RHSA-2023:6156HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift support for Windows Containers 8.1.0 security update

Published
October 30, 2023
Last Modified
August 22, 2026

🔗 CVE IDs covered (2)

CVE-2023-2431 →CVE-2023-39325 →

📋 Description

CVE-2023-2431 — kubernetes: Bypass of seccomp profile enforcement CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

🎯 Affected products3

  • Red Hat OpenShift Container Platform 4.13
  • openshift4-wincw/windows-machine-config-operator-bundle@sha256:ee24ac6ea9ba7c1067327d66b421815f88acff31165e07256de322bd02df4910_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4-wincw/windows-machine-config-rhel9-operator@sha256:6238c841ed9684453ac6167a666269e16175d724fd3a7c34b230dbf7244932de_amd64 as a component of Red Hat OpenShift Container Platform 4.13

✅ Remediation

For Windows Machine Config Operator upgrades, see the following documentation: https://docs.openshift.com/container-platform/latest/windows_containers/windows-node-upgrades.html Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (17)