RHSA-2023:4456MediumCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.13.8 bug fix and security update

Published
August 8, 2023
Last Modified
August 6, 2026

🔗 CVE IDs covered (2)

CVE-2022-41723 →CVE-2023-3089 →

📋 Description

CVE-2022-41723 — golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding CVE-2023-3089 — openshift: OCP & FIPS mode

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.13
  • openshift4/cloud-network-config-controller-rhel8@sha256:2fa6d6d5764b828663df8aca6264b57f6c572fe3cecc445f3d7fd04218ae9458_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/cloud-network-config-controller-rhel8@sha256:927157d6f5db25525bea2a649a519fbc1b63cededc69e1c5dd86b6ebd4764873_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/cloud-network-config-controller-rhel8@sha256:9c6e0341ff27ee4f10f5e37c9fe2022dc3f8796b10af6267885b8d3df24e2771_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/cloud-network-config-controller-rhel8@sha256:ed34395903b24b6d746814090ff29d6b1cfa8fdff05ef7c38a66bddf7bf63aa8_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/driver-toolkit-rhel9@sha256:16d2b77c1e3dc05096de7e50119567cf5861d306fa4c9acecfa4e0a78cea1264_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/driver-toolkit-rhel9@sha256:360cc9942503a1cf41a2c6c002de77f059230e5fd3ffa43ac68c23358615fa0b_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/driver-toolkit-rhel9@sha256:56b46ace9b78d2f8816369401f63f93431f45bc3fae696e2e2c26e1810a319fc_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/driver-toolkit-rhel9@sha256:60757657aab2c7450f67aae0459678c92e9cfb9662c4933787ca4698f0dfd48e_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/egress-router-cni-rhel8@sha256:001ec14fcccf616a956e66fcac828ce3e7a78bc83ea00546daafd61471747473_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/egress-router-cni-rhel8@sha256:08114bd914fd4dc3e4e030f45630851aa6e5e356cc449c6675331309c5224c58_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/egress-router-cni-rhel8@sha256:0ce83e1d4be5190ccac81dc04a9a4a2af9a51c4512000494750aab26459d7374_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/egress-router-cni-rhel8@sha256:55fa691e775ce7d116c9b28aeede76c37eb6f0f7c3f43292cbebfa32b7abc4db_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/kubevirt-csi-driver-rhel8@sha256:6a21c0bef886c25858d2762af63c33337f905c89975aabce818c547ef2afae1c_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/kubevirt-csi-driver-rhel8@sha256:b65cd3daa33b31d9ca5ac9b993e729fca37b71fb387d225afbbb6d3a60e59cef_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/kubevirt-csi-driver-rhel8@sha256:bc68274ea72c86450bf9dbe8d6b9d3b2de8ac237113fa914383034170005bbff_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/kubevirt-csi-driver-rhel8@sha256:fa7f9be37568b058d1aa220ebc75551ba875cad0db1d6bd00d49763ce5f13740_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/network-tools-rhel8@sha256:1387f092f719818ea91c2c6370ea5856d29c32532691791c4e2d2a5706b23d72_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/network-tools-rhel8@sha256:2d4cf3736d091e8fe40c83cc4675eca6bd3dfc6f12d1160ee104aa3364ea8807_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/network-tools-rhel8@sha256:8bcd63bfb177969dbf04ae1ce04083d33f7e0d1c0195e308e9650378ed7220aa_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/network-tools-rhel8@sha256:c04140d23662a04f9eb5502f142dc6cd8555bba38f6b3a06c755ad8a753604a6_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/oc-mirror-plugin-rhel8@sha256:278b6167e214992b2a40dd2fb44e8588f4a9ef100a70ec20cada58728350dd02_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/openshift-route-controller-manager-rhel8@sha256:882f9744bf88e268c11c875f67fe29aa52327e4e736e22ad4c959dfcba3f7f5c_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/openshift-route-controller-manager-rhel8@sha256:bfada38246104c2045d2b0e10988d9be27eacc2a151ac69911e36dff00e257ea_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/openshift-route-controller-manager-rhel8@sha256:c724af8fbd426cc921ffdba6f6e52e747688bdd677ad636ab0178656998d0042_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/openshift-route-controller-manager-rhel8@sha256:d257ed147e749c2aa7757b6a44baaa2196f11391e56da7f738a029f1eb99090f_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:2da4ee71fea34086a8faee62e27a35a3c3650b86f45d5b5c8abf95901e61a155_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:397dedb55ffdc3b7e9800fd7941720ef6b823a585baff667c6aa3e8ac929c260_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:de0f9fa9488eae6ea380795dd42006d1307f3a46a79dc80547499b58a5d9900d_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:f30dc53366aedfea8288d18ae6a57fa21ee84d82d4b843334cdbc9d683b5bbe6_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:a956488d295fe5a59c8663a4d9992b9b5d0950f510a7387dbbfb8d20fc5970ce (For s390x architecture) The image digest is sha256:9768dd5f5c79565da6e410de63429dc1b329a777d250047d37e474f70521c06e (For ppc64le architecture) The image digest is sha256:45a1e6f79a40ca205449936ba34c08cd4a1c4309453d85948ce91d7178a85be1 (For aarch64 architecture) The image digest is sha256:c8f6f564d2f840cf7b8785ae5c0aaeef01017a258a85be50945dc003485b83f7 All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected packages as soon as possible.

🔗 References (41)