RHSA-2023:7690HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.11.55 security update

Published
December 13, 2023
Last Modified
July 31, 2026

🔗 CVE IDs covered (1)

CVE-2023-39325 →

📋 Description

CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

🎯 Affected products170

  • Red Hat OpenShift Container Platform 4.11
  • openshift-tech-preview/metallb-rhel8@sha256:53cf9311516309bae94d028f930202c947e2ff0842381f80d32194f2e4acc6c7_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift-tech-preview/metallb-rhel8@sha256:790a185c4dfe9a0fce76537c3bafaf594b630be6a7f1a7a9b3796b33e154c405_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift-tech-preview/metallb-rhel8@sha256:a3b04a273e44d26a5c7b29de2ed842a3c600d4561588dc648efba919bff2a9e6_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift-tech-preview/metallb-rhel8@sha256:ae18fc1f995af25fccf3a670afba8cfbf3746b20f9696b5fe405f6fb74d3a683_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/cloud-event-proxy-rhel8@sha256:6ce8f92c7d832667781f26f342334945d2d73496fc4c89e57e44458992fb8459_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/cloud-event-proxy-rhel8@sha256:85e46716d6e12a7253648bacf221039414b954dc07b372efb054ccc09237e71e_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/cloud-event-proxy-rhel8@sha256:af0e9d40f1e83247185d1d6acc733b3253f5a0026043be729bb7547677e08e51_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/dpu-network-rhel8-operator@sha256:3c19914bdd17e76a478384478eb52e490aa62cff5952be47141be8618f0e630d_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/dpu-network-rhel8-operator@sha256:757c2f6e7e3c00c6b6c34cd64fe107d0a4f350b0941bf52b5c0cfbaa3eae8451_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/frr-rhel8@sha256:0ea97bda70d1bff9e0537d7697b5f1599d8f698c38af0b861c63826539323e7f_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/frr-rhel8@sha256:3866f3ebc9535c6a7cc147428047893cb80d7f97f7f28c695a535fa2d1b4f817_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/frr-rhel8@sha256:b57cadc4fcd45439994d5fd6e85fcc988ecef2f262a804e4a5d70d402263721c_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/frr-rhel8@sha256:d5081758d2d0fd7a7b7077e17391278a8591f571c095f8ec15cf1e8bdc45830d_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/kubernetes-nmstate-rhel8-operator@sha256:3a0b8be1093387b3d4bc4d624fa43534bceb88914ae8409162e0b9ca9b5af7dd_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/kubernetes-nmstate-rhel8-operator@sha256:7a51c3e69462a67ff593773b2ee9788e1d3896e1bf0deaa40e558cb13687149c_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/kubernetes-nmstate-rhel8-operator@sha256:96a242252784efb8679383b9fc4b552b60fa9ec9bc7dea042ff17cc956636ead_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/kubernetes-nmstate-rhel8-operator@sha256:9f9afc9dba04a0fe31e34ff2f0eb6f9aa3a1dfd34c4fb9418e84e284fb4c0c10_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/metallb-rhel8-operator@sha256:26d23dde6ee237e697e953519b674d16b49e33bf26d2bc03c5845fb5793e6a69_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/metallb-rhel8-operator@sha256:29b4078250cfe6a5603d5fc2b3a6cd201f35f62650fba609615c22a192364be6_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/metallb-rhel8-operator@sha256:b9f21ff54cce04c7e4a10af24073c7679fbbf162d9237489343c3e5297bbc3f7_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/metallb-rhel8-operator@sha256:d161823635026808082538dec682d98a1fbec596bcf99ae69a2d6f0e87a83e4a_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/metallb-rhel8@sha256:53cf9311516309bae94d028f930202c947e2ff0842381f80d32194f2e4acc6c7_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/metallb-rhel8@sha256:790a185c4dfe9a0fce76537c3bafaf594b630be6a7f1a7a9b3796b33e154c405_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/metallb-rhel8@sha256:a3b04a273e44d26a5c7b29de2ed842a3c600d4561588dc648efba919bff2a9e6_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/metallb-rhel8@sha256:ae18fc1f995af25fccf3a670afba8cfbf3746b20f9696b5fe405f6fb74d3a683_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-ansible-operator@sha256:5b5157f791427cccf3fe0f240dbc3b29775731eff1af7375cec4bda63b1d0a44_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-ansible-operator@sha256:f24e5a3ca29d6e6c66ab554b8d0e51484e62a0eedead85aff70c968d6f00e474_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-ansible-operator@sha256:fc5f157e017e3e2866f5e4b8d71b09a73a752788df5e8e0e72587e76e5319b06_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-ansible-operator@sha256:fc953193b9f78b058512355a4103a66d63febc0ecdadc987425d8a8af61cab4b_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • +140 more not shown

✅ Remediation

For OpenShift Container Platform 4.11 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.11/release_notes/ocp-4-11-release-notes.html Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (6)