Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2023-29409

Uncontrolled Resource Consumption

Published: Aug 02, 2023 | Modified: Nov 21, 2024
CVSS 3.x
5.3
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 2.x
RedHat/V2
RedHat/V3
5.3 MODERATE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Ubuntu
MEDIUM
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2023-29409
CWEhttps://cwe.mitre.org/data/definitions/400.html

Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in circulation with keys larger than this, and all three appear to be test certificates that are not actively deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so causing breakage here in the interests of increasing the default safety of users of crypto/tls seems reasonable.

Weakness

The product does not properly control the allocation and maintenance of a limited resource.

Affected Software

NameVendorStart VersionEnd Version
GoGolang*1.19.12 (excluding)
GoGolang1.20.0 (including)1.20.7 (excluding)
GoGolang1.21.0-rc1 (including)1.21.0-rc1 (including)
GoGolang1.21.0-rc2 (including)1.21.0-rc2 (including)
GoGolang1.21.0-rc3 (including)1.21.0-rc3 (including)
CERT-MANAGER-1.11-RHEL-9RedHatcert-manager/cert-manager-operator-rhel9:v1.11.5-5*
Cryostat 2 on RHEL 8RedHatcryostat-tech-preview/cryostat-rhel8-operator:2.3.1-11*
Migration Toolkit for Virtualization 2.4RedHatmigration-toolkit-virtualization/mtv-rhel8-operator:2.4.3-3*
MTA-6.2-RHEL-8RedHatmta/mta-rhel8-operator:6.2.2-3*
MTA-6.2-RHEL-9RedHatmta/mta-hub-rhel9:6.2.2-2*
MTA-6.2-RHEL-9RedHatmta/mta-operator-bundle:6.2.2-5*
MTA-6.2-RHEL-9RedHatmta/mta-pathfinder-rhel9:6.2.2-2*
MTA-6.2-RHEL-9RedHatmta/mta-ui-rhel9:6.2.2-2*
MTA-6.2-RHEL-9RedHatmta/mta-windup-addon-rhel9:6.2.2-3*
NETWORK-OBSERVABILITY-1.4.0-RHEL-9RedHatnetwork-observability/network-observability-rhel9-operator:v1.4.0-51*
OADP-1.1-RHEL-8RedHatoadp/oadp-velero-rhel8:1.1.7-6*
Openshift Serverless 1 on RHEL 8RedHatopenshift-serverless-clients-0:1.9.2-4.el8*
OSSO-1.1-RHEL-8RedHatopenshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8:v1.1-37*
Red Hat Ansible Automation Platform 2.4 for RHEL 8RedHatreceptor-0:1.4.2-1.el8ap*
Red Hat Ansible Automation Platform 2.4 for RHEL 9RedHatreceptor-0:1.4.2-1.el9ap*
Red Hat Enterprise Linux 8RedHatgo-toolset:rhel8-8080020231013004859.6b4b45d8*
Red Hat Enterprise Linux 8RedHatcontainer-tools:4.0-8090020231207142256.d7b6f4b7*
Red Hat Enterprise Linux 8RedHatcontainer-tools:rhel8-8100020240227110532.82888897*
Red Hat Enterprise Linux 9RedHatgolang-0:1.19.13-1.el9_2*
Red Hat Enterprise Linux 9RedHatskopeo-2:1.13.3-3.el9_3*
Red Hat Enterprise Linux 9RedHatrunc-4:1.1.9-2.el9_3*
Red Hat Enterprise Linux 9RedHatbuildah-1:1.31.3-2.el9_3*
Red Hat Enterprise Linux 9RedHatpodman-2:4.6.1-7.el9_3*
Red Hat Enterprise Linux 9RedHatcontainernetworking-plugins-1:1.3.0-6.el9_3*
Red Hat Migration Toolkit for Containers 1.7RedHatrhmtc/openshift-velero-plugin-rhel8:v1.7.14-3*
Red Hat OpenShift Container Platform 4.14RedHatpodman-3:4.4.1-10.1.rhaos4.14.el8*
Red Hat OpenShift Container Platform 4.14RedHatrunc-4:1.1.9-2.1.rhaos4.14.el9*
Red Hat OpenShift Container Platform 4.14RedHatopenshift-clients-0:4.14.0-202311031050.p0.g9b1e0d2.assembly.stream.el9*
Red Hat OpenShift Container Platform 4.14RedHatopenshift-0:4.14.0-202401121302.p0.ge36e183.assembly.stream.el9*
Red Hat OpenShift Container Platform 4.14RedHatmicroshift-0:4.14.10-202401181720.p0.gd25a4c5.assembly.4.14.10.el9*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/client-kn-rhel8:1.9.2-4*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/eventing-apiserver-receive-adapter-rhel8:1.9.0-4*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/eventing-controller-rhel8:1.9.0-4*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/eventing-in-memory-channel-controller-rhel8:1.9.0-4*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/eventing-in-memory-channel-dispatcher-rhel8:1.9.0-4*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/eventing-kafka-broker-controller-rhel8:1.9.0-9*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/eventing-kafka-broker-dispatcher-rhel8:1.9.0-9*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/eventing-kafka-broker-post-install-rhel8:1.9.0-9*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/eventing-kafka-broker-receiver-rhel8:1.9.0-9*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/eventing-kafka-broker-webhook-rhel8:1.9.0-9*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/eventing-mtbroker-filter-rhel8:1.9.0-4*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/eventing-mtbroker-ingress-rhel8:1.9.0-4*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/eventing-mtchannel-broker-rhel8:1.9.0-4*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/eventing-mtping-rhel8:1.9.0-4*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/eventing-storage-version-migration-rhel8:1.9.0-4*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/eventing-webhook-rhel8:1.9.0-4*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/func-utils-rhel8:1.30.2-2*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/ingress-rhel8-operator:1.30.2-3*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/knative-rhel8-operator:1.30.2-3*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/kn-cli-artifacts-rhel8:1.9.2-4*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/kourier-control-rhel8:1.9.0-5*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/net-istio-controller-rhel8:1.9.0-5*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/net-istio-webhook-rhel8:1.9.0-5*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/serverless-operator-bundle:1.30.2-2*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/serverless-rhel8-operator:1.30.2-4*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/serving-activator-rhel8:1.9.0-4*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/serving-autoscaler-hpa-rhel8:1.9.0-4*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/serving-autoscaler-rhel8:1.9.0-4*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/serving-controller-rhel8:1.9.0-4*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/serving-domain-mapping-rhel8:1.9.0-4*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/serving-domain-mapping-webhook-rhel8:1.9.0-4*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/serving-queue-rhel8:1.9.0-4*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/serving-storage-version-migration-rhel8:1.9.0-4*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/serving-webhook-rhel8:1.9.0-4*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1/svls-must-gather-rhel8:1.30.2-1*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1-tech-preview/eventing-istio-controller-rhel8:1.9.0-4*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8:1.9.0-4*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1-tech-preview/logic-data-index-ephemeral-rhel8:1.30.0-8*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1-tech-preview/logic-swf-builder-rhel8:1.30.0-9*
Red Hat OpenShift Serverless 1.30RedHatopenshift-serverless-1-tech-preview/logic-swf-devmode-rhel8:1.30.0-9*
Red Hat OpenStack Platform 16.2RedHatrhosp-rhel8/osp-director-agent:1.3.0-10*
Red Hat OpenStack Platform 16.2RedHatrhosp-rhel8/osp-director-downloader:1.3.0-11*
Red Hat OpenStack Platform 16.2RedHatrhosp-rhel8/osp-director-operator:1.3.0-9*
Red Hat OpenStack Platform 16.2RedHatrhosp-rhel8/osp-director-operator-bundle:1.3.0-19*
Red Hat OpenStack Platform 16.2RedHatcollectd-libpod-stats-0:1.0.4-5.el8ost*
Red Hat OpenStack Platform 16.2RedHatetcd-0:3.3.23-15.el8ost*
Red Hat OpenStack Platform 17.1 for RHEL 9RedHatcollectd-libpod-stats-0:1.0.5-6.el9ost*
Red Hat OpenStack Platform 17.1 for RHEL 9RedHatrhosp-rhel9/osp-director-agent:1.3.1-11*
Red Hat OpenStack Platform 17.1 for RHEL 9RedHatrhosp-rhel9/osp-director-downloader:1.3.1-9*
Red Hat OpenStack Platform 17.1 for RHEL 9RedHatrhosp-rhel9/osp-director-operator:1.3.1-11*
Red Hat OpenStack Platform 17.1 for RHEL 9RedHatrhosp-rhel9/osp-director-operator-bundle:1.3.1-18*
RHODF-4.15-RHEL-9RedHatodf4/cephcsi-rhel9:v4.15.0-37*
RHOL-5.6-RHEL-8RedHatopenshift-logging/logging-loki-rhel8:v2.9.2-2*
RHOL-5.7-RHEL-8RedHatopenshift-logging/logging-loki-rhel8:v2.9.2-1*
RODOO-1.0-RHEL-8RedHatrun-once-duration-override-operator/run-once-duration-override-rhel8:v1.0-30*
STF-1.5-RHEL-8RedHatstf/prometheus-webhook-snmp-rhel8:1.5.2-8*
STF-1.5-RHEL-8RedHatstf/service-telemetry-operator-bundle:1.5.1697612918-1*
STF-1.5-RHEL-8RedHatstf/service-telemetry-rhel8-operator:1.5.1-8*
STF-1.5-RHEL-8RedHatstf/sg-bridge-rhel8:1.5.0-18*
STF-1.5-RHEL-8RedHatstf/sg-core-rhel8:5.1.1-8*
STF-1.5-RHEL-8RedHatstf/smart-gateway-operator-bundle:5.0.1697612918-1*
STF-1.5-RHEL-8RedHatstf/smart-gateway-rhel8-operator:5.0.1-9*
Golang-1.19Ubuntubionic*
Golang-1.19Ubuntulunar*
Golang-1.19Ubuntutrusty*
Golang-1.19Ubuntuupstream*
Golang-1.19Ubuntuxenial*
Golang-1.20Ubuntubionic*
Golang-1.20Ubuntufocal*
Golang-1.20Ubuntulunar*
Golang-1.20Ubuntumantic*
Golang-1.20Ubuntutrusty*
Golang-1.20Ubuntuupstream*
Golang-1.20Ubuntuxenial*

Potential Mitigations

  • Mitigation of resource exhaustion attacks requires that the target system either:

  • The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.

  • The second solution is simply difficult to effectively institute – and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use