Vulnerability-Lookup

RHBA-2023:5669

Vulnerability from csaf_redhat - Published: 2023-11-02 13:16 - Updated: 2026-08-12 09:25

Summary

Red Hat Bug Fix Advisory: OpenShift Compliance Operator bug fix and enhancement update

Severity

Important

Notes

Topic: An updated OpenShift Compliance Operator image that fixes various bugs and adds enhancements is now available for the Red Hat OpenShift Enterprise 4 catalog.

Details: The OpenShift Compliance Operator v1.3.1 is now available. See the documentation for bug fix and enhancement information: https://docs.openshift.com/container-platform/4.14/security/compliance_operator/compliance-operator-release-notes.html

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2023-39325

A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RST_STREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any server-side limit for the maximum number of active streams per connection, resulting in a denial of service due to server resource consumption. Red Hat has rated the severity of this flaw as 'Important' as the US Cybersecurity and Infrastructure Security Agency (CISA) declared this vulnerability an active exploit. CVE-2023-39325 was assigned for the `Rapid Reset Attack` in the Go language packages.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-400 - Uncontrolled Resource Consumption

Affected products

Fixed 10 products

Product	Version	Remediation
Unresolved product id: 8Base-CO-1:compliance/openshift-compliance-content-rhel8@sha256:1ee5854db4754c4595ad5c5554202a81e3c59864d4e94bc8232dde0f29f0ed7e_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-CO-1:compliance/openshift-compliance-content-rhel8@sha256:a535f7b6dc4702ee549521ff0f6be6f2808c7c8d20c0a0ce30f8545c2a011458_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-CO-1:compliance/openshift-compliance-content-rhel8@sha256:e78b947e5da6a7a2738fe190d94dc65a79fa09d3f0f2cba9d4f395cc2822b06a_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-CO-1:compliance/openshift-compliance-openscap-rhel8@sha256:4765be5f9ce6c11a2b2db99766a8b96a172502c2abf2424b92a2eba4e0c9f2aa_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-CO-1:compliance/openshift-compliance-openscap-rhel8@sha256:cf23ae92f996605f525f62ffa648ea1d90af5d5b5a9db831bd023608c7ef454e_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-CO-1:compliance/openshift-compliance-openscap-rhel8@sha256:ea5459b9bb2fd5cbc561a68be8967b2b10fc7ffafa5a83cf4a062412587505ec_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-CO-1:compliance/openshift-compliance-operator-bundle@sha256:4088d89f23064fd53a680c71dd7072a0cb1088781c374f7803b6c77997aa7c67_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-CO-1:compliance/openshift-compliance-rhel8-operator@sha256:17c8f12442f7f569e2b934ccf0cb1534e24a9e4c56d02381b51d9d036351cf30_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-CO-1:compliance/openshift-compliance-rhel8-operator@sha256:affa6493d1b38d442deba5e7cc4f79af04a90b8eca337539fc64c7ca258118a2_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-CO-1:compliance/openshift-compliance-rhel8-operator@sha256:ef2e5d192edfc0536de0c8a33ab2604ffaea1467a2e26f860dc19fa53f90e584_amd64	—	Vendor Fix fix Workaround

Threats

Impact Important

References

12 references

URL	Category
https://access.redhat.com/errata/RHBA-2023:5669	self
https://issues.redhat.com/browse/OCPBUGS-18025	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2023-39325	self
https://bugzilla.redhat.com/show_bug.cgi?id=2243296	external
https://access.redhat.com/security/vulnerabilitie…	external
https://www.cve.org/CVERecord?id=CVE-2023-39325	external
https://nvd.nist.gov/vuln/detail/CVE-2023-39325	external
https://access.redhat.com/security/cve/CVE-2023-44487	external
https://go.dev/issue/63417	external
https://pkg.go.dev/vuln/GO-2023-2102	external
https://www.cisa.gov/news-events/alerts/2023/10/1…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An updated OpenShift Compliance Operator image that fixes various bugs and adds enhancements is now available for the Red Hat OpenShift Enterprise 4 catalog.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The OpenShift Compliance Operator v1.3.1 is now available. See the documentation for bug fix and enhancement information:\n\nhttps://docs.openshift.com/container-platform/4.14/security/compliance_operator/compliance-operator-release-notes.html",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHBA-2023:5669",
        "url": "https://access.redhat.com/errata/RHBA-2023:5669"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-18025",
        "url": "https://issues.redhat.com/browse/OCPBUGS-18025"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhba-2023_5669.json"
      }
    ],
    "title": "Red Hat Bug Fix Advisory: OpenShift Compliance Operator bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-08-12T09:25:24+00:00",
      "generator": {
        "date": "2026-08-12T09:25:24+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.14"
        }
      },
      "id": "RHBA-2023:5669",
      "initial_release_date": "2023-11-02T13:16:03+00:00",
      "revision_history": [
        {
          "date": "2023-11-02T13:16:03+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2023-11-02T13:16:03+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-12T09:25:24+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Compliance Operator v1 on RHEL-8",
                "product": {
                  "name": "Red Hat OpenShift Compliance Operator v1 on RHEL-8",
                  "product_id": "8Base-CO-1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift_compliance_operator:1::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Enterprise"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "compliance/openshift-compliance-content-rhel8@sha256:a535f7b6dc4702ee549521ff0f6be6f2808c7c8d20c0a0ce30f8545c2a011458_s390x",
                "product": {
                  "name": "compliance/openshift-compliance-content-rhel8@sha256:a535f7b6dc4702ee549521ff0f6be6f2808c7c8d20c0a0ce30f8545c2a011458_s390x",
                  "product_id": "compliance/openshift-compliance-content-rhel8@sha256:a535f7b6dc4702ee549521ff0f6be6f2808c7c8d20c0a0ce30f8545c2a011458_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-compliance-content-rhel8@sha256:a535f7b6dc4702ee549521ff0f6be6f2808c7c8d20c0a0ce30f8545c2a011458?arch=s390x\u0026repository_url=registry.redhat.io/compliance/openshift-compliance-content-rhel8\u0026tag=5f9cd1975d-10"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "compliance/openshift-compliance-openscap-rhel8@sha256:4765be5f9ce6c11a2b2db99766a8b96a172502c2abf2424b92a2eba4e0c9f2aa_s390x",
                "product": {
                  "name": "compliance/openshift-compliance-openscap-rhel8@sha256:4765be5f9ce6c11a2b2db99766a8b96a172502c2abf2424b92a2eba4e0c9f2aa_s390x",
                  "product_id": "compliance/openshift-compliance-openscap-rhel8@sha256:4765be5f9ce6c11a2b2db99766a8b96a172502c2abf2424b92a2eba4e0c9f2aa_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-compliance-openscap-rhel8@sha256:4765be5f9ce6c11a2b2db99766a8b96a172502c2abf2424b92a2eba4e0c9f2aa?arch=s390x\u0026repository_url=registry.redhat.io/compliance/openshift-compliance-openscap-rhel8\u0026tag=1.3.0-7"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "compliance/openshift-compliance-rhel8-operator@sha256:17c8f12442f7f569e2b934ccf0cb1534e24a9e4c56d02381b51d9d036351cf30_s390x",
                "product": {
                  "name": "compliance/openshift-compliance-rhel8-operator@sha256:17c8f12442f7f569e2b934ccf0cb1534e24a9e4c56d02381b51d9d036351cf30_s390x",
                  "product_id": "compliance/openshift-compliance-rhel8-operator@sha256:17c8f12442f7f569e2b934ccf0cb1534e24a9e4c56d02381b51d9d036351cf30_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-compliance-rhel8-operator@sha256:17c8f12442f7f569e2b934ccf0cb1534e24a9e4c56d02381b51d9d036351cf30?arch=s390x\u0026repository_url=registry.redhat.io/compliance/openshift-compliance-rhel8-operator\u0026tag=1.3.0-6"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "compliance/openshift-compliance-content-rhel8@sha256:e78b947e5da6a7a2738fe190d94dc65a79fa09d3f0f2cba9d4f395cc2822b06a_amd64",
                "product": {
                  "name": "compliance/openshift-compliance-content-rhel8@sha256:e78b947e5da6a7a2738fe190d94dc65a79fa09d3f0f2cba9d4f395cc2822b06a_amd64",
                  "product_id": "compliance/openshift-compliance-content-rhel8@sha256:e78b947e5da6a7a2738fe190d94dc65a79fa09d3f0f2cba9d4f395cc2822b06a_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-compliance-content-rhel8@sha256:e78b947e5da6a7a2738fe190d94dc65a79fa09d3f0f2cba9d4f395cc2822b06a?arch=amd64\u0026repository_url=registry.redhat.io/compliance/openshift-compliance-content-rhel8\u0026tag=5f9cd1975d-10"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "compliance/openshift-compliance-openscap-rhel8@sha256:ea5459b9bb2fd5cbc561a68be8967b2b10fc7ffafa5a83cf4a062412587505ec_amd64",
                "product": {
                  "name": "compliance/openshift-compliance-openscap-rhel8@sha256:ea5459b9bb2fd5cbc561a68be8967b2b10fc7ffafa5a83cf4a062412587505ec_amd64",
                  "product_id": "compliance/openshift-compliance-openscap-rhel8@sha256:ea5459b9bb2fd5cbc561a68be8967b2b10fc7ffafa5a83cf4a062412587505ec_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-compliance-openscap-rhel8@sha256:ea5459b9bb2fd5cbc561a68be8967b2b10fc7ffafa5a83cf4a062412587505ec?arch=amd64\u0026repository_url=registry.redhat.io/compliance/openshift-compliance-openscap-rhel8\u0026tag=1.3.0-7"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "compliance/openshift-compliance-operator-bundle@sha256:4088d89f23064fd53a680c71dd7072a0cb1088781c374f7803b6c77997aa7c67_amd64",
                "product": {
                  "name": "compliance/openshift-compliance-operator-bundle@sha256:4088d89f23064fd53a680c71dd7072a0cb1088781c374f7803b6c77997aa7c67_amd64",
                  "product_id": "compliance/openshift-compliance-operator-bundle@sha256:4088d89f23064fd53a680c71dd7072a0cb1088781c374f7803b6c77997aa7c67_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-compliance-operator-bundle@sha256:4088d89f23064fd53a680c71dd7072a0cb1088781c374f7803b6c77997aa7c67?arch=amd64\u0026repository_url=registry.redhat.io/compliance/openshift-compliance-operator-bundle\u0026tag=1.3.1-6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "compliance/openshift-compliance-rhel8-operator@sha256:ef2e5d192edfc0536de0c8a33ab2604ffaea1467a2e26f860dc19fa53f90e584_amd64",
                "product": {
                  "name": "compliance/openshift-compliance-rhel8-operator@sha256:ef2e5d192edfc0536de0c8a33ab2604ffaea1467a2e26f860dc19fa53f90e584_amd64",
                  "product_id": "compliance/openshift-compliance-rhel8-operator@sha256:ef2e5d192edfc0536de0c8a33ab2604ffaea1467a2e26f860dc19fa53f90e584_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-compliance-rhel8-operator@sha256:ef2e5d192edfc0536de0c8a33ab2604ffaea1467a2e26f860dc19fa53f90e584?arch=amd64\u0026repository_url=registry.redhat.io/compliance/openshift-compliance-rhel8-operator\u0026tag=1.3.0-6"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "compliance/openshift-compliance-content-rhel8@sha256:1ee5854db4754c4595ad5c5554202a81e3c59864d4e94bc8232dde0f29f0ed7e_ppc64le",
                "product": {
                  "name": "compliance/openshift-compliance-content-rhel8@sha256:1ee5854db4754c4595ad5c5554202a81e3c59864d4e94bc8232dde0f29f0ed7e_ppc64le",
                  "product_id": "compliance/openshift-compliance-content-rhel8@sha256:1ee5854db4754c4595ad5c5554202a81e3c59864d4e94bc8232dde0f29f0ed7e_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-compliance-content-rhel8@sha256:1ee5854db4754c4595ad5c5554202a81e3c59864d4e94bc8232dde0f29f0ed7e?arch=ppc64le\u0026repository_url=registry.redhat.io/compliance/openshift-compliance-content-rhel8\u0026tag=5f9cd1975d-10"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "compliance/openshift-compliance-openscap-rhel8@sha256:cf23ae92f996605f525f62ffa648ea1d90af5d5b5a9db831bd023608c7ef454e_ppc64le",
                "product": {
                  "name": "compliance/openshift-compliance-openscap-rhel8@sha256:cf23ae92f996605f525f62ffa648ea1d90af5d5b5a9db831bd023608c7ef454e_ppc64le",
                  "product_id": "compliance/openshift-compliance-openscap-rhel8@sha256:cf23ae92f996605f525f62ffa648ea1d90af5d5b5a9db831bd023608c7ef454e_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-compliance-openscap-rhel8@sha256:cf23ae92f996605f525f62ffa648ea1d90af5d5b5a9db831bd023608c7ef454e?arch=ppc64le\u0026repository_url=registry.redhat.io/compliance/openshift-compliance-openscap-rhel8\u0026tag=1.3.0-7"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "compliance/openshift-compliance-rhel8-operator@sha256:affa6493d1b38d442deba5e7cc4f79af04a90b8eca337539fc64c7ca258118a2_ppc64le",
                "product": {
                  "name": "compliance/openshift-compliance-rhel8-operator@sha256:affa6493d1b38d442deba5e7cc4f79af04a90b8eca337539fc64c7ca258118a2_ppc64le",
                  "product_id": "compliance/openshift-compliance-rhel8-operator@sha256:affa6493d1b38d442deba5e7cc4f79af04a90b8eca337539fc64c7ca258118a2_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/openshift-compliance-rhel8-operator@sha256:affa6493d1b38d442deba5e7cc4f79af04a90b8eca337539fc64c7ca258118a2?arch=ppc64le\u0026repository_url=registry.redhat.io/compliance/openshift-compliance-rhel8-operator\u0026tag=1.3.0-6"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "compliance/openshift-compliance-content-rhel8@sha256:1ee5854db4754c4595ad5c5554202a81e3c59864d4e94bc8232dde0f29f0ed7e_ppc64le as a component of Red Hat OpenShift Compliance Operator v1 on RHEL-8",
          "product_id": "8Base-CO-1:compliance/openshift-compliance-content-rhel8@sha256:1ee5854db4754c4595ad5c5554202a81e3c59864d4e94bc8232dde0f29f0ed7e_ppc64le"
        },
        "product_reference": "compliance/openshift-compliance-content-rhel8@sha256:1ee5854db4754c4595ad5c5554202a81e3c59864d4e94bc8232dde0f29f0ed7e_ppc64le",
        "relates_to_product_reference": "8Base-CO-1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "compliance/openshift-compliance-content-rhel8@sha256:a535f7b6dc4702ee549521ff0f6be6f2808c7c8d20c0a0ce30f8545c2a011458_s390x as a component of Red Hat OpenShift Compliance Operator v1 on RHEL-8",
          "product_id": "8Base-CO-1:compliance/openshift-compliance-content-rhel8@sha256:a535f7b6dc4702ee549521ff0f6be6f2808c7c8d20c0a0ce30f8545c2a011458_s390x"
        },
        "product_reference": "compliance/openshift-compliance-content-rhel8@sha256:a535f7b6dc4702ee549521ff0f6be6f2808c7c8d20c0a0ce30f8545c2a011458_s390x",
        "relates_to_product_reference": "8Base-CO-1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "compliance/openshift-compliance-content-rhel8@sha256:e78b947e5da6a7a2738fe190d94dc65a79fa09d3f0f2cba9d4f395cc2822b06a_amd64 as a component of Red Hat OpenShift Compliance Operator v1 on RHEL-8",
          "product_id": "8Base-CO-1:compliance/openshift-compliance-content-rhel8@sha256:e78b947e5da6a7a2738fe190d94dc65a79fa09d3f0f2cba9d4f395cc2822b06a_amd64"
        },
        "product_reference": "compliance/openshift-compliance-content-rhel8@sha256:e78b947e5da6a7a2738fe190d94dc65a79fa09d3f0f2cba9d4f395cc2822b06a_amd64",
        "relates_to_product_reference": "8Base-CO-1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "compliance/openshift-compliance-openscap-rhel8@sha256:4765be5f9ce6c11a2b2db99766a8b96a172502c2abf2424b92a2eba4e0c9f2aa_s390x as a component of Red Hat OpenShift Compliance Operator v1 on RHEL-8",
          "product_id": "8Base-CO-1:compliance/openshift-compliance-openscap-rhel8@sha256:4765be5f9ce6c11a2b2db99766a8b96a172502c2abf2424b92a2eba4e0c9f2aa_s390x"
        },
        "product_reference": "compliance/openshift-compliance-openscap-rhel8@sha256:4765be5f9ce6c11a2b2db99766a8b96a172502c2abf2424b92a2eba4e0c9f2aa_s390x",
        "relates_to_product_reference": "8Base-CO-1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "compliance/openshift-compliance-openscap-rhel8@sha256:cf23ae92f996605f525f62ffa648ea1d90af5d5b5a9db831bd023608c7ef454e_ppc64le as a component of Red Hat OpenShift Compliance Operator v1 on RHEL-8",
          "product_id": "8Base-CO-1:compliance/openshift-compliance-openscap-rhel8@sha256:cf23ae92f996605f525f62ffa648ea1d90af5d5b5a9db831bd023608c7ef454e_ppc64le"
        },
        "product_reference": "compliance/openshift-compliance-openscap-rhel8@sha256:cf23ae92f996605f525f62ffa648ea1d90af5d5b5a9db831bd023608c7ef454e_ppc64le",
        "relates_to_product_reference": "8Base-CO-1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "compliance/openshift-compliance-openscap-rhel8@sha256:ea5459b9bb2fd5cbc561a68be8967b2b10fc7ffafa5a83cf4a062412587505ec_amd64 as a component of Red Hat OpenShift Compliance Operator v1 on RHEL-8",
          "product_id": "8Base-CO-1:compliance/openshift-compliance-openscap-rhel8@sha256:ea5459b9bb2fd5cbc561a68be8967b2b10fc7ffafa5a83cf4a062412587505ec_amd64"
        },
        "product_reference": "compliance/openshift-compliance-openscap-rhel8@sha256:ea5459b9bb2fd5cbc561a68be8967b2b10fc7ffafa5a83cf4a062412587505ec_amd64",
        "relates_to_product_reference": "8Base-CO-1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "compliance/openshift-compliance-operator-bundle@sha256:4088d89f23064fd53a680c71dd7072a0cb1088781c374f7803b6c77997aa7c67_amd64 as a component of Red Hat OpenShift Compliance Operator v1 on RHEL-8",
          "product_id": "8Base-CO-1:compliance/openshift-compliance-operator-bundle@sha256:4088d89f23064fd53a680c71dd7072a0cb1088781c374f7803b6c77997aa7c67_amd64"
        },
        "product_reference": "compliance/openshift-compliance-operator-bundle@sha256:4088d89f23064fd53a680c71dd7072a0cb1088781c374f7803b6c77997aa7c67_amd64",
        "relates_to_product_reference": "8Base-CO-1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "compliance/openshift-compliance-rhel8-operator@sha256:17c8f12442f7f569e2b934ccf0cb1534e24a9e4c56d02381b51d9d036351cf30_s390x as a component of Red Hat OpenShift Compliance Operator v1 on RHEL-8",
          "product_id": "8Base-CO-1:compliance/openshift-compliance-rhel8-operator@sha256:17c8f12442f7f569e2b934ccf0cb1534e24a9e4c56d02381b51d9d036351cf30_s390x"
        },
        "product_reference": "compliance/openshift-compliance-rhel8-operator@sha256:17c8f12442f7f569e2b934ccf0cb1534e24a9e4c56d02381b51d9d036351cf30_s390x",
        "relates_to_product_reference": "8Base-CO-1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "compliance/openshift-compliance-rhel8-operator@sha256:affa6493d1b38d442deba5e7cc4f79af04a90b8eca337539fc64c7ca258118a2_ppc64le as a component of Red Hat OpenShift Compliance Operator v1 on RHEL-8",
          "product_id": "8Base-CO-1:compliance/openshift-compliance-rhel8-operator@sha256:affa6493d1b38d442deba5e7cc4f79af04a90b8eca337539fc64c7ca258118a2_ppc64le"
        },
        "product_reference": "compliance/openshift-compliance-rhel8-operator@sha256:affa6493d1b38d442deba5e7cc4f79af04a90b8eca337539fc64c7ca258118a2_ppc64le",
        "relates_to_product_reference": "8Base-CO-1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "compliance/openshift-compliance-rhel8-operator@sha256:ef2e5d192edfc0536de0c8a33ab2604ffaea1467a2e26f860dc19fa53f90e584_amd64 as a component of Red Hat OpenShift Compliance Operator v1 on RHEL-8",
          "product_id": "8Base-CO-1:compliance/openshift-compliance-rhel8-operator@sha256:ef2e5d192edfc0536de0c8a33ab2604ffaea1467a2e26f860dc19fa53f90e584_amd64"
        },
        "product_reference": "compliance/openshift-compliance-rhel8-operator@sha256:ef2e5d192edfc0536de0c8a33ab2604ffaea1467a2e26f860dc19fa53f90e584_amd64",
        "relates_to_product_reference": "8Base-CO-1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-39325",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2023-10-10T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2243296"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RST_STREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any server-side limit for the maximum number of active streams per connection, resulting in a denial of service due to server resource consumption. Red Hat has rated the severity of this flaw as \u0027Important\u0027 as the US Cybersecurity and Infrastructure Security Agency (CISA) declared this vulnerability an active exploit.\r\n\r\nCVE-2023-39325 was assigned for the `Rapid Reset Attack` in the Go language packages.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This CVE is related to CVE-2023-44487.\n\nThe majority of RHEL utilities are not long-running applications; instead, they are command-line tools. These tools utilize Golang package as build-time dependency, which is why they are classified as having a \"Moderate\" level of impact.\n\nAs go-lang vendors its dependencies, a package may contain a library with a known vulnerability, solely because of lower tier libraries including it as a part of its dependencies, but the vulnerable code is not reachable at runtime. In such cases the issue is not exploitable. We classify these situations as \u201cNot affected\u201d or \u201cWill not fix,\u201d depending on the risk of breaking other unrelated packages.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-CO-1:compliance/openshift-compliance-content-rhel8@sha256:1ee5854db4754c4595ad5c5554202a81e3c59864d4e94bc8232dde0f29f0ed7e_ppc64le",
          "8Base-CO-1:compliance/openshift-compliance-content-rhel8@sha256:a535f7b6dc4702ee549521ff0f6be6f2808c7c8d20c0a0ce30f8545c2a011458_s390x",
          "8Base-CO-1:compliance/openshift-compliance-content-rhel8@sha256:e78b947e5da6a7a2738fe190d94dc65a79fa09d3f0f2cba9d4f395cc2822b06a_amd64",
          "8Base-CO-1:compliance/openshift-compliance-openscap-rhel8@sha256:4765be5f9ce6c11a2b2db99766a8b96a172502c2abf2424b92a2eba4e0c9f2aa_s390x",
          "8Base-CO-1:compliance/openshift-compliance-openscap-rhel8@sha256:cf23ae92f996605f525f62ffa648ea1d90af5d5b5a9db831bd023608c7ef454e_ppc64le",
          "8Base-CO-1:compliance/openshift-compliance-openscap-rhel8@sha256:ea5459b9bb2fd5cbc561a68be8967b2b10fc7ffafa5a83cf4a062412587505ec_amd64",
          "8Base-CO-1:compliance/openshift-compliance-operator-bundle@sha256:4088d89f23064fd53a680c71dd7072a0cb1088781c374f7803b6c77997aa7c67_amd64",
          "8Base-CO-1:compliance/openshift-compliance-rhel8-operator@sha256:17c8f12442f7f569e2b934ccf0cb1534e24a9e4c56d02381b51d9d036351cf30_s390x",
          "8Base-CO-1:compliance/openshift-compliance-rhel8-operator@sha256:affa6493d1b38d442deba5e7cc4f79af04a90b8eca337539fc64c7ca258118a2_ppc64le",
          "8Base-CO-1:compliance/openshift-compliance-rhel8-operator@sha256:ef2e5d192edfc0536de0c8a33ab2604ffaea1467a2e26f860dc19fa53f90e584_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-39325"
        },
        {
          "category": "external",
          "summary": "RHBZ#2243296",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2243296"
        },
        {
          "category": "external",
          "summary": "RHSB-2023-003",
          "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-003"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-39325",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-39325"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-39325",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39325"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/security/cve/CVE-2023-44487",
          "url": "https://access.redhat.com/security/cve/CVE-2023-44487"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/63417",
          "url": "https://go.dev/issue/63417"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2023-2102",
          "url": "https://pkg.go.dev/vuln/GO-2023-2102"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487",
          "url": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487"
        }
      ],
      "release_date": "2023-10-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-11-02T13:16:03+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to:\n\nhttps://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html",
          "product_ids": [
            "8Base-CO-1:compliance/openshift-compliance-content-rhel8@sha256:1ee5854db4754c4595ad5c5554202a81e3c59864d4e94bc8232dde0f29f0ed7e_ppc64le",
            "8Base-CO-1:compliance/openshift-compliance-content-rhel8@sha256:a535f7b6dc4702ee549521ff0f6be6f2808c7c8d20c0a0ce30f8545c2a011458_s390x",
            "8Base-CO-1:compliance/openshift-compliance-content-rhel8@sha256:e78b947e5da6a7a2738fe190d94dc65a79fa09d3f0f2cba9d4f395cc2822b06a_amd64",
            "8Base-CO-1:compliance/openshift-compliance-openscap-rhel8@sha256:4765be5f9ce6c11a2b2db99766a8b96a172502c2abf2424b92a2eba4e0c9f2aa_s390x",
            "8Base-CO-1:compliance/openshift-compliance-openscap-rhel8@sha256:cf23ae92f996605f525f62ffa648ea1d90af5d5b5a9db831bd023608c7ef454e_ppc64le",
            "8Base-CO-1:compliance/openshift-compliance-openscap-rhel8@sha256:ea5459b9bb2fd5cbc561a68be8967b2b10fc7ffafa5a83cf4a062412587505ec_amd64",
            "8Base-CO-1:compliance/openshift-compliance-operator-bundle@sha256:4088d89f23064fd53a680c71dd7072a0cb1088781c374f7803b6c77997aa7c67_amd64",
            "8Base-CO-1:compliance/openshift-compliance-rhel8-operator@sha256:17c8f12442f7f569e2b934ccf0cb1534e24a9e4c56d02381b51d9d036351cf30_s390x",
            "8Base-CO-1:compliance/openshift-compliance-rhel8-operator@sha256:affa6493d1b38d442deba5e7cc4f79af04a90b8eca337539fc64c7ca258118a2_ppc64le",
            "8Base-CO-1:compliance/openshift-compliance-rhel8-operator@sha256:ef2e5d192edfc0536de0c8a33ab2604ffaea1467a2e26f860dc19fa53f90e584_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2023:5669"
        },
        {
          "category": "workaround",
          "details": "The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.",
          "product_ids": [
            "8Base-CO-1:compliance/openshift-compliance-content-rhel8@sha256:1ee5854db4754c4595ad5c5554202a81e3c59864d4e94bc8232dde0f29f0ed7e_ppc64le",
            "8Base-CO-1:compliance/openshift-compliance-content-rhel8@sha256:a535f7b6dc4702ee549521ff0f6be6f2808c7c8d20c0a0ce30f8545c2a011458_s390x",
            "8Base-CO-1:compliance/openshift-compliance-content-rhel8@sha256:e78b947e5da6a7a2738fe190d94dc65a79fa09d3f0f2cba9d4f395cc2822b06a_amd64",
            "8Base-CO-1:compliance/openshift-compliance-openscap-rhel8@sha256:4765be5f9ce6c11a2b2db99766a8b96a172502c2abf2424b92a2eba4e0c9f2aa_s390x",
            "8Base-CO-1:compliance/openshift-compliance-openscap-rhel8@sha256:cf23ae92f996605f525f62ffa648ea1d90af5d5b5a9db831bd023608c7ef454e_ppc64le",
            "8Base-CO-1:compliance/openshift-compliance-openscap-rhel8@sha256:ea5459b9bb2fd5cbc561a68be8967b2b10fc7ffafa5a83cf4a062412587505ec_amd64",
            "8Base-CO-1:compliance/openshift-compliance-operator-bundle@sha256:4088d89f23064fd53a680c71dd7072a0cb1088781c374f7803b6c77997aa7c67_amd64",
            "8Base-CO-1:compliance/openshift-compliance-rhel8-operator@sha256:17c8f12442f7f569e2b934ccf0cb1534e24a9e4c56d02381b51d9d036351cf30_s390x",
            "8Base-CO-1:compliance/openshift-compliance-rhel8-operator@sha256:affa6493d1b38d442deba5e7cc4f79af04a90b8eca337539fc64c7ca258118a2_ppc64le",
            "8Base-CO-1:compliance/openshift-compliance-rhel8-operator@sha256:ef2e5d192edfc0536de0c8a33ab2604ffaea1467a2e26f860dc19fa53f90e584_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-CO-1:compliance/openshift-compliance-content-rhel8@sha256:1ee5854db4754c4595ad5c5554202a81e3c59864d4e94bc8232dde0f29f0ed7e_ppc64le",
            "8Base-CO-1:compliance/openshift-compliance-content-rhel8@sha256:a535f7b6dc4702ee549521ff0f6be6f2808c7c8d20c0a0ce30f8545c2a011458_s390x",
            "8Base-CO-1:compliance/openshift-compliance-content-rhel8@sha256:e78b947e5da6a7a2738fe190d94dc65a79fa09d3f0f2cba9d4f395cc2822b06a_amd64",
            "8Base-CO-1:compliance/openshift-compliance-openscap-rhel8@sha256:4765be5f9ce6c11a2b2db99766a8b96a172502c2abf2424b92a2eba4e0c9f2aa_s390x",
            "8Base-CO-1:compliance/openshift-compliance-openscap-rhel8@sha256:cf23ae92f996605f525f62ffa648ea1d90af5d5b5a9db831bd023608c7ef454e_ppc64le",
            "8Base-CO-1:compliance/openshift-compliance-openscap-rhel8@sha256:ea5459b9bb2fd5cbc561a68be8967b2b10fc7ffafa5a83cf4a062412587505ec_amd64",
            "8Base-CO-1:compliance/openshift-compliance-operator-bundle@sha256:4088d89f23064fd53a680c71dd7072a0cb1088781c374f7803b6c77997aa7c67_amd64",
            "8Base-CO-1:compliance/openshift-compliance-rhel8-operator@sha256:17c8f12442f7f569e2b934ccf0cb1534e24a9e4c56d02381b51d9d036351cf30_s390x",
            "8Base-CO-1:compliance/openshift-compliance-rhel8-operator@sha256:affa6493d1b38d442deba5e7cc4f79af04a90b8eca337539fc64c7ca258118a2_ppc64le",
            "8Base-CO-1:compliance/openshift-compliance-rhel8-operator@sha256:ef2e5d192edfc0536de0c8a33ab2604ffaea1467a2e26f860dc19fa53f90e584_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)"
    }
  ]
}

CVE-2023-39325 (GCVE-0-2023-39325)

Vulnerability from cvelistv5 – Published: 2023-10-11 21:15 – Updated: 2025-02-13 17:02

Title

HTTP/2 rapid reset can cause excessive work in net/http

Summary

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.

Severity

No CVSS data available.

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

References

43 references

URL	Tags
https://go.dev/issue/63417
https://go.dev/cl/534215
https://go.dev/cl/534235
https://groups.google.com/g/golang-announce/c/iNN…
https://pkg.go.dev/vuln/GO-2023-2102
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://security.netapp.com/advisory/ntap-2023111…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://security.gentoo.org/glsa/202311-09
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…

Impacted products

2 products

Vendor	Product	Version
Go standard library	net/http	Affected: 0 , < 1.20.10 (semver) Affected: 1.21.0-0 , < 1.21.3 (semver)
golang.org/x/net	golang.org/x/net/http2	Affected: 0 , < 0.17.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T18:02:06.746Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/63417"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/534215"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/534235"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2023-2102"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20231110-0008/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202311-09"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3OVW5V2DM5K5IC3H7O42YDUGNJ74J35O/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MZQYOOKHQDQ57LV2IAG6NRFOVXKHJJ3Z/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FTMJ3NJIDAZFWJQQSP3L22MUFJ3UP2PT/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPWCNYB5PQ5PCVZ4NJT6G56ZYFZ5QBU6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LZSWTV4NV4SNQARNXG5T6LRHP26EW2/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PJCUNGIQDUMZ4Z6HWVYIMR66A35F5S74/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5E5JSJBZLYXOTZWXHJKRVCIXIHVWKJ6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YJWHBLVZDM5KQSDFRBFRKU5KSSOLIRQ4/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WJ4QVX2AMUJ2F2S27POOAHRC4K3CHU4/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ODBY7RVMGZCBSTWF2OZGIZS57FNFUL67/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXOU2JZUBEBP7GBKAYIJRPRBZSJCD7ST/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/http",
          "product": "net/http",
          "programRoutines": [
            {
              "name": "http2serverConn.serve"
            },
            {
              "name": "http2serverConn.processHeaders"
            },
            {
              "name": "http2serverConn.upgradeRequest"
            },
            {
              "name": "http2serverConn.runHandler"
            },
            {
              "name": "ListenAndServe"
            },
            {
              "name": "ListenAndServeTLS"
            },
            {
              "name": "Serve"
            },
            {
              "name": "ServeTLS"
            },
            {
              "name": "Server.ListenAndServe"
            },
            {
              "name": "Server.ListenAndServeTLS"
            },
            {
              "name": "Server.Serve"
            },
            {
              "name": "Server.ServeTLS"
            },
            {
              "name": "http2Server.ServeConn"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.20.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.21.3",
              "status": "affected",
              "version": "1.21.0-0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/net/http2",
          "product": "golang.org/x/net/http2",
          "programRoutines": [
            {
              "name": "serverConn.serve"
            },
            {
              "name": "serverConn.processHeaders"
            },
            {
              "name": "serverConn.upgradeRequest"
            },
            {
              "name": "serverConn.runHandler"
            },
            {
              "name": "Server.ServeConn"
            }
          ],
          "vendor": "golang.org/x/net",
          "versions": [
            {
              "lessThan": "0.17.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-28T04:05:57.980Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/63417"
        },
        {
          "url": "https://go.dev/cl/534215"
        },
        {
          "url": "https://go.dev/cl/534235"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2023-2102"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20231110-0008/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP/"
        },
        {
          "url": "https://security.gentoo.org/glsa/202311-09"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3OVW5V2DM5K5IC3H7O42YDUGNJ74J35O/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MZQYOOKHQDQ57LV2IAG6NRFOVXKHJJ3Z/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FTMJ3NJIDAZFWJQQSP3L22MUFJ3UP2PT/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPWCNYB5PQ5PCVZ4NJT6G56ZYFZ5QBU6/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LZSWTV4NV4SNQARNXG5T6LRHP26EW2/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PJCUNGIQDUMZ4Z6HWVYIMR66A35F5S74/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5E5JSJBZLYXOTZWXHJKRVCIXIHVWKJ6/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YJWHBLVZDM5KQSDFRBFRKU5KSSOLIRQ4/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WJ4QVX2AMUJ2F2S27POOAHRC4K3CHU4/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ODBY7RVMGZCBSTWF2OZGIZS57FNFUL67/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXOU2JZUBEBP7GBKAYIJRPRBZSJCD7ST/"
        }
      ],
      "title": "HTTP/2 rapid reset can cause excessive work in net/http"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2023-39325",
    "datePublished": "2023-10-11T21:15:02.727Z",
    "dateReserved": "2023-07-27T17:05:55.188Z",
    "dateUpdated": "2025-02-13T17:02:50.341Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHBA-2023:5669

CVE-2023-39325 (GCVE-0-2023-39325)

Tags

Sightings

Nomenclature