RHSA-2019:3041HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0.1 RPMs

Published
October 14, 2019
Last Modified
August 4, 2026

🔗 CVE IDs covered (2)

CVE-2019-9511 →CVE-2019-9513 →

📋 Description

CVE-2019-9511 — HTTP/2: large amount of data requests leads to denial of service CVE-2019-9513 — HTTP/2: flood using PRIORITY frames results in excessive resource consumption

🎯 Affected products25

  • OpenShift Service Mesh 1.0
  • Red Hat OpenShift Service Mesh 1.0
  • kiali-0:v1.0.6.redhat1-1.el7.src as a component of Red Hat OpenShift Service Mesh 1.0
  • kiali-0:v1.0.6.redhat1-1.el7.x86_64 as a component of Red Hat OpenShift Service Mesh 1.0
  • servicemesh-0:1.0.1-8.el8.src as a component of OpenShift Service Mesh 1.0
  • servicemesh-0:1.0.1-8.el8.x86_64 as a component of OpenShift Service Mesh 1.0
  • servicemesh-citadel-0:1.0.1-8.el8.x86_64 as a component of OpenShift Service Mesh 1.0
  • servicemesh-cni-0:1.0.1-8.el8.src as a component of OpenShift Service Mesh 1.0
  • servicemesh-cni-0:1.0.1-8.el8.x86_64 as a component of OpenShift Service Mesh 1.0
  • servicemesh-galley-0:1.0.1-8.el8.x86_64 as a component of OpenShift Service Mesh 1.0
  • servicemesh-grafana-0:6.2.2-21.el8.src as a component of OpenShift Service Mesh 1.0
  • servicemesh-grafana-0:6.2.2-21.el8.x86_64 as a component of OpenShift Service Mesh 1.0
  • servicemesh-grafana-prometheus-0:6.2.2-21.el8.x86_64 as a component of OpenShift Service Mesh 1.0
  • servicemesh-istioctl-0:1.0.1-8.el8.x86_64 as a component of OpenShift Service Mesh 1.0
  • servicemesh-mixc-0:1.0.1-8.el8.x86_64 as a component of OpenShift Service Mesh 1.0
  • servicemesh-mixs-0:1.0.1-8.el8.x86_64 as a component of OpenShift Service Mesh 1.0
  • servicemesh-operator-0:1.0.1-8.el8.src as a component of OpenShift Service Mesh 1.0
  • servicemesh-operator-0:1.0.1-8.el8.x86_64 as a component of OpenShift Service Mesh 1.0
  • servicemesh-pilot-agent-0:1.0.1-8.el8.x86_64 as a component of OpenShift Service Mesh 1.0
  • servicemesh-pilot-discovery-0:1.0.1-8.el8.x86_64 as a component of OpenShift Service Mesh 1.0
  • servicemesh-prometheus-0:2.7.2-22.el8.src as a component of OpenShift Service Mesh 1.0
  • servicemesh-prometheus-0:2.7.2-22.el8.x86_64 as a component of OpenShift Service Mesh 1.0
  • servicemesh-proxy-0:1.0.1-7.el8.src as a component of OpenShift Service Mesh 1.0
  • servicemesh-proxy-0:1.0.1-7.el8.x86_64 as a component of OpenShift Service Mesh 1.0
  • servicemesh-sidecar-injector-0:1.0.1-8.el8.x86_64 as a component of OpenShift Service Mesh 1.0

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 The OpenShift Service Mesh release notes provide information on the features and known issues: https://docs.openshift.com/container-platform/4.1/service_mesh/servicemesh-release-notes.html Workaround: Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions: 1. Copy the Nginx configuration from the quay container to the host $ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx 2. Edit the Nginx configuration, removing http/2 support $ sed -i 's/http2 //g' /mnt/quay/nginx/nginx.conf 3. Restart Nginx with the new configuration mounted into the container, eg: $ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3

🔗 References (6)