RHSA-2023:4671MediumCVSS 7.3

Red Hat Security Advisory: OpenShift Container Platform 4.12.30 bug fix and security update

Published
August 23, 2023
Last Modified
August 4, 2026

🔗 CVE IDs covered (1)

CVE-2023-25173 →

📋 Description

CVE-2023-25173 — containerd: Supplementary groups are not set up properly

🎯 Affected products80

  • Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:03ada3a0e70f2a72463ead4311cac565ea73582b03d37b92edc3bfe161a669b6_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:10994dcbcdccbcdbc7e43eb4603129b35975649738b7628088bca206ecfe57af_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:21bf509f0936fbc30894ba6e06a4bc0182741f5bcedfc3d947ca344b2731b0aa_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:fffc2a56fffbbea190312dcaf8b982c3390f008ab7b7b931dd0dac6ffdb3e12b_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:6f8f37a510910170c57385e3b51ac0a843c4a5e16f35cc45f56a1733ce10d57f_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:8e094f31ba3c6f02e6360eae92e95b78b9cba419dea6084a40d7f7d078b671fd_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:b5c9fdabc4c9d9c54d544bcdba3de45a6c541468baf24d01839c6c1b32599da8_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:d2948eafa90f6374cc6464e24175a046f9916274fa0ab84bb3bc5494daab3b71_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:3ba46df16b20320da4435b604d893b003c66708374252b5aabdb271af1722be0_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:5e59981fb46ac9b3f5d8c9a9e47256f7f003fdc7b2ec6d6f8d848adb8aaa363b_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:873a3c9aa5ce89c09173fe6849f4e1005bce2b667247ab7b9f8ae027f3867ccb_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:a495e8ad1305312bb4d763601681e51e85427c82667163a6dfcb3f55ba29ccf6_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-baremetal-installer-rhel8@sha256:4507c2b1b193f7123bf0d1b647b940a0b828160e3df5ef8cabaa4a3061fa5b2e_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-baremetal-installer-rhel8@sha256:67424ab04ef29de4afca7898441d64558879a5fb97d8e6f7f1d83fc08ce3baea_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-baremetal-installer-rhel8@sha256:94d7d93d84e63db2ea61af785ea944e6119ebc1abdbe1078a89e5bb56e0e9dc8_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-baremetal-installer-rhel8@sha256:a6ee7a3c62a4c6b1f075079be236f64dc47883b1910b8b298d31af02e99c0908_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-cli-artifacts@sha256:389255f45ee5dc8db1d80e38d33ef1349e551e1f8610cf849498bd4b26d497da_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-cli-artifacts@sha256:82cfef9eb01dd30443fd2621faa6fdfcfe6988b4a41e390b0c88c163d168e9f3_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-cli-artifacts@sha256:e6089b2a5b66eb7507f209a520da7009ff84fb7bfa1e3624247e709e41b2adf4_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-cli-artifacts@sha256:f6d37eb88da116502ddfe1a98c4e867f5ce19007c16c6e1a03fdee79e5c7a4da_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-cli@sha256:4b3ca71ba8ef8196acbf87d200116479a9b40e8b28158956d7bb18ed8c082c7f_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-cli@sha256:88b0d2971ed67a8f2e3dbd7885cf248c32cafa57b10a4dbc1e6f36c5190392c7_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-cli@sha256:8b28fc5d21645b1368f29c610d93ebba192ab8cb76446a858736ae37ac6c8904_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-cli@sha256:d4796bef1bfa60edf7ba9d4839a63e4dbf79384d9f4688aed5e62459d138352d_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-cluster-bootstrap@sha256:261523d459b823904bee3005b26b9ce56854cfe1a3bdd56fb1d49ead200af872_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-cluster-bootstrap@sha256:7376fdd05c85be44e1e003ab4e2a10ae0fb2b5a06d000ce57f5894b064270b31_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-cluster-bootstrap@sha256:b5ad8d6b99636aa3ed2ac05b4241ccab3b73d082ee0c1987b0298d43bc396642_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-cluster-bootstrap@sha256:be3eb15dcfd3b2d0dc963678bae743a4f175280d0e336d99a3367b13530d5386_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-console@sha256:04cf1f8f0edb8d3e16b6f8bf8c688871318077869020ac1abe923e6c077c8023_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • +50 more not shown

✅ Remediation

For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:86ee723d4dc2a83f836232d1d03f8b4193940c50a2636ee86924acb5d14b0b64 (For s390x architecture) The image digest is sha256:c6e023eaa4e80a044bbaeaed5b578d18afddf0b52ad12571ee3a42aa0ff5862a (For ppc64le architecture) The image digest is sha256:0a1dbd83d0552d0332c327d9bd9b1fce8ed73d89937178208d29a73276b72c1c (For aarch64 architecture) The image digest is sha256:21145f1df3c0e88d50de5c697d7fab316f4792f91320a7196ed0dfd94396c0d9 All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html

🔗 References (10)