RHSA-2023:6276HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.12.42 bug fix and security update

Published
November 8, 2023
Last Modified
July 31, 2026

🔗 CVE IDs covered (1)

CVE-2023-39325 →

📋 Description

CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

🎯 Affected products183

  • Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:b060f3241d092b830d03626d95b2b74d5f9b9ceda9a8a4b7ca4e897cc1d3acee_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:b197714e4e34d66b426522fe1af99472aaca9df34d5b083e393e7fa345385f7a_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:d302c5d4b64008c03942ef22cbcff76a6247d70cb0de665eab4a59cd25a43989_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:dc5d2d13999ad67fc2b026a5aece38a6a4ea7c729dc2a2c77fe75e1d7177a32b_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:0c4caecb2b0d79da4929a1292fdc142468144a5730e2a2fbfad1b51e8b7a0674_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:5f55a1cc443adf34be431ea549ccb2733980c137687e5e2b980d0198d11f2a35_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:6f19f1e7dabfc69dce757680f36b844caf7af410f3c55b8c6f1f6d723bcfd8ca_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:dea4124fb22457a207b281332d0d983783c71d847270b33475c0b64727513ca6_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-azure-disk-csi-driver-rhel8@sha256:69319692d56804dca91714c94b924c7b6d0dec9674d4c5fcda05e0d20d2458ed_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-azure-disk-csi-driver-rhel8@sha256:f3ae167a5f43f5793aebb4328e77393febabcee78dacb014168437df49c1a43c_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-baremetal-installer-rhel8@sha256:0340048abfcea83983213c109e2788f2ddea4b1ea5bab04fccee552d1ff59b87_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-baremetal-installer-rhel8@sha256:21805efefe1864df9c548048188b8f0017490da93201b76a379c650e792ba267_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-baremetal-installer-rhel8@sha256:40bb48404f2ddeae0110d2011c7b1b89f53e44aaedd82f825cd65361640b3d80_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-baremetal-installer-rhel8@sha256:a7271bf23466a5381b946ed263bfacafb6d6fce5f222968ed098f248c727ff64_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-baremetal-runtimecfg-rhel8@sha256:1d527f620acb0c191545ba5dac16f17ac85fbfd9b50389fc6079da4a83258f7a_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-baremetal-runtimecfg-rhel8@sha256:31f34675e71403b249762218a59bd7a25d4e4fc3aec22b4bffe987d771899ccb_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-baremetal-runtimecfg-rhel8@sha256:5ce7ea1d1b79951d3f7f6d43ec54236a04f78df48b5b79a3f1b4c38055729072_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-baremetal-runtimecfg-rhel8@sha256:641505f520ea7874ad74d2c8e422ab9b1303838723a1350b54d67fa29fbd499c_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator@sha256:14772b3532fefa63250ad00dc28bc2e5f30c9465d2058fde7c9d9dbed704bb3f_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator@sha256:22196dc3205bef59ae40c9fad5bbac47dad77488fa47cecc80edfa414ee92a03_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator@sha256:76a4d0a8b21e103d49dbc61ea485e38ab9b66c35135516a3bbc3e69e5e93422a_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator@sha256:b6ab890908a0a023ff8a42df61098460169d52b14992d59a21c52c6d83e5fd0d_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-cluster-etcd-rhel8-operator@sha256:173025cc8b91e5289f6a3d58162c313ddae4c857a711ac21459f08ab5378daab_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-cluster-etcd-rhel8-operator@sha256:44de63da1062ca1846d4ffd5581bd806768a32642b645cd545dbe9807d20fab0_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-cluster-etcd-rhel8-operator@sha256:481092c513c3632f85584649f14efe24fe36843d98ce6309cd8b5a3372346cd5_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-cluster-etcd-rhel8-operator@sha256:6a10c26c3280e128c4fcf96f216a16be03ed5a8a9c185817e553ecf575a7ea4b_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-cluster-ingress-operator@sha256:6ed8c26c6e9a22da177d3852b28b741dd8132f11894f078249be52bf0f925713_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-cluster-ingress-operator@sha256:89fda062c1ec57d348c2a700085dfd11c0c1287d85e1d07c648fab90d4807931_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-cluster-ingress-operator@sha256:d8d24d0b55ddc380843337e2c111f6478e94ba5ee3a5ecfab6d53989a89ef43c_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • +153 more not shown

✅ Remediation

For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:a52419c56d84f2953ddaa121e89a3d806902af4538503d8cf229b1e8a14f8902 (For s390x architecture) The image digest is sha256:8f0a556af3a78aaa24fc505162546739fee95b23eacbdc52414e48cd6d071200 (For ppc64le architecture) The image digest is sha256:69f9289f3a9d6880597b0a930661d1b8c3ec0e10a522ad407c54bf64a46a29aa (For aarch64 architecture) The image digest is sha256:c5b0ae94a49ee24de7b6f708deef747348b36e627c86f2d81114931930d94b98 All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (16)