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyC…

  Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 5, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_service_interconnect/1.4
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268019
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268273
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4125.json
• report
  https://access.redhat.com/security/cve/CVE-2023-45288
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-45288
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-45288
• article
  https://nowotarski.info/http2-continuation-flood/
• advisory
  https://pkg.go.dev/vuln/GO-2024-2687
• advisory
  https://www.kb.cert.org/vuls/id/421644
• report
  https://access.redhat.com/security/cve/CVE-2024-24783
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-24783
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-24783
• article
  http://www.openwall.com/lists/oss-security/2024/03/08/4
• advisory
  https://github.com/advisories/GHSA-3q2c-pvp5-3cqp
• article
  https://go.dev/cl/569339
• article
  https://go.dev/issue/65390
• article
  https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
• advisory
  https://pkg.go.dev/vuln/GO-2024-2598
• article
  https://security.netapp.com/advisory/ntap-20240329-0005