Red Hat Security Advisory

RHSA-2023:5935

Red Hat OpenStack Platform 16.2.5 security update

Released 2023-10-19 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenStack Platform 16.2 rhosp-rhel8/osp-director-agent, rhosp-rhel8/osp-director-downloader, rhosp-rhel8/osp-director-operator +1

Fixes 7 records

TI-2023-23979 CVE-2023-44487 · GHSA-qppj-fm5r-hxr3

The HTTP/2 protocol allows a denial of service (server resource consumption) because…

CRITICAL 90KEV

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.99999 Published 2023-10-10 Partial fix · 1.28.0, 0.17.0 +9 CWE-400

TI-2022-20116 CVE-2022-41725 · GHSA-w4h2-22wh-m6jx

Excessive resource consumption in mime/multipart

MEDIUM 41

A denial of service is possible from excessive resource consumption in net/http and mime/multipart.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01241 Published 2023-02-28 Partial fix · 1.19.6, 1.20.1 CWE-770

TI-2022-20115 CVE-2022-41724 · GHSA-89mw-w342-mqrr

Panic on large handshake records in crypto/tls

MEDIUM 41

Large handshake records may cause panics in crypto/tls.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01111 Published 2023-02-28 Partial fix · 1.19.6, 1.20.1 CWE-400

TI-2023-20466 CVE-2023-39325 · GHSA-4374-p667-p6c8

HTTP/2 rapid reset can cause excessive work in net/http

LOW 39

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03796 Published 2023-10-11 Partial fix · 1.20.10, 1.21.3 +1 CWE-770

TI-2023-13786 CVE-2023-29406 · GHSA-f8f7-69v5-w4vx

Insufficient sanitization of Host header in net/http

LOW 32

The HTTP/1 client does not fully validate the contents of the Host header.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01453 Published 2023-07-11 Partial fix · 1.19.11, 1.20.6 CWE-436

TI-2023-13789 CVE-2023-29409 · GHSA-xc82-5m89-g4jv

Large RSA keys can cause high CPU usage in crypto/tls

LOW 27

Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01601 Published 2023-08-02 Partial fix · 1.19.12, 1.20.7 +1 CWE-400

TI-2023-10153 CVE-2023-24532 · GHSA-x2w5-7wp4-5qff

Incorrect calculation on P256 curves in crypto/internal/nistec

LOW 26

The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a scalar larger than the order of the curve).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00817 Published 2023-03-08 Partial fix · 1.19.7, 1.20.2 CWE-682