RHSA-2023:7198CriticalCVSS 8.1

Red Hat Security Advisory: OpenShift Container Platform 4.15.0 bug fix and security update

Published
February 27, 2024
Last Modified
August 24, 2026

🔗 CVE IDs covered (13)

CVE-2023-48795 →CVE-2023-3978 →CVE-2023-26159 →CVE-2023-30551 →CVE-2023-39325 →CVE-2023-44487 →CVE-2023-45285 →CVE-2023-49569 →CVE-2023-37788 →CVE-2023-39326 →CVE-2023-40577 →CVE-2023-45142 →CVE-2023-47108 →

📋 Description

CVE-2023-3978 — golang.org/x/net/html: Cross site scripting CVE-2023-26159 — follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse() CVE-2023-30551 — rekor: compressed archives can result in OOM conditions CVE-2023-37788 — goproxy: Denial of service (DoS) via unspecified vectors. CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) CVE-2023-39326 — golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests CVE-2023-40577 — prometheus-alertmanager: UI is vulnerable to stored XSS via the /api/v1/alerts endpoint CVE-2023-44487 — HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) CVE-2023-45142 — opentelemetry: DoS vulnerability in otelhttp CVE-2023-45285 — golang: cmd/go: Protocol Fallback when fetching modules CVE-2023-47108 — opentelemetry-go-contrib: DoS vulnerability in otelgrpc due to unbound cardinality metrics CVE-2023-48795 — ssh: Prefix truncation attack on Binary Packet Protocol (BPP) CVE-2023-49569 — go-git: Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.15
  • openshift4/cloud-network-config-controller-rhel8@sha256:1b919d0d7cddccef32fa4a5c2fecba62b328022dfe3eb5e20778a292352301d9_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/cloud-network-config-controller-rhel8@sha256:a28a5f6cf2b69671c6d98a2fbbd297ff037aa49ce49140ded591246c633c4135_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/cloud-network-config-controller-rhel8@sha256:af50776f404a09db6930094ed6888f812dd0e0b96c026e1637c2aa5fc0a14e0b_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/cloud-network-config-controller-rhel8@sha256:d7866f76b1338bc8daa3207c95a86eacbe796c003f6251ac2f50dc082ca68a0b_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/driver-toolkit-rhel9@sha256:3297acf3a2464f7e6d07063ab1a30f74a0c245b40b7dd12142bbdfde561677de_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/driver-toolkit-rhel9@sha256:ac6a319d56cfe1d25a7e863762e05cfd8920c9dd77b8503c4bca620f45233fc3_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/driver-toolkit-rhel9@sha256:cd0ea5d8ec43c5b03bf362e0b595bafe3e97e222d4344a851453ebe8770df135_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/driver-toolkit-rhel9@sha256:e9063e8c733a875589bcc2c54a4d564be5400613aac0e38d7bb8962f36a12552_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/egress-router-cni-rhel8@sha256:1082e7c205f29034031ed11d3a45e53e9b98e7076a221d5c0bbc74d403938bc0_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/egress-router-cni-rhel8@sha256:5c970778d9e652b136cde1a98cceb10c0ca14bc8200e752659c4bc796c8f0fdc_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/egress-router-cni-rhel8@sha256:64067a887a7be14d295a2898a591eeeba5f3f409ee16cbf0ac8ff680eeb5ffda_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/egress-router-cni-rhel8@sha256:6c9d4266fc3a81515821436c68eac1e8e4e233fea923b8126998bf08038511af_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/kube-metrics-server-rhel8@sha256:07ed298ea2bc3f2bed40fa70bc664ca85042ca17060491898c1c7adc54b88591_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/kube-metrics-server-rhel8@sha256:7afa7f270d0901d4055675e25d8da1b5be78bca0ee6ef3699f51acce48d9cca5_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/kube-metrics-server-rhel8@sha256:971eba9b22e1b6a21371607cf51da2673537ea186d7cef446d549adf334dfc8b_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/kube-metrics-server-rhel8@sha256:d8723f662b71c33f6d37c81b2e9c04e2eaa803f44c1c331d38e735686c6157a3_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/kubevirt-csi-driver-rhel8@sha256:6775f84037a9951be7e2cdd569e379d35e157afe1c0c498d99bfab1ff1e614fe_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/kubevirt-csi-driver-rhel8@sha256:755c08ed2a02c0218f3ab49fa6c61e743534065944ea0331f91bf5a32d339fbb_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/kubevirt-csi-driver-rhel8@sha256:a6d27a74f471e1e57189eb75a7ebe7bc2c6c705cadaf32d1e95a57070735c897_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/kubevirt-csi-driver-rhel8@sha256:c010f869946b5496369a57bf809a93bed2b3bf7c0f3f6f7d4f53a53c48ff63b9_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:04b4d43c1a1e1cf3b4b7ecf87d3a4028439066b3ca1279945281d15f2babd02a_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:ac8002330eb2647810fba50e38c88e3232dd587faddd078bf6cf9c292a19d1ae_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:b60dff3858234841eef3727701704f4c51c05b2a600835716a64c7864e58cc41_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:bf37735695c16ad649c9fd8c81dd11b060c59ab9684d3dfbc5760d394f447d3f_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/oc-mirror-plugin-rhel8@sha256:396d7399f8dd7840e2ad9a416b66f339826d0335f7d7ea9705e8f221a21083c6_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/oc-mirror-plugin-rhel8@sha256:6ad7034391ed4cb580ec141679a53b5d6bb3d48f4e24b71feb70bfd4889c3e6b_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/oc-mirror-plugin-rhel8@sha256:91a968f0a6f1046e14033eccf9eae86710c34f76e1da47a386024048717ce415_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/oc-mirror-plugin-rhel8@sha256:a2f70851a23cb19bc979e26cf2d7e9ac148a506e6d02ea6e2a9be09dd347c7c9_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/openshift-route-controller-manager-rhel8@sha256:1874ff7aa11a5eff979ca4b6d47898db56a3c3ff8c3aa6762beffb265ea589db_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.15/release_notes/ocp-4-15-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:0da6316466d60a3a4535d5fed3589feb0391989982fba59d47d4c729912d6363 (For s390x architecture) The image digest is sha256:8dd9ec7f5d7d7990cf66182960dc6bbf4815295f5b252e3ae3e38b5f0f65ace1 (For ppc64le architecture) The image digest is sha256:26674d2dad3e80fe0e34af948bba02f5ea93ae505180e3224177b913049103ba (For aarch64 architecture) The image digest is sha256:41d64cadd215782ebdfb54706481c5b70f8551522377849945d353771fdfe51a All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.15/updating/updating_a_cluster/updating-cluster-cli.html Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2. Workaround: No mitigation is available for this flaw. Workaround: Users can setup a reverse proxy in front of the Alertmanager web server to forbid access to the /api/v1/alerts endpoint. Workaround: Users are strongly urged to update their software as soon as fixes are available. There are several mitigation approaches for this flaw. 1. If circumstances permit, users may disable http2 endpoints to circumvent the flaw altogether until a fix is available. 2. IP-based blocking or flood protection and rate control tools may be used at network endpoints to filter incoming traffic. 3. Several package specific mitigations are also available. a. nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ b. netty: https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p c. haproxy: https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487 d. nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg e. golang: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2. Workaround: As a workaround to stop being affected otelhttp.WithFilter() can be used. For convenience and safe usage of this library, it should by default mark with the label unknown non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it. The other possibility is to disable HTTP metrics instrumentation by passing otelhttp.WithMeterProvider option with noop.NewMeterProvider. Workaround: This issue only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off). In order to mitigate this, keep GOPROXY with default values and use a module proxy. This vulnerability is not explored with default GOPROXY value. Workaround: As a workaround, use a view removing the attributes. Another possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider. Workaround: Update to the last version and check that client and server provide kex pseudo-algorithms indicating usage of the updated version of the protocol which is protected from the attack. If "[email protected]" is provided by clients and "[email protected]" is in the server's reply, no other steps are necessary. Disabling ciphers if necessary: If "[email protected]" is not provided by clients or "[email protected]" is absent in the server's reply, you can disable the following ciphers and HMACs as a workaround on RHEL-8 and RHEL-9: 1. [email protected] 2. [email protected] 3. [email protected] 4. [email protected] 5. [email protected] To do that through crypto-policies, one can apply a subpolicy with the following content: ``` cipher@SSH = -CHACHA20-POLY1305 ssh_etm = 0 ``` e.g., by putting these lines into `/etc/crypto-policies/policies/modules/CVE-2023-48795.pmod`, applying the resulting subpolicy with `update-crypto-policies --set $(update-crypto-policies --show):CVE-2023-48795` and restarting openssh server. One can verify that the changes are in effect by ensuring the ciphers listed above are missing from both `/etc/crypto-policies/back-ends/openssh.config` and `/etc/crypto-policies/back-ends/opensshserver.config`. For more details on using crypto-policies, please refer to https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/security_hardening/using-the-system-wide-cryptographic-policies_security-hardening Note that this procedure does limit the interoperability of the host and is only suggested as a temporary mitigation until the issue is fully resolved with an update. For RHEL-7: We can recommend to use strict MACs and Ciphers on RHEL7 in both files /etc/ssh/ssh_config and /etc/ssh/sshd_config. Below strict set of Ciphers and MACs can be used as mitigation for RHEL 7. ``` Ciphers aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected] MACs [email protected],[email protected],hmac-sha2-256,hmac-sha2-512 ``` - For Openshift Container Platform 4: Please refer the KCS[1] document for verifying the fix in RHCOS. [1] https://access.redhat.com/solutions/7071748 Workaround: In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.

🔗 References (1064)