RHSA-2023:7479HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.11.54 bug fix and security update

Published
November 29, 2023
Last Modified
September 2, 2026

🔗 CVE IDs covered (2)

CVE-2023-5408 →CVE-2023-39325 →

📋 Description

CVE-2023-5408 — OpenShift: modification of node role labels CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.11
  • openshift4/cloud-network-config-controller-rhel8@sha256:5d3fdf342bcd14c0e8ef2da219b0284d605074b467a8b4f06e510280395c4f33_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/cloud-network-config-controller-rhel8@sha256:5e9ad73de1a70d1758a4fe626e622be0807cfd23cfb90e1c3a9b16ed53a6a68f_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/cloud-network-config-controller-rhel8@sha256:825de731c9c04e5eed87a74c0ade6a9bbc3e7f0e75fffa80bc373b9bf254dee5_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/cloud-network-config-controller-rhel8@sha256:da595bd248df6097354849710c3cac2ed48812e5bb13164bdc4b76ecd395203c_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/driver-toolkit-rhel8@sha256:0051860882db965dc2126d99028ba2f94a6d108d07e68f4bfef148fdd57464d6_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/driver-toolkit-rhel8@sha256:4494c847283158f0789b80e1038d7ebd8618c2a193e0169f92d12204db0b619d_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/driver-toolkit-rhel8@sha256:65433e4d253049d7b53e72679fa7de4f2744fa360dda0e44640cbee1374694f3_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/driver-toolkit-rhel8@sha256:9ca833c327793fbc7242c7e853797bbddfc29bb688ac27452b5ccd281c5b60e7_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/egress-router-cni-rhel8@sha256:0cb1dfcfcada47e0c3f3ea53a25d62b6fee4e37d24cb377ede9da1b9dd09148d_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/egress-router-cni-rhel8@sha256:141daed144cca9839b4a1ccdc6ce145484e39b024dfe3bfcc82e507f1a26e4a4_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/egress-router-cni-rhel8@sha256:747686abb4b1ff57dc951eeed950f4b8514732827c5124c3e288b7d844d7eab0_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/egress-router-cni-rhel8@sha256:babd50db380a86830e9660146b6d9e4df59f07e527f5296ba734631b7169d5e4_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/network-tools-rhel8@sha256:1f5e4ec2742b17fa602bcf1671ddce306d36de9ab7e4d113c256dc23c3f6bcec_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/network-tools-rhel8@sha256:7a53cbde267962d331849e1921bfd604d9fad4e0d272466475615665b673fb88_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/network-tools-rhel8@sha256:8766cd15fc7e8752f8cc9926517363dcd0c65a142a768e2a5398591aa3ff5569_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/network-tools-rhel8@sha256:b255c6a2f6d3a2714ce0de53565f0594aecb50e339fa20fe80974a5db1970ad7_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/oc-mirror-plugin-rhel8@sha256:0c487412ee618556e81395b6d51d9465f325e2ce7f76482e96521e53c60af59e_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:025c1383188aa559efd448d6b9d59285aee7e0963754909506498e628a759676_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:207546947330433c31dac79e7b239d0f92e93049083d1100243fae4f07125b9c_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:4162168e359b1af36cc21fcf9f37a58ad717ea85117124f08728c223137c80bf_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:aa8ff09b0f4b7cbcb34227a1640aa1da5a31b9f59982c38c4732216e3f053f9a_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:0ac304cf08303c065a08b5151c9ebae01a7b211f7e9ea5f88352a8c30710cb1b_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:13e73295a62b03f31c36afdc0fb18cc61878820740019b17850f61eeba94cfc3_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:de7a15cd99f836440509d3f9df39e2439002f5d42ca6fcf0162277d0b028ef0f_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:e66e30cbd4188d879242ed75f4f7c208c90c079d41e89d2b3b09db03f3d7960f_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-node-agent-rhel8@sha256:5a8c3281696a5ee6b596f9a26203f966763d4af977c00b6603c833d17bed972e_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-node-agent-rhel8@sha256:73cebb51098bb55ecd7b8494657fb27539cf520bdd769b27eb6f6263282414d9_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-node-agent-rhel8@sha256:97f6600610301cd236ee6d4a2e7393255c6c74fa9397c98ffc1503d10879a5e1_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-node-agent-rhel8@sha256:ebe7f007b97ae0876af47169a8de5447a8192e8a981c55da8652d3a22f61bf66_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.11 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.11/release_notes/ocp-4-11-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:f659402f24812b07e63e84901e79720650d1af4097535f059ce731031948a8a8 (For s390x architecture) The image digest is sha256:791bb60e637e8e45e96445ebedbb71be9b5276f248078a4d0733a8a1d3a26e39 (For ppc64le architecture) The image digest is sha256:af4e9f6dda16cde77b54e21f7edd61e70e4648176ea3844f0d4e3970f6485168 (For aarch64 architecture) The image digest is sha256:988e910e7bdbe8092ef69685af1af383503b49b1b1e0e3ee629ec8c760976cd9 All OpenShift Container Platform 4.11 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.11/updating/updating-cluster-cli.html Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (13)