RHSA-2023:5677HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.12.39 bug fix and security update

Published
October 18, 2023
Last Modified
August 2, 2026

🔗 CVE IDs covered (1)

CVE-2023-39325 →

📋 Description

CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.12
  • openshift4/cloud-network-config-controller-rhel8@sha256:2c06e20c40e64f653c47979b4303c2ec6259751283b7d53d9ca91a7638f0e8c4_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/cloud-network-config-controller-rhel8@sha256:9ef5b0defabdbd62baa167798690acf0c6af45e2f28e5279ca9e167502bdec01_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/cloud-network-config-controller-rhel8@sha256:de3818f5bc9b598e4273a796fb7462b48179f70f068c16d49e7e3a03a2c0f9a2_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/cloud-network-config-controller-rhel8@sha256:f485d6a5d6be884fc7c9d15b1ca1aae2168f443f794bc6b914e75bec5b4d1b46_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:73bb08b1d2235c01b6a9d5e8d462fd0c7e02831685b11ef04630767f7a480c1a_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:9b86cf71a6dd31463ceffef7855dd74bfa67d53342cc515a80082f3bb91f1371_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:c04404f2afb6b65c232b61dd9acac0baf0ce0371dd7b74a452ab3c80d7a6bd96_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:c6028d79687f87d4bd78d3dbcd582b5b4d20952c74cf7536299fe3bf71a46287_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/egress-router-cni-rhel8@sha256:5c0d8f8a18d25ea1bba6cad879aa1922b44e9bb0b0a736be4d699314ef9e1b4b_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/egress-router-cni-rhel8@sha256:604b4dfb6cc5b0b4d4203d72e36be89e40d7aff757eaa64fa3ec774e4959ea54_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/egress-router-cni-rhel8@sha256:8b5c266f08138691f5b03c422fe7d9cc2701bffeae32f2e672f83f897d6f806a_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/egress-router-cni-rhel8@sha256:93ecea19a74bdb996e82fd32b32f70ec54219a03408e14fe9b20eb80f48df1b9_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/kubevirt-csi-driver-rhel8@sha256:0ff06d14e2b0e2f4b5391634f9dcfbb071c7e242930816dfa3bfa250a60510c2_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/kubevirt-csi-driver-rhel8@sha256:a17c1d57c14151cf1bbdaf57b460dc03bec5ca0f06115280dcb072a8318d11c9_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/kubevirt-csi-driver-rhel8@sha256:e53a501145a39687189cc152c7d999b906ae1173b1e22ea5a30d5896dbab55fa_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/kubevirt-csi-driver-rhel8@sha256:fec8c847933f056db834df60a7688769b71c2c346b917b3a8830aaedd481417e_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:0ae06696335d6b8a835dc4735ac07857374e0b977be0244c0caea2da0b56aac4_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:37ff47451c8f971a3f17b5ab11ad202a71ca4271dd024bc6be096345b8da8c7d_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:abe35526307b02871c6fcfc1e06e61511f282c1cb5388fb666e8b1e5780d3025_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:e09282b881945f301ccd9dc35c8f794a75f3e0902936900b1bcf7aac92d016a4_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/oc-mirror-plugin-rhel8@sha256:486058655245cd3ccc5f7108471ef71b7d1052af964ec3cde4bbe392c58be7e4_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/openshift-route-controller-manager-rhel8@sha256:1a08e5237d7b22b34a628de79fd430c6f5052474154e1d225061fbf197a1b767_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/openshift-route-controller-manager-rhel8@sha256:318427a9ed46f91b9725bbdcbbbc0fb5beaff14e0b21e79cce468fee13a59523_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/openshift-route-controller-manager-rhel8@sha256:3e3867e9bf674b4fbcf9724353329ab6ff3485af047dce5d637ed4c96d545625_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/openshift-route-controller-manager-rhel8@sha256:46051d4ff8a5b9e6493e19646defb228a8ab27bfd3c1223ef8aec662e2a8697e_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:0880403812592f51fcb19a8d42824b10050b8966f6cb023da69b9b70092badda_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:146fd71735e327c31d6efdbb7aa3a8415a88099d877abaf499fba67b03cf394d_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:4d640b647d43ea33744360fe481e7bc71e7549d5cc30169a64096b4e3c91cbab_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:a69ae5ce9014b150ce1e4ede4cceffc84453b17a14e4d74b4a28dff78fd678a6_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:75687feb6344caeb0edb6b1513b53fd07b90b481079415b6545d860fe74059eb (For s390x architecture) The image digest is sha256:afe5528a62115908f293e0f6030483624c79efd3fcc6f9705b734a7fb3ef7576 (For ppc64le architecture) The image digest is sha256:3b0611f03d5561f179e58080a80bd7db53965794ca597a12e55d83c59833a683 (For aarch64 architecture) The image digest is sha256:72008386ad6a2ac1ceb59b86116ea23d98e7be8685698e9375b9370d9adfb770 All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (23)