RHSA-2023:7662HighCVSS 8.8

Red Hat Security Advisory: Red Hat OpenShift for Windows Containers 6.0.3 security update

Published
December 6, 2023
Last Modified
September 8, 2026

🔗 CVE IDs covered (2)

CVE-2023-5528 →CVE-2023-39325 →

📋 Description

CVE-2023-5528 — kubernetes: Insufficient input sanitization in in-tree storage plugin leads to privilege escalation on Windows nodes CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

🎯 Affected products3

  • Red Hat OpenShift Container Platform 4.11
  • openshift4-wincw/windows-machine-config-operator-bundle@sha256:b706f4f982fc8fe32b5d4ce571a8556366c321de4ad38af1ee8fb519083052db_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4-wincw/windows-machine-config-rhel8-operator@sha256:4e5bbb7cadb76a5170e828761b019b9a415f16e01f303f2a54fab0056176814e_amd64 as a component of Red Hat OpenShift Container Platform 4.11

✅ Remediation

For Windows Machine Config Operator upgrades, see the following documentation: https://docs.openshift.com/container-platform/latest/windows_containers/windows-node-upgrades.html Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (7)