The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2023-39325/CVE-2023-44487, known as Rapid Reset. This issue occurs because the etcd package in the Red Hat OpenStack platform is using http://golang.org/x/net/http2 instead of the one provided by Red Hat Enterprise Linux versions, meaning it should be updated at compile time instead.

The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2023-39325/CVE-2023-44487, known as Rapid Reset. This issue occurs because the etcd package in the Red Hat OpenStack platform is using http://golang.org/x/net/http2 instead of the one provided by Red Hat Enterprise Linux versions, meaning it should be updated at compile time instead.

golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges. golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads etcd: Incomplete fix for CVE-2023-39325/CVE-2023-44487 in OpenStack Platform

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenStack ausnutzen, um Sicherheitsmaßnahmen zu umgehen, eine Denial-of-Service-Zustand zu erzeugen, um vertrauliche Informationen offenzulegen und Daten zu ändern.