RHSA-2023:5005HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.14.0 security and extras update

Published
October 31, 2023
Last Modified
August 2, 2026

🔗 CVE IDs covered (1)

CVE-2023-39325 →

📋 Description

CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

🎯 Affected products52

  • Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-ansible-operator@sha256:23ff614e800a60760894210950d10e849828b0ef047141105796b3493dba0c62_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-ansible-operator@sha256:7b7e6436f6c7d1c0bd95bd747f0a56b75957b2c7a7dc6a6da5f79b826e84199e_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-ansible-operator@sha256:8123084c9276f3ba07d108accd785f3a83d6a341a894ab6c0c9c60def8e71480_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-ansible-operator@sha256:d7bf6d2a4a4756d0fbd9c2af65212fa72397ef54d24b2d9987780e4b4feaec1c_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-cluster-capacity@sha256:3805d5832e52e625afc1ca688293c855e6d8f6adc9fbf9ad6ab3ab70e124d6bb_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-cluster-capacity@sha256:d4ef871ad4f0a2b7b6a64fece7de235e4e3d8b2dbc3700ecbe36c53d13ab3e50_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-cluster-capacity@sha256:e44e087aee91c1acfe7d6e8371afa0fb8b15fb6bb79d2ef9b481ad1fec9afdd6_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-cluster-capacity@sha256:f0e4fc2ee4bfe2400dee1f61232e485b16639caba43303f0e43b2bddb5f1eac4_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-csi-driver-shared-resource-mustgather-rhel8@sha256:1483d7366638eda5d7b13009021f7f42ece781e6d3ec691d16cb0ae9466468ea_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-csi-driver-shared-resource-mustgather-rhel8@sha256:2115c4d308539e3538955204738da54117f82e0b9a7e39196d0a32dd659c4d3d_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-csi-driver-shared-resource-mustgather-rhel8@sha256:43b6b6e761a2b6a2b197c35b6845a36118c4f568f97375fb91f49c7b2717fb89_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-csi-driver-shared-resource-mustgather-rhel8@sha256:eee0c52e5a7c56407a7dca88455f7b0aa32dddedfc21f4c50d919db679735216_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-egress-dns-proxy@sha256:81784d9b669cd24576d7d450105b3a270577c665d81ae26e2485dfc25ea41d82_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-egress-dns-proxy@sha256:98ec26354260a7d7a09322267981f9607814b3067a8311a217beae94f275a742_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-egress-dns-proxy@sha256:bb6e83f842d92379ddcd5e1a41e463ca9a7744a8f0b1f3276f177712ed5bdae9_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-egress-dns-proxy@sha256:f107c45a46ae54e3d0218fc8dcaefe6525180ed5304c1ff76ba94be5fe448831_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-egress-http-proxy@sha256:10d514f9daf187029c69b1c69b05f36442cee295582988c80c29f9514268de3b_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-egress-http-proxy@sha256:2a0f0527217d6342d4f2ef96748da1cd534305c24f7e62e1eb4fcea6e52eba82_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-egress-http-proxy@sha256:6eca1f041bb214af2e830a5ab48850f25cc39cf293d30a463c1c6f46e3c4bd5e_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-egress-http-proxy@sha256:a515bbaf11a14a7c497522d7019cc5196a6035346bac2bc35fb0af20e2386b44_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-egress-router@sha256:3691eeed5e178d44411d327a547685f89cb0e1a58753897fea367d339369a470_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-egress-router@sha256:619064d04f8ced541c85b1d9ed19ca10b3784ccfb5800bfb80486bfa2c2d0ddc_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-egress-router@sha256:90a19339a32b9bea590699a8a5437b015141f8cc692b3b4d43e3e6748d6a7ffe_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-egress-router@sha256:d57760cdfaab4346443711bbe3d6f4b992233b6870a66b77ce9a533fdb671ed9_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-helm-operator@sha256:b33c3225d7ed9dd7e4b42df40a4b6627f1889c6c4c71872ffe2abd8f30f2c229_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-helm-operator@sha256:c6ac1879d9e5fcb2c671f14ee03f76441a21ded88213e09fa59f9907d0e22bd0_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-helm-operator@sha256:daa2dc67235553c7af6744ce80dbf8baa088bf20464f3b46a30f785d165103b1_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-helm-operator@sha256:f99cea1fb4dd01302c50d7a09789dce63228cd25701365016514aea1e5923778_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-node-problem-detector-rhel8@sha256:2e2c6403eb0d67f7467be9c430707ee167bb8d2194ef1e2f031df343f00b29bc_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • +22 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (38)