RHSA-2023:0774HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.11.28 security update

Published
February 21, 2023
Last Modified
August 7, 2026

🔗 CVE IDs covered (3)

CVE-2021-4238 →CVE-2021-38561 →CVE-2022-41717 →

📋 Description

CVE-2021-4238 — goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be CVE-2021-38561 — golang: out-of-bounds read in golang.org/x/text/language leads to DoS CVE-2022-41717 — golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests

🎯 Affected products81

  • Red Hat OpenShift Container Platform 4.11
  • openshift4/driver-toolkit-rhel8@sha256:1e530ac61e1a2607c2967410eeeb51b48d5e5b8a29211b8404d1a560f42e734d_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/driver-toolkit-rhel8@sha256:73d8bb4814c06c1c47fba6b4fc7b808477c9015739f7aaf198b6aac66e1808a4_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/driver-toolkit-rhel8@sha256:edcb79eab9b513a7945be35d3d382b470d41b64628ba60d95ef48422c8ca45f1_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/driver-toolkit-rhel8@sha256:f49690c772895ddfda8d5c246816a534690ab436b21bac75a1aa7d8f90e1abc1_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/network-tools-rhel8@sha256:2d85a2e24a0171f944719720628dd51eb44df87838dd6ddea6f59d5d5f33bdb1_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/network-tools-rhel8@sha256:87beb41b30a883c08b84dc115f467a6cb677a7ec030282bbf23d26b4e6501c47_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/network-tools-rhel8@sha256:920c4d641e4e0964137163a3c5b5f75312078526b52b9f81f564cdac86d285c6_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/network-tools-rhel8@sha256:cd37dcf700a5564a2804ba7f1560fdac5e2a670202e1166bc33d4ad0cb3a2079_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-baremetal-installer-rhel8@sha256:4aa99f4ac08356bc21bbb68b874c0efb5fb404591cf68795ad806a73cc4e4282_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-baremetal-installer-rhel8@sha256:70f003473f7d7d1401f6a4a6a25d9104ed5418766b47ae6a4c75cf8da1ee7dd5_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-baremetal-installer-rhel8@sha256:a12a209b6c6bb50759fb2e79dd026549bf65ae6980e5cb5d8e3b81a9165c66b7_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-baremetal-installer-rhel8@sha256:cf8cb914aade1a38e8370f65832c7bd8b492bdf9da2fa17d963110bba630e512_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-cluster-node-tuning-operator@sha256:0677e88a300f7f3922157e5de439945d326a33937e4e32e877eeafe875bcf0ef_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-cluster-node-tuning-operator@sha256:073166bab5c30ff0537654ffc4098b9497fc0754dd0d2fa411d1fdc1492cae60_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-cluster-node-tuning-operator@sha256:358023322f59e02f37ac4ebc0bbd6de775ce9e81da0afc6c89eb825fdb5089ee_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-cluster-node-tuning-operator@sha256:bf679c0525f56ef2a43fa3bd26b3dbecfc97dc952df0d12682fea11d085e360d_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-cluster-samples-operator@sha256:0bd34a70ec284bcaea228fce4be1d5cbea801b57595a12667eb13a7b4147a4e6_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-cluster-samples-operator@sha256:345a234b50348b00d0d9ca10136eaa4461439c21bd3830c7dbd8493754478821_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-cluster-samples-operator@sha256:5c5f53ab966eec724e4413273951aad0e8783ce05554a80fa751c5430bc487c8_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-cluster-samples-operator@sha256:902a96d3b7ebc2602ddd91f6adefe7eb05aa641788a7be77e57c1a00ee1e7806_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-console@sha256:2efe145053d4f8bd7d50c6f9beff8553a0ecd129fc6435d73e4eb2131d2694bd_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-console@sha256:374fb5f8cf65da5b5925a9db60fc8f5cfe64e20e23c7e638509bb859fe54e4ce_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-console@sha256:4e4ce827781ec9338acb40b8dda860b4bb04addf44f5a2f35774c653da4b2ea2_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-console@sha256:dd1e489c6dd605771cd534244f4995a20d7eddaff808c9b3e491bda1375c4372_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-csi-driver-manila-rhel8@sha256:40a135133957a0bb9f4099d25dab5b6b500b5c288d8054cb924fc1c93a0af870_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-csi-driver-manila-rhel8@sha256:8455edcd02518c3e26688b37f36ab816e2205251d3997a873fb1f2abbd83ac7f_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-haproxy-router@sha256:331ba95cc9166838ce3c2732c4d92d7b25e744fba819faae19b5cc3e9212ce20_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-haproxy-router@sha256:53056d53167346440dfc4fb6bf51b32c4d807e126f437666347f72bd9647ffab_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-haproxy-router@sha256:604e988fe6e4cff2a9d68d7219263ad09866404d191b57742e4a7761fad2dec7_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • +51 more not shown

✅ Remediation

For OpenShift Container Platform 4.11 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.11/release_notes/ocp-4-11-release-notes.html You can download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests can be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are: (For x86_64 architecture) The image digest is sha256:85238bc3eddb88e958535597dbe8ec6f2aa88aa1713c2e1ee7faf88d1fefdac0 (For s390x architecture) The image digest is sha256:96528500690870b001c214ed0b142b5b375494ddfd99de274285ae6eacd318bb (For ppc64le architecture) The image digest is sha256:0821035d379a4cab1147669bac5f42139b9839e780394e8586e29800e79789bd (For aarch64 architecture) The image digest is sha256:a5c6196590d47b5ca8578e35c23da47cb103947271ab5deb21c8d258de62a777 All OpenShift Container Platform 4.11 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.11/updating/updating-cluster-cli.html

🔗 References (14)