rhsa-2023_7587
Vulnerability from csaf_redhat
Published
2023-11-29 18:13
Modified
2024-09-16 20:00
Summary
Red Hat Security Advisory: Updated IBM Business Automation Manager Open Editions 8.0.4 SP1 Images

Notes

Topic
An update is now available for IBM Business Automation Manager Open Editions including images for Red Hat OpenShift Container Platform.
Details
IBM Business Automation Manager Open Editions is an open source business process management suite that combines process management and decision service management. It enables business and IT users to create, manage, validate, and deploy process applications and decision services. IBM Business Automation Manager Open Editions images have been provided for use within the OpenShift Container Platform cloud computing Platform-as-a-Service (PaaS) and for on-premise or private-cloud deployments. This release updates the IBM Business Automation Manager Open Editions images to 8.0.4. This release includes security fixes. Security Fix(es): * netty-codec-http2: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) * undertow: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) * Quarkus: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) * EAP XP: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) * EAP: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) * businessautomation-operator: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) A Red Hat Security Bulletin which addresses further details about this flaw is available in the References section. For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE pages listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for IBM Business Automation Manager Open Editions including images for Red Hat OpenShift Container Platform.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "IBM Business Automation Manager Open Editions is an open source business process management suite that combines process management and decision service management. It enables business and IT users to create, manage, validate, and deploy process applications and decision services.\n\nIBM Business Automation Manager Open Editions images have been provided for use within the OpenShift Container Platform cloud computing Platform-as-a-Service (PaaS) and for on-premise or private-cloud deployments.\n\nThis release updates the IBM Business Automation Manager Open Editions images to 8.0.4.\n\nThis release includes security fixes.\n\nSecurity Fix(es):\n\n* netty-codec-http2: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n\n* undertow: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n\n* Quarkus: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n\n* EAP XP: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n\n* EAP: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n\n* businessautomation-operator: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n\nA Red Hat Security Bulletin which addresses further details about this flaw is available in the References section.\n\nFor more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE pages listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2023:7587",
        "url": "https://access.redhat.com/errata/RHSA-2023:7587"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2242803",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242803"
      },
      {
        "category": "external",
        "summary": "RHPAM-4816",
        "url": "https://issues.redhat.com/browse/RHPAM-4816"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_7587.json"
      }
    ],
    "title": "Red Hat Security Advisory: Updated IBM Business Automation Manager Open Editions 8.0.4 SP1 Images",
    "tracking": {
      "current_release_date": "2024-09-16T20:00:15+00:00",
      "generator": {
        "date": "2024-09-16T20:00:15+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "3.33.3"
        }
      },
      "id": "RHSA-2023:7587",
      "initial_release_date": "2023-11-29T18:13:51+00:00",
      "revision_history": [
        {
          "date": "2023-11-29T18:13:51+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2023-11-29T18:13:52+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-09-16T20:00:15+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Middleware Containers for OpenShift",
                "product": {
                  "name": "Middleware Containers for OpenShift",
                  "product_id": "8Base-RHOSE-Middleware",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhosemc:1.0::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Enterprise"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ibm-bamoe/bamoe-businesscentral-monitoring-rhel8@sha256:72999c6bcd08c26d15813fa4a813749f1349cafeb7d155ecf262e6cbdf6a0b33_amd64",
                "product": {
                  "name": "ibm-bamoe/bamoe-businesscentral-monitoring-rhel8@sha256:72999c6bcd08c26d15813fa4a813749f1349cafeb7d155ecf262e6cbdf6a0b33_amd64",
                  "product_id": "ibm-bamoe/bamoe-businesscentral-monitoring-rhel8@sha256:72999c6bcd08c26d15813fa4a813749f1349cafeb7d155ecf262e6cbdf6a0b33_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/bamoe-businesscentral-monitoring-rhel8@sha256:72999c6bcd08c26d15813fa4a813749f1349cafeb7d155ecf262e6cbdf6a0b33?arch=amd64\u0026repository_url=registry.redhat.io/ibm-bamoe/bamoe-businesscentral-monitoring-rhel8\u0026tag=8.0.4-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ibm-bamoe/bamoe-businesscentral-rhel8@sha256:bdb79faae81c9624759b0b7acb9825004e377ac5186fefa4be3393c21f41a869_amd64",
                "product": {
                  "name": "ibm-bamoe/bamoe-businesscentral-rhel8@sha256:bdb79faae81c9624759b0b7acb9825004e377ac5186fefa4be3393c21f41a869_amd64",
                  "product_id": "ibm-bamoe/bamoe-businesscentral-rhel8@sha256:bdb79faae81c9624759b0b7acb9825004e377ac5186fefa4be3393c21f41a869_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/bamoe-businesscentral-rhel8@sha256:bdb79faae81c9624759b0b7acb9825004e377ac5186fefa4be3393c21f41a869?arch=amd64\u0026repository_url=registry.redhat.io/ibm-bamoe/bamoe-businesscentral-rhel8\u0026tag=8.0.4-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ibm-bamoe/bamoe-controller-rhel8@sha256:4257937e0e3fe3c0dc7b150fb111738c3bf8416781fe15f7245a0b2f9dc604c9_amd64",
                "product": {
                  "name": "ibm-bamoe/bamoe-controller-rhel8@sha256:4257937e0e3fe3c0dc7b150fb111738c3bf8416781fe15f7245a0b2f9dc604c9_amd64",
                  "product_id": "ibm-bamoe/bamoe-controller-rhel8@sha256:4257937e0e3fe3c0dc7b150fb111738c3bf8416781fe15f7245a0b2f9dc604c9_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/bamoe-controller-rhel8@sha256:4257937e0e3fe3c0dc7b150fb111738c3bf8416781fe15f7245a0b2f9dc604c9?arch=amd64\u0026repository_url=registry.redhat.io/ibm-bamoe/bamoe-controller-rhel8\u0026tag=8.0.4-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ibm-bamoe/bamoe-dashbuilder-rhel8@sha256:f0efba2fc020c17063ade1ab8860c1f63a6bba74228587ad6c0582001249e6cc_amd64",
                "product": {
                  "name": "ibm-bamoe/bamoe-dashbuilder-rhel8@sha256:f0efba2fc020c17063ade1ab8860c1f63a6bba74228587ad6c0582001249e6cc_amd64",
                  "product_id": "ibm-bamoe/bamoe-dashbuilder-rhel8@sha256:f0efba2fc020c17063ade1ab8860c1f63a6bba74228587ad6c0582001249e6cc_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/bamoe-dashbuilder-rhel8@sha256:f0efba2fc020c17063ade1ab8860c1f63a6bba74228587ad6c0582001249e6cc?arch=amd64\u0026repository_url=registry.redhat.io/ibm-bamoe/bamoe-dashbuilder-rhel8\u0026tag=8.0.4-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ibm-bamoe/bamoe-kieserver-rhel8@sha256:a02e0a493f8651a31614dc30a3e803df08c9563e9f5da21a9710a7d010dfca2f_amd64",
                "product": {
                  "name": "ibm-bamoe/bamoe-kieserver-rhel8@sha256:a02e0a493f8651a31614dc30a3e803df08c9563e9f5da21a9710a7d010dfca2f_amd64",
                  "product_id": "ibm-bamoe/bamoe-kieserver-rhel8@sha256:a02e0a493f8651a31614dc30a3e803df08c9563e9f5da21a9710a7d010dfca2f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/bamoe-kieserver-rhel8@sha256:a02e0a493f8651a31614dc30a3e803df08c9563e9f5da21a9710a7d010dfca2f?arch=amd64\u0026repository_url=registry.redhat.io/ibm-bamoe/bamoe-kieserver-rhel8\u0026tag=8.0.4-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ibm-bamoe/bamoe-kogito-builder-rhel8@sha256:b212e8d2ee392c732960889369d51c885f5eabd9f76a586189e75d8e54fa12ed_amd64",
                "product": {
                  "name": "ibm-bamoe/bamoe-kogito-builder-rhel8@sha256:b212e8d2ee392c732960889369d51c885f5eabd9f76a586189e75d8e54fa12ed_amd64",
                  "product_id": "ibm-bamoe/bamoe-kogito-builder-rhel8@sha256:b212e8d2ee392c732960889369d51c885f5eabd9f76a586189e75d8e54fa12ed_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/bamoe-kogito-builder-rhel8@sha256:b212e8d2ee392c732960889369d51c885f5eabd9f76a586189e75d8e54fa12ed?arch=amd64\u0026repository_url=registry.redhat.io/ibm-bamoe/bamoe-kogito-builder-rhel8\u0026tag=8.0.4-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ibm-bamoe/bamoe-kogito-rhel8-operator-bundle@sha256:331ca81863339a0b8d52f127e860209ac3be2cf05fb4d26f3162eb3ee81f605c_amd64",
                "product": {
                  "name": "ibm-bamoe/bamoe-kogito-rhel8-operator-bundle@sha256:331ca81863339a0b8d52f127e860209ac3be2cf05fb4d26f3162eb3ee81f605c_amd64",
                  "product_id": "ibm-bamoe/bamoe-kogito-rhel8-operator-bundle@sha256:331ca81863339a0b8d52f127e860209ac3be2cf05fb4d26f3162eb3ee81f605c_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/bamoe-kogito-rhel8-operator-bundle@sha256:331ca81863339a0b8d52f127e860209ac3be2cf05fb4d26f3162eb3ee81f605c?arch=amd64\u0026repository_url=registry.redhat.io/ibm-bamoe/bamoe-kogito-rhel8-operator-bundle\u0026tag=8.0.4-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ibm-bamoe/bamoe-kogito-rhel8-operator@sha256:f883b2a9cfb1516222e86f3994a7560233f1b96ae25d0421922bfcfe6935fa16_amd64",
                "product": {
                  "name": "ibm-bamoe/bamoe-kogito-rhel8-operator@sha256:f883b2a9cfb1516222e86f3994a7560233f1b96ae25d0421922bfcfe6935fa16_amd64",
                  "product_id": "ibm-bamoe/bamoe-kogito-rhel8-operator@sha256:f883b2a9cfb1516222e86f3994a7560233f1b96ae25d0421922bfcfe6935fa16_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/bamoe-kogito-rhel8-operator@sha256:f883b2a9cfb1516222e86f3994a7560233f1b96ae25d0421922bfcfe6935fa16?arch=amd64\u0026repository_url=registry.redhat.io/ibm-bamoe/bamoe-kogito-rhel8-operator\u0026tag=8.0.4-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ibm-bamoe/bamoe-kogito-runtime-jvm-rhel8@sha256:db94353ed91569bacb79c0f434deff478e01469671ef3af6804940cef31c7492_amd64",
                "product": {
                  "name": "ibm-bamoe/bamoe-kogito-runtime-jvm-rhel8@sha256:db94353ed91569bacb79c0f434deff478e01469671ef3af6804940cef31c7492_amd64",
                  "product_id": "ibm-bamoe/bamoe-kogito-runtime-jvm-rhel8@sha256:db94353ed91569bacb79c0f434deff478e01469671ef3af6804940cef31c7492_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/bamoe-kogito-runtime-jvm-rhel8@sha256:db94353ed91569bacb79c0f434deff478e01469671ef3af6804940cef31c7492?arch=amd64\u0026repository_url=registry.redhat.io/ibm-bamoe/bamoe-kogito-runtime-jvm-rhel8\u0026tag=8.0.4-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ibm-bamoe-tech-preview/bamoe-kogito-runtime-native-rhel8@sha256:db4267235a69729c0cdc7a8af7d84afeeea6b1cda81e2c9411d5307f11c45bde_amd64",
                "product": {
                  "name": "ibm-bamoe-tech-preview/bamoe-kogito-runtime-native-rhel8@sha256:db4267235a69729c0cdc7a8af7d84afeeea6b1cda81e2c9411d5307f11c45bde_amd64",
                  "product_id": "ibm-bamoe-tech-preview/bamoe-kogito-runtime-native-rhel8@sha256:db4267235a69729c0cdc7a8af7d84afeeea6b1cda81e2c9411d5307f11c45bde_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/bamoe-kogito-runtime-native-rhel8@sha256:db4267235a69729c0cdc7a8af7d84afeeea6b1cda81e2c9411d5307f11c45bde?arch=amd64\u0026repository_url=registry.redhat.io/ibm-bamoe-tech-preview/bamoe-kogito-runtime-native-rhel8\u0026tag=8.0.4-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ibm-bamoe/bamoe-operator-bundle@sha256:f4d8d5f8bde0fdd607b889da98e039610f306f45e05074435db0e00d4c62785e_amd64",
                "product": {
                  "name": "ibm-bamoe/bamoe-operator-bundle@sha256:f4d8d5f8bde0fdd607b889da98e039610f306f45e05074435db0e00d4c62785e_amd64",
                  "product_id": "ibm-bamoe/bamoe-operator-bundle@sha256:f4d8d5f8bde0fdd607b889da98e039610f306f45e05074435db0e00d4c62785e_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/bamoe-operator-bundle@sha256:f4d8d5f8bde0fdd607b889da98e039610f306f45e05074435db0e00d4c62785e?arch=amd64\u0026repository_url=registry.redhat.io/ibm-bamoe/bamoe-operator-bundle\u0026tag=8.0.4-6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ibm-bamoe/bamoe-process-migration-rhel8@sha256:fdfeda38dd932c4aa9f63b4f5e758b823eb079c90f068a482f92c4aa8e880664_amd64",
                "product": {
                  "name": "ibm-bamoe/bamoe-process-migration-rhel8@sha256:fdfeda38dd932c4aa9f63b4f5e758b823eb079c90f068a482f92c4aa8e880664_amd64",
                  "product_id": "ibm-bamoe/bamoe-process-migration-rhel8@sha256:fdfeda38dd932c4aa9f63b4f5e758b823eb079c90f068a482f92c4aa8e880664_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/bamoe-process-migration-rhel8@sha256:fdfeda38dd932c4aa9f63b4f5e758b823eb079c90f068a482f92c4aa8e880664?arch=amd64\u0026repository_url=registry.redhat.io/ibm-bamoe/bamoe-process-migration-rhel8\u0026tag=8.0.4-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ibm-bamoe/bamoe-rhel8-operator@sha256:76a66069057cc21cc1476e0b20defaf78178343c8c16de5b5af7c5d3be846474_amd64",
                "product": {
                  "name": "ibm-bamoe/bamoe-rhel8-operator@sha256:76a66069057cc21cc1476e0b20defaf78178343c8c16de5b5af7c5d3be846474_amd64",
                  "product_id": "ibm-bamoe/bamoe-rhel8-operator@sha256:76a66069057cc21cc1476e0b20defaf78178343c8c16de5b5af7c5d3be846474_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/bamoe-rhel8-operator@sha256:76a66069057cc21cc1476e0b20defaf78178343c8c16de5b5af7c5d3be846474?arch=amd64\u0026repository_url=registry.redhat.io/ibm-bamoe/bamoe-rhel8-operator\u0026tag=8.0.4-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ibm-bamoe/bamoe-smartrouter-rhel8@sha256:90dae7252e3c285e1b1d318dd0831f851a7be4608b8f8b82384c7236049b6442_amd64",
                "product": {
                  "name": "ibm-bamoe/bamoe-smartrouter-rhel8@sha256:90dae7252e3c285e1b1d318dd0831f851a7be4608b8f8b82384c7236049b6442_amd64",
                  "product_id": "ibm-bamoe/bamoe-smartrouter-rhel8@sha256:90dae7252e3c285e1b1d318dd0831f851a7be4608b8f8b82384c7236049b6442_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/bamoe-smartrouter-rhel8@sha256:90dae7252e3c285e1b1d318dd0831f851a7be4608b8f8b82384c7236049b6442?arch=amd64\u0026repository_url=registry.redhat.io/ibm-bamoe/bamoe-smartrouter-rhel8\u0026tag=8.0.4-3"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ibm-bamoe/bamoe-kogito-builder-rhel8@sha256:53a848ec0126dd74180697bd76d83f02151ce08dcb1ddda59a4b2ebdcae44047_ppc64le",
                "product": {
                  "name": "ibm-bamoe/bamoe-kogito-builder-rhel8@sha256:53a848ec0126dd74180697bd76d83f02151ce08dcb1ddda59a4b2ebdcae44047_ppc64le",
                  "product_id": "ibm-bamoe/bamoe-kogito-builder-rhel8@sha256:53a848ec0126dd74180697bd76d83f02151ce08dcb1ddda59a4b2ebdcae44047_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/bamoe-kogito-builder-rhel8@sha256:53a848ec0126dd74180697bd76d83f02151ce08dcb1ddda59a4b2ebdcae44047?arch=ppc64le\u0026repository_url=registry.redhat.io/ibm-bamoe/bamoe-kogito-builder-rhel8\u0026tag=8.0.4-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ibm-bamoe/bamoe-kogito-rhel8-operator-bundle@sha256:86854b56abee2f78540bd5c3dae1d874ed0281fb756d3d06faa17cb9386b55b8_ppc64le",
                "product": {
                  "name": "ibm-bamoe/bamoe-kogito-rhel8-operator-bundle@sha256:86854b56abee2f78540bd5c3dae1d874ed0281fb756d3d06faa17cb9386b55b8_ppc64le",
                  "product_id": "ibm-bamoe/bamoe-kogito-rhel8-operator-bundle@sha256:86854b56abee2f78540bd5c3dae1d874ed0281fb756d3d06faa17cb9386b55b8_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/bamoe-kogito-rhel8-operator-bundle@sha256:86854b56abee2f78540bd5c3dae1d874ed0281fb756d3d06faa17cb9386b55b8?arch=ppc64le\u0026repository_url=registry.redhat.io/ibm-bamoe/bamoe-kogito-rhel8-operator-bundle\u0026tag=8.0.4-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ibm-bamoe/bamoe-kogito-rhel8-operator@sha256:1f2f53c48f1d8e997b0a8ec314405ac90126e710cc2f25d4362c250499cc927b_ppc64le",
                "product": {
                  "name": "ibm-bamoe/bamoe-kogito-rhel8-operator@sha256:1f2f53c48f1d8e997b0a8ec314405ac90126e710cc2f25d4362c250499cc927b_ppc64le",
                  "product_id": "ibm-bamoe/bamoe-kogito-rhel8-operator@sha256:1f2f53c48f1d8e997b0a8ec314405ac90126e710cc2f25d4362c250499cc927b_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/bamoe-kogito-rhel8-operator@sha256:1f2f53c48f1d8e997b0a8ec314405ac90126e710cc2f25d4362c250499cc927b?arch=ppc64le\u0026repository_url=registry.redhat.io/ibm-bamoe/bamoe-kogito-rhel8-operator\u0026tag=8.0.4-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ibm-bamoe/bamoe-kogito-runtime-jvm-rhel8@sha256:1a3a50a1af4d78bc70a9c11a42f059bd372454ce84913c3b78021180ec4d0bdf_ppc64le",
                "product": {
                  "name": "ibm-bamoe/bamoe-kogito-runtime-jvm-rhel8@sha256:1a3a50a1af4d78bc70a9c11a42f059bd372454ce84913c3b78021180ec4d0bdf_ppc64le",
                  "product_id": "ibm-bamoe/bamoe-kogito-runtime-jvm-rhel8@sha256:1a3a50a1af4d78bc70a9c11a42f059bd372454ce84913c3b78021180ec4d0bdf_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/bamoe-kogito-runtime-jvm-rhel8@sha256:1a3a50a1af4d78bc70a9c11a42f059bd372454ce84913c3b78021180ec4d0bdf?arch=ppc64le\u0026repository_url=registry.redhat.io/ibm-bamoe/bamoe-kogito-runtime-jvm-rhel8\u0026tag=8.0.4-3"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ibm-bamoe-tech-preview/bamoe-kogito-runtime-native-rhel8@sha256:db4267235a69729c0cdc7a8af7d84afeeea6b1cda81e2c9411d5307f11c45bde_amd64 as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:ibm-bamoe-tech-preview/bamoe-kogito-runtime-native-rhel8@sha256:db4267235a69729c0cdc7a8af7d84afeeea6b1cda81e2c9411d5307f11c45bde_amd64"
        },
        "product_reference": "ibm-bamoe-tech-preview/bamoe-kogito-runtime-native-rhel8@sha256:db4267235a69729c0cdc7a8af7d84afeeea6b1cda81e2c9411d5307f11c45bde_amd64",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ibm-bamoe/bamoe-businesscentral-monitoring-rhel8@sha256:72999c6bcd08c26d15813fa4a813749f1349cafeb7d155ecf262e6cbdf6a0b33_amd64 as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-businesscentral-monitoring-rhel8@sha256:72999c6bcd08c26d15813fa4a813749f1349cafeb7d155ecf262e6cbdf6a0b33_amd64"
        },
        "product_reference": "ibm-bamoe/bamoe-businesscentral-monitoring-rhel8@sha256:72999c6bcd08c26d15813fa4a813749f1349cafeb7d155ecf262e6cbdf6a0b33_amd64",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ibm-bamoe/bamoe-businesscentral-rhel8@sha256:bdb79faae81c9624759b0b7acb9825004e377ac5186fefa4be3393c21f41a869_amd64 as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-businesscentral-rhel8@sha256:bdb79faae81c9624759b0b7acb9825004e377ac5186fefa4be3393c21f41a869_amd64"
        },
        "product_reference": "ibm-bamoe/bamoe-businesscentral-rhel8@sha256:bdb79faae81c9624759b0b7acb9825004e377ac5186fefa4be3393c21f41a869_amd64",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ibm-bamoe/bamoe-controller-rhel8@sha256:4257937e0e3fe3c0dc7b150fb111738c3bf8416781fe15f7245a0b2f9dc604c9_amd64 as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-controller-rhel8@sha256:4257937e0e3fe3c0dc7b150fb111738c3bf8416781fe15f7245a0b2f9dc604c9_amd64"
        },
        "product_reference": "ibm-bamoe/bamoe-controller-rhel8@sha256:4257937e0e3fe3c0dc7b150fb111738c3bf8416781fe15f7245a0b2f9dc604c9_amd64",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ibm-bamoe/bamoe-dashbuilder-rhel8@sha256:f0efba2fc020c17063ade1ab8860c1f63a6bba74228587ad6c0582001249e6cc_amd64 as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-dashbuilder-rhel8@sha256:f0efba2fc020c17063ade1ab8860c1f63a6bba74228587ad6c0582001249e6cc_amd64"
        },
        "product_reference": "ibm-bamoe/bamoe-dashbuilder-rhel8@sha256:f0efba2fc020c17063ade1ab8860c1f63a6bba74228587ad6c0582001249e6cc_amd64",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ibm-bamoe/bamoe-kieserver-rhel8@sha256:a02e0a493f8651a31614dc30a3e803df08c9563e9f5da21a9710a7d010dfca2f_amd64 as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kieserver-rhel8@sha256:a02e0a493f8651a31614dc30a3e803df08c9563e9f5da21a9710a7d010dfca2f_amd64"
        },
        "product_reference": "ibm-bamoe/bamoe-kieserver-rhel8@sha256:a02e0a493f8651a31614dc30a3e803df08c9563e9f5da21a9710a7d010dfca2f_amd64",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ibm-bamoe/bamoe-kogito-builder-rhel8@sha256:53a848ec0126dd74180697bd76d83f02151ce08dcb1ddda59a4b2ebdcae44047_ppc64le as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-builder-rhel8@sha256:53a848ec0126dd74180697bd76d83f02151ce08dcb1ddda59a4b2ebdcae44047_ppc64le"
        },
        "product_reference": "ibm-bamoe/bamoe-kogito-builder-rhel8@sha256:53a848ec0126dd74180697bd76d83f02151ce08dcb1ddda59a4b2ebdcae44047_ppc64le",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ibm-bamoe/bamoe-kogito-builder-rhel8@sha256:b212e8d2ee392c732960889369d51c885f5eabd9f76a586189e75d8e54fa12ed_amd64 as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-builder-rhel8@sha256:b212e8d2ee392c732960889369d51c885f5eabd9f76a586189e75d8e54fa12ed_amd64"
        },
        "product_reference": "ibm-bamoe/bamoe-kogito-builder-rhel8@sha256:b212e8d2ee392c732960889369d51c885f5eabd9f76a586189e75d8e54fa12ed_amd64",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ibm-bamoe/bamoe-kogito-rhel8-operator-bundle@sha256:331ca81863339a0b8d52f127e860209ac3be2cf05fb4d26f3162eb3ee81f605c_amd64 as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-rhel8-operator-bundle@sha256:331ca81863339a0b8d52f127e860209ac3be2cf05fb4d26f3162eb3ee81f605c_amd64"
        },
        "product_reference": "ibm-bamoe/bamoe-kogito-rhel8-operator-bundle@sha256:331ca81863339a0b8d52f127e860209ac3be2cf05fb4d26f3162eb3ee81f605c_amd64",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ibm-bamoe/bamoe-kogito-rhel8-operator-bundle@sha256:86854b56abee2f78540bd5c3dae1d874ed0281fb756d3d06faa17cb9386b55b8_ppc64le as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-rhel8-operator-bundle@sha256:86854b56abee2f78540bd5c3dae1d874ed0281fb756d3d06faa17cb9386b55b8_ppc64le"
        },
        "product_reference": "ibm-bamoe/bamoe-kogito-rhel8-operator-bundle@sha256:86854b56abee2f78540bd5c3dae1d874ed0281fb756d3d06faa17cb9386b55b8_ppc64le",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ibm-bamoe/bamoe-kogito-rhel8-operator@sha256:1f2f53c48f1d8e997b0a8ec314405ac90126e710cc2f25d4362c250499cc927b_ppc64le as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-rhel8-operator@sha256:1f2f53c48f1d8e997b0a8ec314405ac90126e710cc2f25d4362c250499cc927b_ppc64le"
        },
        "product_reference": "ibm-bamoe/bamoe-kogito-rhel8-operator@sha256:1f2f53c48f1d8e997b0a8ec314405ac90126e710cc2f25d4362c250499cc927b_ppc64le",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ibm-bamoe/bamoe-kogito-rhel8-operator@sha256:f883b2a9cfb1516222e86f3994a7560233f1b96ae25d0421922bfcfe6935fa16_amd64 as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-rhel8-operator@sha256:f883b2a9cfb1516222e86f3994a7560233f1b96ae25d0421922bfcfe6935fa16_amd64"
        },
        "product_reference": "ibm-bamoe/bamoe-kogito-rhel8-operator@sha256:f883b2a9cfb1516222e86f3994a7560233f1b96ae25d0421922bfcfe6935fa16_amd64",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ibm-bamoe/bamoe-kogito-runtime-jvm-rhel8@sha256:1a3a50a1af4d78bc70a9c11a42f059bd372454ce84913c3b78021180ec4d0bdf_ppc64le as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-runtime-jvm-rhel8@sha256:1a3a50a1af4d78bc70a9c11a42f059bd372454ce84913c3b78021180ec4d0bdf_ppc64le"
        },
        "product_reference": "ibm-bamoe/bamoe-kogito-runtime-jvm-rhel8@sha256:1a3a50a1af4d78bc70a9c11a42f059bd372454ce84913c3b78021180ec4d0bdf_ppc64le",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ibm-bamoe/bamoe-kogito-runtime-jvm-rhel8@sha256:db94353ed91569bacb79c0f434deff478e01469671ef3af6804940cef31c7492_amd64 as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-runtime-jvm-rhel8@sha256:db94353ed91569bacb79c0f434deff478e01469671ef3af6804940cef31c7492_amd64"
        },
        "product_reference": "ibm-bamoe/bamoe-kogito-runtime-jvm-rhel8@sha256:db94353ed91569bacb79c0f434deff478e01469671ef3af6804940cef31c7492_amd64",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ibm-bamoe/bamoe-operator-bundle@sha256:f4d8d5f8bde0fdd607b889da98e039610f306f45e05074435db0e00d4c62785e_amd64 as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-operator-bundle@sha256:f4d8d5f8bde0fdd607b889da98e039610f306f45e05074435db0e00d4c62785e_amd64"
        },
        "product_reference": "ibm-bamoe/bamoe-operator-bundle@sha256:f4d8d5f8bde0fdd607b889da98e039610f306f45e05074435db0e00d4c62785e_amd64",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ibm-bamoe/bamoe-process-migration-rhel8@sha256:fdfeda38dd932c4aa9f63b4f5e758b823eb079c90f068a482f92c4aa8e880664_amd64 as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-process-migration-rhel8@sha256:fdfeda38dd932c4aa9f63b4f5e758b823eb079c90f068a482f92c4aa8e880664_amd64"
        },
        "product_reference": "ibm-bamoe/bamoe-process-migration-rhel8@sha256:fdfeda38dd932c4aa9f63b4f5e758b823eb079c90f068a482f92c4aa8e880664_amd64",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ibm-bamoe/bamoe-rhel8-operator@sha256:76a66069057cc21cc1476e0b20defaf78178343c8c16de5b5af7c5d3be846474_amd64 as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-rhel8-operator@sha256:76a66069057cc21cc1476e0b20defaf78178343c8c16de5b5af7c5d3be846474_amd64"
        },
        "product_reference": "ibm-bamoe/bamoe-rhel8-operator@sha256:76a66069057cc21cc1476e0b20defaf78178343c8c16de5b5af7c5d3be846474_amd64",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ibm-bamoe/bamoe-smartrouter-rhel8@sha256:90dae7252e3c285e1b1d318dd0831f851a7be4608b8f8b82384c7236049b6442_amd64 as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-smartrouter-rhel8@sha256:90dae7252e3c285e1b1d318dd0831f851a7be4608b8f8b82384c7236049b6442_amd64"
        },
        "product_reference": "ibm-bamoe/bamoe-smartrouter-rhel8@sha256:90dae7252e3c285e1b1d318dd0831f851a7be4608b8f8b82384c7236049b6442_amd64",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-44487",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2023-10-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2242803"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RST_STREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any server-side limit for the maximum number of active streams per connection, resulting in a denial of service due to server resource consumption. Red Hat has rated the severity of this flaw as \u0027Important\u0027 as the US Cybersecurity and Infrastructure Security Agency (CISA) declared this vulnerability an active exploit.\r\n\r\nCVE-2023-39325 was assigned for the Rapid Reset Attack in the Go language packages.\r\n\r\nSecurity Bulletin\r\nhttps://access.redhat.com/security/vulnerabilities/RHSB-2023-003",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "NGINX has been marked as Moderate Impact because, for performance and resource consumption reasons, NGINX limits the number of concurrent streams to a default of 128. In addition, to optimally balance network and server performance, NGINX allows the client to persist HTTP connections for up to 1000 requests by default using an HTTP keepalive.\n\nThe majority of RHEL utilities are not long-running applications; instead, they are command-line tools. These tools utilize Golang package as build-time dependency, which is why they are classified as having a \"Moderate\" level of impact.\n\nrhc component is no longer impacted by CVE-2023-44487 \u0026 CVE-2023-39325.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:ibm-bamoe-tech-preview/bamoe-kogito-runtime-native-rhel8@sha256:db4267235a69729c0cdc7a8af7d84afeeea6b1cda81e2c9411d5307f11c45bde_amd64",
          "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-businesscentral-monitoring-rhel8@sha256:72999c6bcd08c26d15813fa4a813749f1349cafeb7d155ecf262e6cbdf6a0b33_amd64",
          "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-businesscentral-rhel8@sha256:bdb79faae81c9624759b0b7acb9825004e377ac5186fefa4be3393c21f41a869_amd64",
          "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-controller-rhel8@sha256:4257937e0e3fe3c0dc7b150fb111738c3bf8416781fe15f7245a0b2f9dc604c9_amd64",
          "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-dashbuilder-rhel8@sha256:f0efba2fc020c17063ade1ab8860c1f63a6bba74228587ad6c0582001249e6cc_amd64",
          "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kieserver-rhel8@sha256:a02e0a493f8651a31614dc30a3e803df08c9563e9f5da21a9710a7d010dfca2f_amd64",
          "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-builder-rhel8@sha256:53a848ec0126dd74180697bd76d83f02151ce08dcb1ddda59a4b2ebdcae44047_ppc64le",
          "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-builder-rhel8@sha256:b212e8d2ee392c732960889369d51c885f5eabd9f76a586189e75d8e54fa12ed_amd64",
          "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-rhel8-operator-bundle@sha256:331ca81863339a0b8d52f127e860209ac3be2cf05fb4d26f3162eb3ee81f605c_amd64",
          "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-rhel8-operator-bundle@sha256:86854b56abee2f78540bd5c3dae1d874ed0281fb756d3d06faa17cb9386b55b8_ppc64le",
          "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-rhel8-operator@sha256:1f2f53c48f1d8e997b0a8ec314405ac90126e710cc2f25d4362c250499cc927b_ppc64le",
          "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-rhel8-operator@sha256:f883b2a9cfb1516222e86f3994a7560233f1b96ae25d0421922bfcfe6935fa16_amd64",
          "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-runtime-jvm-rhel8@sha256:1a3a50a1af4d78bc70a9c11a42f059bd372454ce84913c3b78021180ec4d0bdf_ppc64le",
          "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-runtime-jvm-rhel8@sha256:db94353ed91569bacb79c0f434deff478e01469671ef3af6804940cef31c7492_amd64",
          "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-operator-bundle@sha256:f4d8d5f8bde0fdd607b889da98e039610f306f45e05074435db0e00d4c62785e_amd64",
          "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-process-migration-rhel8@sha256:fdfeda38dd932c4aa9f63b4f5e758b823eb079c90f068a482f92c4aa8e880664_amd64",
          "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-rhel8-operator@sha256:76a66069057cc21cc1476e0b20defaf78178343c8c16de5b5af7c5d3be846474_amd64",
          "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-smartrouter-rhel8@sha256:90dae7252e3c285e1b1d318dd0831f851a7be4608b8f8b82384c7236049b6442_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-44487"
        },
        {
          "category": "external",
          "summary": "RHBZ#2242803",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242803"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-44487",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487"
        },
        {
          "category": "external",
          "summary": "https://github.com/dotnet/announcements/issues/277",
          "url": "https://github.com/dotnet/announcements/issues/277"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2023-2102",
          "url": "https://pkg.go.dev/vuln/GO-2023-2102"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487",
          "url": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487"
        },
        {
          "category": "external",
          "summary": "https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/",
          "url": "https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "release_date": "2023-10-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Updated IBM Business Automation Manager Open Editions 8.0.4 OpenShift images can be found in the Red Hat Container Catalog.",
          "product_ids": [
            "8Base-RHOSE-Middleware:ibm-bamoe-tech-preview/bamoe-kogito-runtime-native-rhel8@sha256:db4267235a69729c0cdc7a8af7d84afeeea6b1cda81e2c9411d5307f11c45bde_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-businesscentral-monitoring-rhel8@sha256:72999c6bcd08c26d15813fa4a813749f1349cafeb7d155ecf262e6cbdf6a0b33_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-businesscentral-rhel8@sha256:bdb79faae81c9624759b0b7acb9825004e377ac5186fefa4be3393c21f41a869_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-controller-rhel8@sha256:4257937e0e3fe3c0dc7b150fb111738c3bf8416781fe15f7245a0b2f9dc604c9_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-dashbuilder-rhel8@sha256:f0efba2fc020c17063ade1ab8860c1f63a6bba74228587ad6c0582001249e6cc_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kieserver-rhel8@sha256:a02e0a493f8651a31614dc30a3e803df08c9563e9f5da21a9710a7d010dfca2f_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-builder-rhel8@sha256:53a848ec0126dd74180697bd76d83f02151ce08dcb1ddda59a4b2ebdcae44047_ppc64le",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-builder-rhel8@sha256:b212e8d2ee392c732960889369d51c885f5eabd9f76a586189e75d8e54fa12ed_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-rhel8-operator-bundle@sha256:331ca81863339a0b8d52f127e860209ac3be2cf05fb4d26f3162eb3ee81f605c_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-rhel8-operator-bundle@sha256:86854b56abee2f78540bd5c3dae1d874ed0281fb756d3d06faa17cb9386b55b8_ppc64le",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-rhel8-operator@sha256:1f2f53c48f1d8e997b0a8ec314405ac90126e710cc2f25d4362c250499cc927b_ppc64le",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-rhel8-operator@sha256:f883b2a9cfb1516222e86f3994a7560233f1b96ae25d0421922bfcfe6935fa16_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-runtime-jvm-rhel8@sha256:1a3a50a1af4d78bc70a9c11a42f059bd372454ce84913c3b78021180ec4d0bdf_ppc64le",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-runtime-jvm-rhel8@sha256:db94353ed91569bacb79c0f434deff478e01469671ef3af6804940cef31c7492_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-operator-bundle@sha256:f4d8d5f8bde0fdd607b889da98e039610f306f45e05074435db0e00d4c62785e_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-process-migration-rhel8@sha256:fdfeda38dd932c4aa9f63b4f5e758b823eb079c90f068a482f92c4aa8e880664_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-rhel8-operator@sha256:76a66069057cc21cc1476e0b20defaf78178343c8c16de5b5af7c5d3be846474_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-smartrouter-rhel8@sha256:90dae7252e3c285e1b1d318dd0831f851a7be4608b8f8b82384c7236049b6442_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:7587"
        },
        {
          "category": "workaround",
          "details": "Users are strongly urged to update their software as soon as fixes are available. \nThere are several mitigation approaches for this flaw. \n\n1. If circumstances permit, users may disable http2 endpoints to circumvent the flaw altogether until a fix is available.\n2. IP-based blocking or flood protection and rate control tools may be used at network endpoints to filter incoming traffic.\n3. Several package specific mitigations are also available. \n     a. nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/\n     b. netty: https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p\n     c. haproxy: https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487\n     d. nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg\n     e. golang: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.",
          "product_ids": [
            "8Base-RHOSE-Middleware:ibm-bamoe-tech-preview/bamoe-kogito-runtime-native-rhel8@sha256:db4267235a69729c0cdc7a8af7d84afeeea6b1cda81e2c9411d5307f11c45bde_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-businesscentral-monitoring-rhel8@sha256:72999c6bcd08c26d15813fa4a813749f1349cafeb7d155ecf262e6cbdf6a0b33_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-businesscentral-rhel8@sha256:bdb79faae81c9624759b0b7acb9825004e377ac5186fefa4be3393c21f41a869_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-controller-rhel8@sha256:4257937e0e3fe3c0dc7b150fb111738c3bf8416781fe15f7245a0b2f9dc604c9_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-dashbuilder-rhel8@sha256:f0efba2fc020c17063ade1ab8860c1f63a6bba74228587ad6c0582001249e6cc_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kieserver-rhel8@sha256:a02e0a493f8651a31614dc30a3e803df08c9563e9f5da21a9710a7d010dfca2f_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-builder-rhel8@sha256:53a848ec0126dd74180697bd76d83f02151ce08dcb1ddda59a4b2ebdcae44047_ppc64le",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-builder-rhel8@sha256:b212e8d2ee392c732960889369d51c885f5eabd9f76a586189e75d8e54fa12ed_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-rhel8-operator-bundle@sha256:331ca81863339a0b8d52f127e860209ac3be2cf05fb4d26f3162eb3ee81f605c_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-rhel8-operator-bundle@sha256:86854b56abee2f78540bd5c3dae1d874ed0281fb756d3d06faa17cb9386b55b8_ppc64le",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-rhel8-operator@sha256:1f2f53c48f1d8e997b0a8ec314405ac90126e710cc2f25d4362c250499cc927b_ppc64le",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-rhel8-operator@sha256:f883b2a9cfb1516222e86f3994a7560233f1b96ae25d0421922bfcfe6935fa16_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-runtime-jvm-rhel8@sha256:1a3a50a1af4d78bc70a9c11a42f059bd372454ce84913c3b78021180ec4d0bdf_ppc64le",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-runtime-jvm-rhel8@sha256:db94353ed91569bacb79c0f434deff478e01469671ef3af6804940cef31c7492_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-operator-bundle@sha256:f4d8d5f8bde0fdd607b889da98e039610f306f45e05074435db0e00d4c62785e_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-process-migration-rhel8@sha256:fdfeda38dd932c4aa9f63b4f5e758b823eb079c90f068a482f92c4aa8e880664_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-rhel8-operator@sha256:76a66069057cc21cc1476e0b20defaf78178343c8c16de5b5af7c5d3be846474_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-smartrouter-rhel8@sha256:90dae7252e3c285e1b1d318dd0831f851a7be4608b8f8b82384c7236049b6442_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:ibm-bamoe-tech-preview/bamoe-kogito-runtime-native-rhel8@sha256:db4267235a69729c0cdc7a8af7d84afeeea6b1cda81e2c9411d5307f11c45bde_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-businesscentral-monitoring-rhel8@sha256:72999c6bcd08c26d15813fa4a813749f1349cafeb7d155ecf262e6cbdf6a0b33_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-businesscentral-rhel8@sha256:bdb79faae81c9624759b0b7acb9825004e377ac5186fefa4be3393c21f41a869_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-controller-rhel8@sha256:4257937e0e3fe3c0dc7b150fb111738c3bf8416781fe15f7245a0b2f9dc604c9_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-dashbuilder-rhel8@sha256:f0efba2fc020c17063ade1ab8860c1f63a6bba74228587ad6c0582001249e6cc_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kieserver-rhel8@sha256:a02e0a493f8651a31614dc30a3e803df08c9563e9f5da21a9710a7d010dfca2f_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-builder-rhel8@sha256:53a848ec0126dd74180697bd76d83f02151ce08dcb1ddda59a4b2ebdcae44047_ppc64le",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-builder-rhel8@sha256:b212e8d2ee392c732960889369d51c885f5eabd9f76a586189e75d8e54fa12ed_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-rhel8-operator-bundle@sha256:331ca81863339a0b8d52f127e860209ac3be2cf05fb4d26f3162eb3ee81f605c_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-rhel8-operator-bundle@sha256:86854b56abee2f78540bd5c3dae1d874ed0281fb756d3d06faa17cb9386b55b8_ppc64le",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-rhel8-operator@sha256:1f2f53c48f1d8e997b0a8ec314405ac90126e710cc2f25d4362c250499cc927b_ppc64le",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-rhel8-operator@sha256:f883b2a9cfb1516222e86f3994a7560233f1b96ae25d0421922bfcfe6935fa16_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-runtime-jvm-rhel8@sha256:1a3a50a1af4d78bc70a9c11a42f059bd372454ce84913c3b78021180ec4d0bdf_ppc64le",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-kogito-runtime-jvm-rhel8@sha256:db94353ed91569bacb79c0f434deff478e01469671ef3af6804940cef31c7492_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-operator-bundle@sha256:f4d8d5f8bde0fdd607b889da98e039610f306f45e05074435db0e00d4c62785e_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-process-migration-rhel8@sha256:fdfeda38dd932c4aa9f63b4f5e758b823eb079c90f068a482f92c4aa8e880664_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-rhel8-operator@sha256:76a66069057cc21cc1476e0b20defaf78178343c8c16de5b5af7c5d3be846474_amd64",
            "8Base-RHOSE-Middleware:ibm-bamoe/bamoe-smartrouter-rhel8@sha256:90dae7252e3c285e1b1d318dd0831f851a7be4608b8f8b82384c7236049b6442_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "exploit_status",
          "date": "2023-10-10T00:00:00+00:00",
          "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.