RHSA-2023:7478HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.11.54 security and extras update

Published
November 29, 2023
Last Modified
July 31, 2026

🔗 CVE IDs covered (1)

CVE-2023-39325 →

📋 Description

CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

🎯 Affected products170

  • Red Hat OpenShift Container Platform 4.11
  • openshift-tech-preview/metallb-rhel8@sha256:71d9eff03b414652e86b3903c49772534b1767d64e21d1c67358dc7f3a49382d_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift-tech-preview/metallb-rhel8@sha256:803f136b7e04ddbbaaea1d4efe7df98eaa1bd64684a5ef8a9e3aaadf731562a1_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift-tech-preview/metallb-rhel8@sha256:9f2bf73eb06b6cafc0d45878ce7d8bdb2cdbf4740d69aeef2fdf09bf4f352795_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift-tech-preview/metallb-rhel8@sha256:eadb330d8ce7d98ca8d3bd3a89c962d2741155e5c8b0a0557351bfc15cd6dc5d_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/cloud-event-proxy-rhel8@sha256:1d192d4b5e6003eda89c1e13c66fe687243e079a401935217b0796d51c0046a5_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/cloud-event-proxy-rhel8@sha256:85a568f180fd3947b7a8911720285b2de664927d704e5f33e8bba48d6a3df691_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/cloud-event-proxy-rhel8@sha256:dd51a84acc45fa064e342b5f5756f261b8fec326e6e52c17e2506d346323990f_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/dpu-network-rhel8-operator@sha256:45d1dfa916d69737357f6b4417fcaf0d44264ae6e88335b209d6dcfdcab13001_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/dpu-network-rhel8-operator@sha256:47de8d19b54f1291bb6a5e482191ad94f09bce299a3d918a82c6b7fd7f261382_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/frr-rhel8@sha256:508043b5dd3f16ff52ea98f577bcedae434ce6d2e369b2fe4d47ab13c1a5194c_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/frr-rhel8@sha256:71691415b5ab006d4c25a7b6e596e555ffa80c3a51c758148d114bd2c10a6406_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/frr-rhel8@sha256:9fd8e4d77ede743206acc617a48c35ca5d822c598909fc9f54229a8d42a425ae_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/frr-rhel8@sha256:efa5697c1296aab1d1fcd92fb7ea22fb746c618f597a01c0025b2a99e356cff3_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/kubernetes-nmstate-rhel8-operator@sha256:847a3ac98523b8fce37b3e7c762c70c2e6e07e76adbef363a3906c4643987aff_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/kubernetes-nmstate-rhel8-operator@sha256:91176dacae6f05b58e6c6dd5724b7a0309e54e0078e8f6923a4e81c84ed777c7_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/kubernetes-nmstate-rhel8-operator@sha256:d685842b2545440e7ea8678533948de464ef457235ab95d02388e064c1e170b1_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/kubernetes-nmstate-rhel8-operator@sha256:d6ab69b9069dfca83e1b03ebfe41b9e3f5cf2aff2abd9ea7d0894d8b4624aaa9_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/metallb-rhel8-operator@sha256:01411cdf8d4baba42a8f1f8e9e0432af43ea039391d272739a22a28841e26cce_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/metallb-rhel8-operator@sha256:35418929fb6193ce7574f70aa3365fb5003b16a0aeb319973f8530a1aa489cf1_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/metallb-rhel8-operator@sha256:51bc7fa9fdac43bee4be1f976b60fad13ac6a741744790007de8187de9eb567f_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/metallb-rhel8-operator@sha256:637e5ea2cdf0179e07f2fbc806719846ca00ecb88207aee9d7bea01c75554298_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/metallb-rhel8@sha256:71d9eff03b414652e86b3903c49772534b1767d64e21d1c67358dc7f3a49382d_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/metallb-rhel8@sha256:803f136b7e04ddbbaaea1d4efe7df98eaa1bd64684a5ef8a9e3aaadf731562a1_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/metallb-rhel8@sha256:9f2bf73eb06b6cafc0d45878ce7d8bdb2cdbf4740d69aeef2fdf09bf4f352795_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/metallb-rhel8@sha256:eadb330d8ce7d98ca8d3bd3a89c962d2741155e5c8b0a0557351bfc15cd6dc5d_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-ansible-operator@sha256:244b76eedb73e185c1967099bc16ca1b355b2f0c35b7c842e1e9393204516907_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-ansible-operator@sha256:2fe1950d6a466d81fce5b2f4a63de9b26c3c339a568031db42461dde85b10108_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-ansible-operator@sha256:880e6eea176db16e9bf0cf59f29ccd0f17e33105def7aa429e1fabc8b96fe3dc_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-ansible-operator@sha256:c66f7e02ac5e6388e72f9e22e0daa765e2ea79bcaf363588848e806914b63501_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • +140 more not shown

✅ Remediation

For OpenShift Container Platform 4.11 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.11/release_notes/ocp-4-11-release-notes.html Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (4)