Red Hat Updates Go Components to Fix HTTP/2 DoS and Certificate-Validation Flaws
Patch & Detection Intelligence · 19 sources · Updated 2mo ago · First seen Jun 27, 2024
Red Hat released Important-severity updates for Red Hat Service Interconnect 1.4 and 1.5, RHEL 9.2 Go packages, and Red Hat OpenStack Platform 17.1 director Operator images to remediate multiple Go vulnerabilities. Key issues include CVE-2023-45288, where unlimited HTTP/2 CONTINUATION frames can exhaust resources; CVE-2024-24783, which can panic crypto/x509 certificate verification when an unknown public-key algorithm is processed; and CVE-2023-39326, in which oversized HTTP chunk extensions can drive server memory consumption to roughly 1 GiB. The OpenStack update also fixes CVE-2023-48795, an SSH Binary Packet Protocol prefix-truncation flaw.
Red Hat additionally updated OpenShift Container Platform 4.13 and 4.14 releases for CVE-2024-1394, a memory leak in golang-fips/openssl RSA encryption and decryption operations; OpenShift 4.14.19 also addresses CVE-2024-28180, involving improper handling of highly compressed data in jose-go. Affected organizations should update Service Interconnect images and skupper-cli, deploy the updated RHEL Go packages and OpenStack operator images, and upgrade OpenShift clusters through their supported release channels across x86_64, ARM64, IBM Power, and IBM Z/LinuxONE where applicable.
