(RHSA-2023:7345) Important: Red Hat OpenShift GitOps v1.9.3 security update

2023-11-2008:32:06

access.redhat.com

red hat

openshift gitops

security update

rapid stream resets

http/2

ddos attack

cve-2023-39325

cve-2023-44487

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.816

Percentile

98.4%

JSON

An update is now available for Red Hat OpenShift GitOps 1.9.

Security Fix(es):

golang: net/http, x/net/http2: rapid stream resets can cause excessive work (Rapid Reset Attack) (CVE-2023-39325)
HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)

A Red Hat Security Bulletin which addresses further details about the Rapid Reset flaw is available in the References section.

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.