RHSA-2023:7475HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.13.24 bug fix and security update

Published
November 29, 2023
Last Modified
July 31, 2026

🔗 CVE IDs covered (1)

CVE-2023-39325 →

📋 Description

CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.13
  • openshift4/cloud-network-config-controller-rhel8@sha256:4c10bdfcefe4c4816b13abc571b4feb40184dd32aa60255c35f87cc316b1a0bf_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/cloud-network-config-controller-rhel8@sha256:7c49f585922db4fa81bae368be51170ebea600f815fa60059482083a44920185_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/cloud-network-config-controller-rhel8@sha256:dab7c6755399249e2f49f9009d15e330a4bd23bb893226df509fb3d68670cbce_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/cloud-network-config-controller-rhel8@sha256:ed8c6b0d696a5cb9ffa4003bc1495341ddc40bff1f796729814fc39c04ef8122_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/driver-toolkit-rhel9@sha256:4201f071b8501254c47cd59eb52811acc8b885d954c2b8bd76dd6ab108b3246c_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/driver-toolkit-rhel9@sha256:52da2e2fefa39cb32db322942daa12eade38f1ccce78b5c4489c3842be03c98e_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/driver-toolkit-rhel9@sha256:e118f6bb6b4b79559bd87670120501d49e75f1766b3fa30eec41f893117701fb_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/driver-toolkit-rhel9@sha256:f30a5ab2841b5c7aed558acf855fc6f25276e9fb61decb9cb654ab43ad2fd87a_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/egress-router-cni-rhel8@sha256:0563ac034429269f74fbc9f9009976588b8236255c04ee3df1eed935f065c412_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/egress-router-cni-rhel8@sha256:66a9eec784b405740846c9198513dbb561d9c183061981a60f20d5933289a364_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/egress-router-cni-rhel8@sha256:8ff7761dd0bcf34489463c7d0027a0ce6866ba1200d96fd890f2415f2dedccb2_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/egress-router-cni-rhel8@sha256:fcc47456b63f05b6fa8c6dd4f229433b40039e84afe0bcadda676da461bd94aa_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/kubevirt-csi-driver-rhel8@sha256:41a21fd07ae9800e4f3671149b94ee0a077230c78959c233dc52f28658bcff7a_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/kubevirt-csi-driver-rhel8@sha256:cc736903ee9b015e1a720f4908ba418050632beae75cf70c9e4d4f8b676a899b_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/kubevirt-csi-driver-rhel8@sha256:e4cc1c83fea2bcee27e015d5ff9d39c852b29f995f43d685370be3694d7e6f5a_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/kubevirt-csi-driver-rhel8@sha256:f6e5bb54c276da493b533718e6ae8f4e01a014e8debeb608083de0214dd628c3_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/network-tools-rhel8@sha256:453a9833aa686ca6872b02e56c81c05cbe999d69c811adc97d3ad911eb76d79a_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/network-tools-rhel8@sha256:484c7c0945cf6f859d106e42c3699eeec2abf07e4fe893ff4ce382ddb86d7343_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/network-tools-rhel8@sha256:53be2907c8410df8e2ab709614a4f31467e72912c1fc5b63fc29e867de8cde1d_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/network-tools-rhel8@sha256:74d8652cbf3e961a088788d63b781d7682621b5775b1a1c3ac7afb6fd8195a07_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/oc-mirror-plugin-rhel8@sha256:2eac99c480d9ee5009d467533b2da0afd7a41c3afd815942fdefba513d0f6bfc_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/openshift-route-controller-manager-rhel8@sha256:1da6f527a3c92169a35dee17ab205063db6afdf547c6fab51407170e39cec6a7_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/openshift-route-controller-manager-rhel8@sha256:7e63aa59704c1f16365a7457cf88d8da6db7c32aa11a1702e2bdf104ba2c656a_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/openshift-route-controller-manager-rhel8@sha256:805e500fc6164b010f368433f071a427454a502918866511788f31be97271a51_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/openshift-route-controller-manager-rhel8@sha256:f35baab27474bbd0bd183bf0de9c8dbb7259b2de9e0ab2952d98bcb01dd00553_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:2c551c94d38d4ec3ce39e5773dca52d657602ebb5a65399a12c8e0ff8d7b9faa_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:65051167c011a18856a71f7b6b01558a202e6021dd729ef66bff28c9a69c7586_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:7f2401135c49d4516546652b368db39d3fa7c15456221441f24824b8ee7ebd63_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:dffa42eb743b82b0f0d2d958e2a6a6dd157a732acbcb1f078926ae0b90464912_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:d6a7e20a8929a3ad985373f05472ea64bada8ff46f0beb89e1b6d04919affde3 (For s390x architecture) The image digest is sha256:b32acea02af9dec3acb15791c08f9982f96a55cfc6bc4f8e017148b89261903f (For ppc64le architecture) The image digest is sha256:5b7b8011a588ed60b8605f0ebe7c7a1333ee2578efc5666bf7325cc9a5ee3f8e (For aarch64 architecture) The image digest is sha256:93629dfeb4ad1128dfa5f39df9d11bdfcb20c3e85f7e59a56301167bc4894199 All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (14)