The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2021-44716. This issue occurs because the etcd package in the Red Hat OpenStack platform is using http://golang.org/x/net/http2 instead of the one provided by Red Hat Enterprise Linux versions, meaning it should be updated at compile time instead.

The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2021-44716. This issue occurs because the etcd package in the Red Hat OpenStack platform is using http://golang.org/x/net/http2 instead of the one provided by Red Hat Enterprise Linux versions, meaning it should be updated at compile time instead.

golang: html/template: improper handling of HTML-like comments within script contexts golang: html/template: improper handling of special tags within script contexts golang: crypto/tls: panic when processing post-handshake message on QUIC connections golang: crypto/tls: lack of a limit on buffered post-handshake golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads etcd: Incomplete fix for CVE-2022-41723 in OpenStack Platform etcd: Incomplete fix for CVE-2021-44716 in OpenStack Platform etcd: Incomplete fix for CVE-2023-39325/CVE-2023-44487 in OpenStack Platform