RHBA-2023:6287 - Bug Fix Advisory

Topic

The JBoss Web Server (JWS) Operator for OpenShift has been updated to provide a fix for nghttp2 and python CVEs.

Description

This erratum covers updates to the JWS Operator for OpenShift to fix the following CVEs:

• nghttp2: CVE-2023-44487
• python: CVE-2023-40217

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenShift Container Platform 4.11 for RHEL 8 x86_64
• Red Hat OpenShift Container Platform 4.10 for RHEL 8 x86_64
• Red Hat OpenShift Container Platform for Power 4.10 for RHEL 8 ppc64le
• Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.10 for RHEL 8 s390x

Fixes

• BZ - 2242803 - CVE-2023-44487 HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)
• JWS-3126 - Update JWS Openshift operator due to nghttp2 CVE
• JWS-3127 - Update JWS Openshift operator due to python CVE

CVEs

• CVE-2023-40217
• CVE-2023-44487

References

• https://access.redhat.com/errata/RHSA-2023:5837
• https://access.redhat.com/errata/RHSA-2023:5997