BIT-2023-45802

When a HTTP/2 stream was reset RST frame by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing...

Amazon Linux 2 : httpd (ALAS-2023-2322)

The version of httpd installed on the remote host is prior to 2.4.58-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2322 advisory. Out-of-bounds Read vulnerability in modmacro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57...

Amazon Linux 2 : cri-tools (ALAS-2023-2324)

The version of cri-tools installed on the remote host is prior to 1.26.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2324 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams...

Amazon Linux 2 : golist (ALAS-2023-2326)

The version of golist installed on the remote host is prior to 0.10.1-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2326 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams...

Amazon Linux 2 : cni-plugins (ALAS-2023-2325)

The version of cni-plugins installed on the remote host is prior to 1.2.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2325 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams...

GO-2023-2153 Denial of service from HTTP/2 Rapid Reset in google.golang.org/grpc

An attacker can send HTTP/2 requests, cancel them, and send subsequent requests. This is valid by the HTTP/2 protocol, but would cause the gRPC-Go server to launch more concurrent method handlers than the configured maximum stream limit, grpc.MaxConcurrentStreams. This results in a denial of...

Security Bulletin: IBM Storage Ceph is vulnerable to a denial of service vulnerablity in Golang Go

Summary Golang Go is used by IBM Storage Ceph as part of RGW and in assorted other locations. CVE-2022-41721, CVE-2022-27664, CVE-2022-30633, CVE-2022-28131. Vulnerability Details CVEID: CVE-2022-41721 DESCRIPTION: Golang Go is vulnerable to HTTP request smuggling, caused by a flaw when using...

Important: Red Hat Security Advisory: OpenShift Virtualization 4.11.7 Images security and bug fix update

Red Hat OpenShift Virtualization release 4.11.7 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which...

Important: Red Hat Security Advisory: OpenShift Virtualization 4.12.8 Images security update

Red Hat OpenShift Virtualization release 4.12.8 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which...

Important: Red Hat Security Advisory: Kiali (Kiali 1.65.10) security update

An update is now available for Kiali Kiali 1.65.10 for RHEL 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

Important: Red Hat Security Advisory: OpenShift Virtualization 4.13.5 Images security update

Red Hat OpenShift Virtualization release 4.13.5 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which...

BIT-2023-39325

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...

Important: Red Hat Security Advisory: Secondary Scheduler Operator for Red Hat OpenShift 1.2.0

Secondary Scheduler Operator for Red Hat OpenShift 1.2.0 The Secondary Scheduler Operator for Red Hat OpenShift is an optional operator that makes it possible to deploy a secondary scheduler by providing a scheduler image. You can run a scheduler with custom plugins without applying additional...

Amazon Linux 2 : amazon-ecr-credential-helper (ALASNITRO-ENCLAVES-2023-033)

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.7.1-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2023-033 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request...

Important: golist

Issue Overview: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-39325 Affected Packages: golist Note: This advisory is applicable to Amazon Lin...

Amazon Linux 2 : containerd (ALASECS-2023-017)

The version of containerd installed on the remote host is prior to 1.6.19-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2023-017 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many stream...

Amazon Linux 2 : docker (ALASECS-2023-019)

The version of docker installed on the remote host is prior to 20.10.25-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2023-019 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Templates did not properly consider backticks...

Important: cri-tools

Issue Overview: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-39325 Affected Packages: cri-tools Note: This advisory is applicable to Amazon...

Amazon Linux 2 : amazon-ecr-credential-helper (ALASDOCKER-2023-034)

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.7.1-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2023-034 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation c...

Amazon Linux 2 : runc (ALASECS-2023-018)

The version of runc installed on the remote host is prior to 1.1.7-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2023-018 advisory. Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signature...