RHSA-2023:5672HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.13.17 bug fix and security update

Published
October 17, 2023
Last Modified
August 24, 2026

🔗 CVE IDs covered (3)

CVE-2023-39325 →CVE-2022-41723 →CVE-2023-3153 →

📋 Description

CVE-2022-41723 — golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding CVE-2023-3153 — ovn: service monitor MAC flow is not rate limited CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.13
  • openshift4/cloud-network-config-controller-rhel8@sha256:052757e20cf20a27e2d7fa60533b8373fc16873552cddc6549e0a644ef303b0c_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/cloud-network-config-controller-rhel8@sha256:1370b62a7848f01c8b6ca04d9280f23bbf66cb7dd5f4951baeaa1dc5fc78617d_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/cloud-network-config-controller-rhel8@sha256:408d5dc77fa17ea4b51450051b860bc2400598effa9d4da236d9d747f7252294_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/cloud-network-config-controller-rhel8@sha256:d18999d581e71527782027b5d17bf2db8382ef69e1eee85579ae2982c1877210_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/driver-toolkit-rhel9@sha256:3561df2ae7b845504f98b72f00db06c2e052159397e275ac115ca937c4c32e7d_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/driver-toolkit-rhel9@sha256:6e098f5a3eb7d986fccee972ca5ed6a29bfac42b5d7f93c50207c4beabb66b44_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/driver-toolkit-rhel9@sha256:ca2ae3c8c06c0da4751375118bc200e08395de4ea9e2dceb49946eb3932e7aa0_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/driver-toolkit-rhel9@sha256:ebd6ba42130ffede214055be24e5bdec5caafb5a87fac437edec7cc0dc1ccc23_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/egress-router-cni-rhel8@sha256:21fbedc06046752d4cbe02c1c8528bbf69f5e524eb29051eef047837270fdd01_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/egress-router-cni-rhel8@sha256:5d83d78b424ea799b0737ed789011bb4c288a79237ce32f5230900e283861017_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/egress-router-cni-rhel8@sha256:863c16e3a64d13fe373df8e1bc7bd4da64427c182498d731d0b1eba0e7a2faea_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/egress-router-cni-rhel8@sha256:d134648f6af1346a6de5da49f9dc4809810493433410babbc951c0d08ea59e87_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/kubevirt-csi-driver-rhel8@sha256:12b9847faa4f04b8dee3eda0ee54191ab8ff2f6b84090bfce143832c9d5014da_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/kubevirt-csi-driver-rhel8@sha256:45f5853d79f69e736a28daa28569325b0c689254df6fb8177bdbab3ba2aaf6d0_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/kubevirt-csi-driver-rhel8@sha256:94394e00336a8ccad139ea44292c3f5efcb6192b5f0e768782003eabbca508be_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/kubevirt-csi-driver-rhel8@sha256:fc681ab6231387c819bcbc5664de12d0fa25cdc7d63d97ab397be72a20907910_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/network-tools-rhel8@sha256:553e6f59c64b1655d57eabed3ecbda91b054f18d00afee8a4826542bdb491417_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/network-tools-rhel8@sha256:deba49d1a81aa70fb6aa15356057123646396fd1f9e8415e92e3cec20bd990e1_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/network-tools-rhel8@sha256:f66cc31c18e193a51ba617d6bbb61048688f0baf2717cba3e78b722ec5a733cf_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/network-tools-rhel8@sha256:f887fe1d40d1f18e6a3e1d9c79cc1cd5fa44bd675fc76f562181c1c94d6b17c5_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/oc-mirror-plugin-rhel8@sha256:ee43bc6f5bd8a0ce87ffa2fd854a85396d2868ea36350752850547d0c3409114_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/openshift-route-controller-manager-rhel8@sha256:29f9eb041f9110452ccc58eed774a2fa7df13d94cea31156ba3a40f98fc71081_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/openshift-route-controller-manager-rhel8@sha256:7808c51803676318709a4328dc86eed0a331dc183114d428d8d288c21b7c33b1_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/openshift-route-controller-manager-rhel8@sha256:7feefa32ed880bcaa058cfd482d13cb0e900ade78deff36ac1cd6b926f8898ba_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/openshift-route-controller-manager-rhel8@sha256:910adbac281c50d563eac4b1f9fc56955ddfb2668254435f8f6dfca61acd8b32_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:06b9c92de3338853836cedeabb5e0a1e607649dcd3385d485a69371228fd81ce_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:1001feb54bdf0469355478d16ee4ea41c0564bc2a3b43f37639518a882d5644e_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:9e0c095ab38ddd9011dc9b1e019323d951f5800df165732a3e3738dc26608b83_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:b10fcfd0ef7a15c516ed11d69c8789d7b10fc7ac47df3e6db499b1f76e805fd7_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:c1f2fa2170c02869484a4e049132128e216a363634d38abf292eef181e93b692 (For s390x architecture) The image digest is sha256:0902c17eeab84343a97782e1ab213dc49e416c032c24c3778b19b42744ecc1ce (For ppc64le architecture) The image digest is sha256:5bf008feaf16985474ee73cd0d421284850e160415353ad3d99d79ecfbf33fef (For aarch64 architecture) The image digest is sha256:2fc4809d78f95c943010227351c101c4b5d6a9572f3b4d51b3a90c803ff1242c All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (35)