(RHSA-2023:6786) Important: Fence Agents Remediation Operator 0.2.1 security update

2023-11-0801:44:39

access.redhat.com

fence agents

remediation operator

ipmi

security update

http/2

ddos attack

cve-2023-44487

cluster nodes

power cycling

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8 High

AI Score

Confidence

High

0.732 High

EPSS

Percentile

98.1%

JSON

The Fence Agents Remediation Operator runs an existing set of upstream
fencing agents for environments with a traditional API end-point (for
example, IPMI) for power cycling cluster nodes.

Security Fix(es):

golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) (CVE-2023-39325)
HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.