RHBA-2023:6124
Vulnerability from csaf_redhat - Published: 2023-11-02 09:07 - Updated: 2026-08-11 20:49Summary
Red Hat Bug Fix Advisory: Red Hat Quay v3.9.4 minor release
Severity
Important
Notes
Topic: Red Hat Quay 3.9.4 is now available with bug fixes.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Quay 3.9.4
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RST_STREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any server-side limit for the maximum number of active streams per connection, resulting in a denial of service due to server resource consumption. Red Hat has rated the severity of this flaw as 'Important' as the US Cybersecurity and Infrastructure Security Agency (CISA) declared this vulnerability an active exploit. CVE-2023-39325 was assigned for the `Rapid Reset Attack` in the Go language packages.
7.5 (High)
Affected products
Fixed
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:d063fd53c313d31fb6b8ae2b5c90ca72c612754cfd28dc91b731c331d679fcb9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:83ba5dd9ce4a37474e70e8d8536911314d0c258f7c50232fa202d1c01c8755f8_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:4c6b3d41f9f8640ec1c341444e09af6f6d222cc1b32c35a4e4f79fb9cb00fc44_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:259d7c4aad2559a052d26e3555fb4e30b6ddbc08b949e77b351dedafff0c5a4d_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:c0fa0c35c2bb1baba0cad43d259d8fb3c4bf81ae1b96711bc32e919b1ae57292_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9af0519509785cf2889fe81fd490453dc8f919c5a307ba442084fc75f5388ae2_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:c06fde1e0433aee697c0182ff70829642edfcce7df6addb614f60042e05bc991_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:39fe504ac94fce04fa8679657aa97e42b530b3b4f0699ac90194a7373f0e4129_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:8fb1d9966d70ab01a66387d38831378d818d17f58057138540aac83c6b4fe0cc_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:ad7db1f398e1d5fd98d453f08a7c855de600541b626a39c0669f8d67f9c7771c_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
11 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat Quay 3.9.4 is now available with bug fixes.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Quay 3.9.4",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHBA-2023:6124",
"url": "https://access.redhat.com/errata/RHBA-2023:6124"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhba-2023_6124.json"
}
],
"title": "Red Hat Bug Fix Advisory: Red Hat Quay v3.9.4 minor release",
"tracking": {
"current_release_date": "2026-08-11T20:49:02+00:00",
"generator": {
"date": "2026-08-11T20:49:02+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.14"
}
},
"id": "RHBA-2023:6124",
"initial_release_date": "2023-11-02T09:07:13+00:00",
"revision_history": [
{
"date": "2023-11-02T09:07:13+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2023-11-02T09:07:13+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-11T20:49:02+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Quay v3",
"product": {
"name": "Quay v3",
"product_id": "8Base-Quay-3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:quay:3::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Quay"
},
{
"branches": [
{
"category": "product_version",
"name": "quay/quay-bridge-operator-bundle@sha256:83ba5dd9ce4a37474e70e8d8536911314d0c258f7c50232fa202d1c01c8755f8_amd64",
"product": {
"name": "quay/quay-bridge-operator-bundle@sha256:83ba5dd9ce4a37474e70e8d8536911314d0c258f7c50232fa202d1c01c8755f8_amd64",
"product_id": "quay/quay-bridge-operator-bundle@sha256:83ba5dd9ce4a37474e70e8d8536911314d0c258f7c50232fa202d1c01c8755f8_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256:83ba5dd9ce4a37474e70e8d8536911314d0c258f7c50232fa202d1c01c8755f8?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=v3.9.4-6"
}
}
},
{
"category": "product_version",
"name": "quay/quay-bridge-operator-rhel8@sha256:4c6b3d41f9f8640ec1c341444e09af6f6d222cc1b32c35a4e4f79fb9cb00fc44_amd64",
"product": {
"name": "quay/quay-bridge-operator-rhel8@sha256:4c6b3d41f9f8640ec1c341444e09af6f6d222cc1b32c35a4e4f79fb9cb00fc44_amd64",
"product_id": "quay/quay-bridge-operator-rhel8@sha256:4c6b3d41f9f8640ec1c341444e09af6f6d222cc1b32c35a4e4f79fb9cb00fc44_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256:4c6b3d41f9f8640ec1c341444e09af6f6d222cc1b32c35a4e4f79fb9cb00fc44?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=v3.9.4-4"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-rhel8@sha256:c0fa0c35c2bb1baba0cad43d259d8fb3c4bf81ae1b96711bc32e919b1ae57292_amd64",
"product": {
"name": "quay/quay-builder-rhel8@sha256:c0fa0c35c2bb1baba0cad43d259d8fb3c4bf81ae1b96711bc32e919b1ae57292_amd64",
"product_id": "quay/quay-builder-rhel8@sha256:c0fa0c35c2bb1baba0cad43d259d8fb3c4bf81ae1b96711bc32e919b1ae57292_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256:c0fa0c35c2bb1baba0cad43d259d8fb3c4bf81ae1b96711bc32e919b1ae57292?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=v3.9.4-3"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:259d7c4aad2559a052d26e3555fb4e30b6ddbc08b949e77b351dedafff0c5a4d_amd64",
"product": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:259d7c4aad2559a052d26e3555fb4e30b6ddbc08b949e77b351dedafff0c5a4d_amd64",
"product_id": "quay/quay-builder-qemu-rhcos-rhel8@sha256:259d7c4aad2559a052d26e3555fb4e30b6ddbc08b949e77b351dedafff0c5a4d_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256:259d7c4aad2559a052d26e3555fb4e30b6ddbc08b949e77b351dedafff0c5a4d?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=v3.9.4-3"
}
}
},
{
"category": "product_version",
"name": "quay/clair-rhel8@sha256:d063fd53c313d31fb6b8ae2b5c90ca72c612754cfd28dc91b731c331d679fcb9_amd64",
"product": {
"name": "quay/clair-rhel8@sha256:d063fd53c313d31fb6b8ae2b5c90ca72c612754cfd28dc91b731c331d679fcb9_amd64",
"product_id": "quay/clair-rhel8@sha256:d063fd53c313d31fb6b8ae2b5c90ca72c612754cfd28dc91b731c331d679fcb9_amd64",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256:d063fd53c313d31fb6b8ae2b5c90ca72c612754cfd28dc91b731c331d679fcb9?arch=amd64\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=v3.9.4-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-bundle@sha256:9af0519509785cf2889fe81fd490453dc8f919c5a307ba442084fc75f5388ae2_amd64",
"product": {
"name": "quay/quay-container-security-operator-bundle@sha256:9af0519509785cf2889fe81fd490453dc8f919c5a307ba442084fc75f5388ae2_amd64",
"product_id": "quay/quay-container-security-operator-bundle@sha256:9af0519509785cf2889fe81fd490453dc8f919c5a307ba442084fc75f5388ae2_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256:9af0519509785cf2889fe81fd490453dc8f919c5a307ba442084fc75f5388ae2?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=v3.9.4-3"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-rhel8@sha256:c06fde1e0433aee697c0182ff70829642edfcce7df6addb614f60042e05bc991_amd64",
"product": {
"name": "quay/quay-container-security-operator-rhel8@sha256:c06fde1e0433aee697c0182ff70829642edfcce7df6addb614f60042e05bc991_amd64",
"product_id": "quay/quay-container-security-operator-rhel8@sha256:c06fde1e0433aee697c0182ff70829642edfcce7df6addb614f60042e05bc991_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256:c06fde1e0433aee697c0182ff70829642edfcce7df6addb614f60042e05bc991?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=v3.9.4-3"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-bundle@sha256:39fe504ac94fce04fa8679657aa97e42b530b3b4f0699ac90194a7373f0e4129_amd64",
"product": {
"name": "quay/quay-operator-bundle@sha256:39fe504ac94fce04fa8679657aa97e42b530b3b4f0699ac90194a7373f0e4129_amd64",
"product_id": "quay/quay-operator-bundle@sha256:39fe504ac94fce04fa8679657aa97e42b530b3b4f0699ac90194a7373f0e4129_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256:39fe504ac94fce04fa8679657aa97e42b530b3b4f0699ac90194a7373f0e4129?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=v3.9.4-12"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-rhel8@sha256:8fb1d9966d70ab01a66387d38831378d818d17f58057138540aac83c6b4fe0cc_amd64",
"product": {
"name": "quay/quay-operator-rhel8@sha256:8fb1d9966d70ab01a66387d38831378d818d17f58057138540aac83c6b4fe0cc_amd64",
"product_id": "quay/quay-operator-rhel8@sha256:8fb1d9966d70ab01a66387d38831378d818d17f58057138540aac83c6b4fe0cc_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256:8fb1d9966d70ab01a66387d38831378d818d17f58057138540aac83c6b4fe0cc?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=v3.9.4-4"
}
}
},
{
"category": "product_version",
"name": "quay/quay-rhel8@sha256:ad7db1f398e1d5fd98d453f08a7c855de600541b626a39c0669f8d67f9c7771c_amd64",
"product": {
"name": "quay/quay-rhel8@sha256:ad7db1f398e1d5fd98d453f08a7c855de600541b626a39c0669f8d67f9c7771c_amd64",
"product_id": "quay/quay-rhel8@sha256:ad7db1f398e1d5fd98d453f08a7c855de600541b626a39c0669f8d67f9c7771c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256:ad7db1f398e1d5fd98d453f08a7c855de600541b626a39c0669f8d67f9c7771c?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=v3.9.4-7"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/clair-rhel8@sha256:d063fd53c313d31fb6b8ae2b5c90ca72c612754cfd28dc91b731c331d679fcb9_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/clair-rhel8@sha256:d063fd53c313d31fb6b8ae2b5c90ca72c612754cfd28dc91b731c331d679fcb9_amd64"
},
"product_reference": "quay/clair-rhel8@sha256:d063fd53c313d31fb6b8ae2b5c90ca72c612754cfd28dc91b731c331d679fcb9_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-bundle@sha256:83ba5dd9ce4a37474e70e8d8536911314d0c258f7c50232fa202d1c01c8755f8_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:83ba5dd9ce4a37474e70e8d8536911314d0c258f7c50232fa202d1c01c8755f8_amd64"
},
"product_reference": "quay/quay-bridge-operator-bundle@sha256:83ba5dd9ce4a37474e70e8d8536911314d0c258f7c50232fa202d1c01c8755f8_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-rhel8@sha256:4c6b3d41f9f8640ec1c341444e09af6f6d222cc1b32c35a4e4f79fb9cb00fc44_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:4c6b3d41f9f8640ec1c341444e09af6f6d222cc1b32c35a4e4f79fb9cb00fc44_amd64"
},
"product_reference": "quay/quay-bridge-operator-rhel8@sha256:4c6b3d41f9f8640ec1c341444e09af6f6d222cc1b32c35a4e4f79fb9cb00fc44_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:259d7c4aad2559a052d26e3555fb4e30b6ddbc08b949e77b351dedafff0c5a4d_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:259d7c4aad2559a052d26e3555fb4e30b6ddbc08b949e77b351dedafff0c5a4d_amd64"
},
"product_reference": "quay/quay-builder-qemu-rhcos-rhel8@sha256:259d7c4aad2559a052d26e3555fb4e30b6ddbc08b949e77b351dedafff0c5a4d_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-rhel8@sha256:c0fa0c35c2bb1baba0cad43d259d8fb3c4bf81ae1b96711bc32e919b1ae57292_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-rhel8@sha256:c0fa0c35c2bb1baba0cad43d259d8fb3c4bf81ae1b96711bc32e919b1ae57292_amd64"
},
"product_reference": "quay/quay-builder-rhel8@sha256:c0fa0c35c2bb1baba0cad43d259d8fb3c4bf81ae1b96711bc32e919b1ae57292_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-bundle@sha256:9af0519509785cf2889fe81fd490453dc8f919c5a307ba442084fc75f5388ae2_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9af0519509785cf2889fe81fd490453dc8f919c5a307ba442084fc75f5388ae2_amd64"
},
"product_reference": "quay/quay-container-security-operator-bundle@sha256:9af0519509785cf2889fe81fd490453dc8f919c5a307ba442084fc75f5388ae2_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-rhel8@sha256:c06fde1e0433aee697c0182ff70829642edfcce7df6addb614f60042e05bc991_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:c06fde1e0433aee697c0182ff70829642edfcce7df6addb614f60042e05bc991_amd64"
},
"product_reference": "quay/quay-container-security-operator-rhel8@sha256:c06fde1e0433aee697c0182ff70829642edfcce7df6addb614f60042e05bc991_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-bundle@sha256:39fe504ac94fce04fa8679657aa97e42b530b3b4f0699ac90194a7373f0e4129_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-bundle@sha256:39fe504ac94fce04fa8679657aa97e42b530b3b4f0699ac90194a7373f0e4129_amd64"
},
"product_reference": "quay/quay-operator-bundle@sha256:39fe504ac94fce04fa8679657aa97e42b530b3b4f0699ac90194a7373f0e4129_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-rhel8@sha256:8fb1d9966d70ab01a66387d38831378d818d17f58057138540aac83c6b4fe0cc_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-rhel8@sha256:8fb1d9966d70ab01a66387d38831378d818d17f58057138540aac83c6b4fe0cc_amd64"
},
"product_reference": "quay/quay-operator-rhel8@sha256:8fb1d9966d70ab01a66387d38831378d818d17f58057138540aac83c6b4fe0cc_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-rhel8@sha256:ad7db1f398e1d5fd98d453f08a7c855de600541b626a39c0669f8d67f9c7771c_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-rhel8@sha256:ad7db1f398e1d5fd98d453f08a7c855de600541b626a39c0669f8d67f9c7771c_amd64"
},
"product_reference": "quay/quay-rhel8@sha256:ad7db1f398e1d5fd98d453f08a7c855de600541b626a39c0669f8d67f9c7771c_amd64",
"relates_to_product_reference": "8Base-Quay-3"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-39325",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2023-10-10T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2243296"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RST_STREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any server-side limit for the maximum number of active streams per connection, resulting in a denial of service due to server resource consumption. Red Hat has rated the severity of this flaw as \u0027Important\u0027 as the US Cybersecurity and Infrastructure Security Agency (CISA) declared this vulnerability an active exploit.\r\n\r\nCVE-2023-39325 was assigned for the `Rapid Reset Attack` in the Go language packages.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This CVE is related to CVE-2023-44487.\n\nThe majority of RHEL utilities are not long-running applications; instead, they are command-line tools. These tools utilize Golang package as build-time dependency, which is why they are classified as having a \"Moderate\" level of impact.\n\nAs go-lang vendors its dependencies, a package may contain a library with a known vulnerability, solely because of lower tier libraries including it as a part of its dependencies, but the vulnerable code is not reachable at runtime. In such cases the issue is not exploitable. We classify these situations as \u201cNot affected\u201d or \u201cWill not fix,\u201d depending on the risk of breaking other unrelated packages.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/clair-rhel8@sha256:d063fd53c313d31fb6b8ae2b5c90ca72c612754cfd28dc91b731c331d679fcb9_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:83ba5dd9ce4a37474e70e8d8536911314d0c258f7c50232fa202d1c01c8755f8_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:4c6b3d41f9f8640ec1c341444e09af6f6d222cc1b32c35a4e4f79fb9cb00fc44_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:259d7c4aad2559a052d26e3555fb4e30b6ddbc08b949e77b351dedafff0c5a4d_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:c0fa0c35c2bb1baba0cad43d259d8fb3c4bf81ae1b96711bc32e919b1ae57292_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9af0519509785cf2889fe81fd490453dc8f919c5a307ba442084fc75f5388ae2_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:c06fde1e0433aee697c0182ff70829642edfcce7df6addb614f60042e05bc991_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:39fe504ac94fce04fa8679657aa97e42b530b3b4f0699ac90194a7373f0e4129_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:8fb1d9966d70ab01a66387d38831378d818d17f58057138540aac83c6b4fe0cc_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:ad7db1f398e1d5fd98d453f08a7c855de600541b626a39c0669f8d67f9c7771c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-39325"
},
{
"category": "external",
"summary": "RHBZ#2243296",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2243296"
},
{
"category": "external",
"summary": "RHSB-2023-003",
"url": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-003"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-39325",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39325"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-39325",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39325"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2023-44487",
"url": "https://access.redhat.com/security/cve/CVE-2023-44487"
},
{
"category": "external",
"summary": "https://go.dev/issue/63417",
"url": "https://go.dev/issue/63417"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2023-2102",
"url": "https://pkg.go.dev/vuln/GO-2023-2102"
},
{
"category": "external",
"summary": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487",
"url": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487"
}
],
"release_date": "2023-10-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2023-11-02T09:07:13+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:d063fd53c313d31fb6b8ae2b5c90ca72c612754cfd28dc91b731c331d679fcb9_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:83ba5dd9ce4a37474e70e8d8536911314d0c258f7c50232fa202d1c01c8755f8_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:4c6b3d41f9f8640ec1c341444e09af6f6d222cc1b32c35a4e4f79fb9cb00fc44_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:259d7c4aad2559a052d26e3555fb4e30b6ddbc08b949e77b351dedafff0c5a4d_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:c0fa0c35c2bb1baba0cad43d259d8fb3c4bf81ae1b96711bc32e919b1ae57292_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9af0519509785cf2889fe81fd490453dc8f919c5a307ba442084fc75f5388ae2_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:c06fde1e0433aee697c0182ff70829642edfcce7df6addb614f60042e05bc991_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:39fe504ac94fce04fa8679657aa97e42b530b3b4f0699ac90194a7373f0e4129_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:8fb1d9966d70ab01a66387d38831378d818d17f58057138540aac83c6b4fe0cc_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:ad7db1f398e1d5fd98d453f08a7c855de600541b626a39c0669f8d67f9c7771c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2023:6124"
},
{
"category": "workaround",
"details": "The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:d063fd53c313d31fb6b8ae2b5c90ca72c612754cfd28dc91b731c331d679fcb9_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:83ba5dd9ce4a37474e70e8d8536911314d0c258f7c50232fa202d1c01c8755f8_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:4c6b3d41f9f8640ec1c341444e09af6f6d222cc1b32c35a4e4f79fb9cb00fc44_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:259d7c4aad2559a052d26e3555fb4e30b6ddbc08b949e77b351dedafff0c5a4d_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:c0fa0c35c2bb1baba0cad43d259d8fb3c4bf81ae1b96711bc32e919b1ae57292_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9af0519509785cf2889fe81fd490453dc8f919c5a307ba442084fc75f5388ae2_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:c06fde1e0433aee697c0182ff70829642edfcce7df6addb614f60042e05bc991_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:39fe504ac94fce04fa8679657aa97e42b530b3b4f0699ac90194a7373f0e4129_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:8fb1d9966d70ab01a66387d38831378d818d17f58057138540aac83c6b4fe0cc_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:ad7db1f398e1d5fd98d453f08a7c855de600541b626a39c0669f8d67f9c7771c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/clair-rhel8@sha256:d063fd53c313d31fb6b8ae2b5c90ca72c612754cfd28dc91b731c331d679fcb9_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:83ba5dd9ce4a37474e70e8d8536911314d0c258f7c50232fa202d1c01c8755f8_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:4c6b3d41f9f8640ec1c341444e09af6f6d222cc1b32c35a4e4f79fb9cb00fc44_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:259d7c4aad2559a052d26e3555fb4e30b6ddbc08b949e77b351dedafff0c5a4d_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:c0fa0c35c2bb1baba0cad43d259d8fb3c4bf81ae1b96711bc32e919b1ae57292_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:9af0519509785cf2889fe81fd490453dc8f919c5a307ba442084fc75f5388ae2_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:c06fde1e0433aee697c0182ff70829642edfcce7df6addb614f60042e05bc991_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:39fe504ac94fce04fa8679657aa97e42b530b3b4f0699ac90194a7373f0e4129_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:8fb1d9966d70ab01a66387d38831378d818d17f58057138540aac83c6b4fe0cc_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:ad7db1f398e1d5fd98d453f08a7c855de600541b626a39c0669f8d67f9c7771c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…