RHSA-2023:6126HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.12.41 bug fix and security update

Published
November 1, 2023
Last Modified
July 31, 2026

🔗 CVE IDs covered (1)

CVE-2023-39325 →

📋 Description

CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.12
  • openshift4/cloud-network-config-controller-rhel8@sha256:52e8a8f398ff627ea52ce0153f3a9008764251892d53158dd045ea8ea105ca4f_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/cloud-network-config-controller-rhel8@sha256:bdfa71b7f5121d181c8b4466efd0bd5945e2db1c666f2a58313c2c383b2b9f54_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/cloud-network-config-controller-rhel8@sha256:e8e45e589d45aa063846ec7ecace171e9b52e238df6a4a712c5d8310a62162b6_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/cloud-network-config-controller-rhel8@sha256:ffdbd10029edae6ee4a18aa753c782db3746047a8725344eb59f4d0074a24581_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:1b9940a954f67d1bad3d71678c98856ec0d15309c36a45c4eb69266adcce11da_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:1effdd3ade55fcc1f7b00412a14be70461f994560b53e746575c1e7ed2969bb9_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:a748c4f19b62c0ec10e5c5b547ed022aa7ebcc16aa4e32181898ed84ff6294df_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:d677d28622fe7688d3fdb726a1fe87cbb7a68ec1199b320d8233eb8c63e4ab64_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/egress-router-cni-rhel8@sha256:2ce790b8da8653a78d63928e1b05d4eb7822922f1865053cea69edb56a210f68_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/egress-router-cni-rhel8@sha256:6396c10160fa19ac9d908fed355b4841e83bf4abfa7cbbbf1555daec4812f54f_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/egress-router-cni-rhel8@sha256:8088d3bc1839b3a3d012aab6c808f5a5c59d48e47a892357aef001a21238af27_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/egress-router-cni-rhel8@sha256:e1b21eb80f5cfbaad1c6fcbf5561a82644d4f759de0944e506e38487e688c322_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/kubevirt-csi-driver-rhel8@sha256:3cb4a77a2fa754f65eb6560f4b1b95a99a986212e708753ee195d0477047536d_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/kubevirt-csi-driver-rhel8@sha256:560f10170c23416e6bfe5e9251361c4c2e8463beb39c485e5a908b11d104ae91_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/kubevirt-csi-driver-rhel8@sha256:8c3e883186d7cc009e931e64972391748cdff760aaa2f5026aee2179f07b3a2a_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/kubevirt-csi-driver-rhel8@sha256:c7ca6a906c80626382b9daf18fe8422f1e9967dab6bd8c71e85cd1a690ff4ea7_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:0d55c54ca67290b1055b4747ecc5e08d4d34fd0201e818d133f4f2ecaa3b1eea_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:1a366d3cd59d3ea0ad4159e3441b644e2b49a0c94611ab50f01cf0ef74bee8cf_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:75bfa585bb8db72a2dfa8f60a67a6fe9457af5ba3212ceb50af6ba7e6b1fcecd_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:ed8bf4cb3b94fc884cffc134e8fdc8d2a3e125eba77b989a269587e68dcf8032_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/oc-mirror-plugin-rhel8@sha256:eef3a90c29fe505d90d26a73c3500cac4537a62d254cd9058ad3ca0f423f06d2_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/openshift-route-controller-manager-rhel8@sha256:39478af944e08ed38d3df4f11a3571e5fe9b8ffb09055dd2d05b7950f5c9d9f3_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/openshift-route-controller-manager-rhel8@sha256:55b70e4402f72695addbe97fae8e1c2d4d9a41bb0a229c2ed5f78d9f7f106038_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/openshift-route-controller-manager-rhel8@sha256:6472a8a786f0c1d400ffc7ec65094e35d9c9b82e3350b61250b0e16fd53cc7a2_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/openshift-route-controller-manager-rhel8@sha256:7c339ebf85fa1633917aeb2b8837f31420d1bed06ce03a54b6fad7a2e7e92e59_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:180282880d8ad9375de4c568a1c3e0ec3fb6d415f062858d27109710d7d6f91e_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:35f478c6cb9a1aabbe95d548ea493fa0caa92be213034d03c2e08769e59b17e5_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:9eb129a40c54bacaf181119d205508cfccd87fcdbfbcd51e492f152ee3d2688a_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:ca0080774493591fea76e9129f0d1780f14d7abd800cf507ddf32056d1a32557_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:59c93fdfff4ecca2ca6d6bb0ec722bca2bb08152252ae10ce486a9fc80c82dcf (For s390x architecture) The image digest is sha256:0335f61734157940c643422460317372128b2eb8ed1523729a150e3600c2f7b7 (For ppc64le architecture) The image digest is sha256:fc6c5ab43a800cde1afbdf1a63f24a19f49282e51461c936b3a096b453956597 (For aarch64 architecture) The image digest is sha256:46da6987f277e8837e0d7223bfa9bbe646173021c374809b4f5021051d573782 All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (19)