Red Hat Product Errata RHSA-2023:7335 - Security Advisory
Issued:
2023-11-16
Updated:
2023-11-16

RHSA-2023:7335 - Security Advisory

Synopsis

Important: Updated Red Hat Process Automation Manager 7.13.4 SP2 Images

Type/Severity

Security Advisory: Important

Topic

An update is now available for Red Hat Process Automation Manager including images for Red Hat OpenShift Container Platform.

Description

Red Hat Process Automation Manager is an open source business process management suite that combines process management and decision service management and enables business and IT users to create, manage, validate, and deploy process applications and decision services.

This release includes security fixes.

Security Fix(es):

  • netty-codec-http2: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
  • undertow: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
  • Quarkus: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
  • EAP XP: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
  • EAP: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
  • businessautomation-operator: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)

A Red Hat Security Bulletin which addresses further details about this flaw is available in the References section.

For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE pages listed in the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat OpenShift Container Platform 4.12 for RHEL 8 x86_64
  • Red Hat OpenShift Container Platform 4.11 for RHEL 8 x86_64
  • Red Hat OpenShift Container Platform 4.10 for RHEL 8 x86_64

Fixes

  • BZ - 2242803 - CVE-2023-44487 HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

ppc64le

rhpam-7/rhpam-kogito-builder-rhel8@sha256:eeb33a9caf57c04f021eea1aba0c87f8d4e70c1a804fbe1c8adc68859e7c4424
rhpam-7/rhpam-kogito-rhel8-operator@sha256:6ea8b56d752f98a1dd48d8e91f00f49a8f40124b6ec4464209e2e8554de7c93e
rhpam-7/rhpam-kogito-rhel8-operator-bundle@sha256:056cc42012b5da9581c8d6f347a1693d6d3d904f76954fc1aafe12a6601994aa
rhpam-7/rhpam-kogito-runtime-jvm-rhel8@sha256:ccb049dd64523e98d0e7a0f7cf99e2171f17917532f4d10ab5893b24c1b19698

x86_64

rhpam-7-tech-preview/rhpam-kogito-runtime-native-rhel8@sha256:f100720059d7a0d35ff776e5b928486708b420b7a70652e82b815e4dc654b1f5
rhpam-7/rhpam-businesscentral-monitoring-rhel8@sha256:878b83b28bf3b7dcfcb710c70ff06268477dddfa6a3df21b7dbe52f53ca3ca40
rhpam-7/rhpam-businesscentral-rhel8@sha256:52e746b99d6a15be91dc7c4e74fb0a58c27ca1d08151d456336e26b0cbcb54fe
rhpam-7/rhpam-controller-rhel8@sha256:c570297daff9ae813db39b27b4604f56cfcfa32a27e81d339da06dd33c13254f
rhpam-7/rhpam-dashbuilder-rhel8@sha256:b787d57beb85e6098033b8c26789d2cc7a29faf7463fa8607d962382752f0883
rhpam-7/rhpam-kieserver-rhel8@sha256:62a457fc1595ed3e534ef9c792cb2bdf3c1712642d370b450a2f341bdd118eda
rhpam-7/rhpam-kogito-builder-rhel8@sha256:2caadb26d1a4ed774bdfa67664d11210b02a143b741cd4068b1654d51ed80c61
rhpam-7/rhpam-kogito-rhel8-operator@sha256:52c4c3483cbcd0552730311a21cd4f32902de01b0efbaca2420a96dae6ad6b59
rhpam-7/rhpam-kogito-rhel8-operator-bundle@sha256:4553c12fa6f1a41b098efb333ce15d062eeea289b2bed5b2fd3075f5d4bb8cc8
rhpam-7/rhpam-kogito-runtime-jvm-rhel8@sha256:cbddd58758ac980a75e007808225feb9e65c280bbdc4727330acfa639474b808
rhpam-7/rhpam-operator-bundle@sha256:d5d8ae9b97b00623af7c4c85a15966bf4de7bc53b767634d6e8e33ba4167d9d3
rhpam-7/rhpam-process-migration-rhel8@sha256:193ff45f398332ecb2af83f7c6bd1e729ca64e5bbb757ce6623b75a448bfaf55
rhpam-7/rhpam-rhel8-operator@sha256:a7a20aed601d9a2ff38788dc773f821c1f68132de83fb1c36cc534a4f0d3468c
rhpam-7/rhpam-smartrouter-rhel8@sha256:91b1516edf464d7f67b9f97062629d0e1beb1c3023d94871db577c392a2df2a8

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.