(RHSA-2023:6296) Important: Release of OpenShift Serverless 1.30.2

2023-11-0219:13:53

access.redhat.com

openshift serverless

security

bug fixes

red hat openshift

http/2

ddos attack

golang

tls

cve pages

unix

6.6 Medium

AI Score

Confidence

High

0.732 High

EPSS

Percentile

98.1%

JSON

Version 1.30.2 of the OpenShift Serverless Operator is supported on Red Hat
OpenShift Container Platform versions 4.11, 4.12, and 4.13.

This release includes security, bug fixes, and enhancements.

Security Fix(es):

HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) (CVE-2023-39325)
golang: crypto/tls: slow verification of certificate chains containing large RSA keys (CVE-2023-29409)
golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

For more details about the security issues, including the impact, a CVSS score, acknowledgements, and other related information, refer to the CVE pages listed in the References section.