Red Hat OpenShift Updates Remediate HTTP/2 Rapid Reset and Telemetry DoS Flaws

Red Hat released security updates across OpenShift Container Platform (OCP) versions 4.12, 4.14, 4.15, and 4.16 to address denial-of-service vulnerabilities in bundled components. Key issues include CVE-2023-39325, the Go net/http/x/net/http2 flaw associated with the HTTP/2 Rapid Reset attack and related to CVE-2023-44487, which lets unauthenticated clients repeatedly create and reset HTTP/2 streams to exhaust server resources. Red Hat rates CVE-2023-39325 as Important, CVSS 7.5, and notes CISA identified active exploitation.

The releases also remediate CVE-2023-47108, in which unbounded-cardinality metrics in OpenTelemetry's otelgrpc component can cause resource exhaustion, alongside other version-specific fixes such as OpenTelemetry otelhttp DoS, word-wrap regular-expression DoS, Python temporary-directory path traversal, XSS, Rekor out-of-memory, and SSH prefix-truncation issues. Organizations should upgrade affected clusters through their supported OCP release channels using the web console or OpenShift CLI; where patching CVE-2023-39325 cannot be immediate, Red Hat recommends reducing the HTTP/2 server stream-concurrency setting as a mitigation.