RHSA-2023:7710HighCVSS 8.8

Red Hat Security Advisory: Red Hat OpenShift for Windows Containers 7.2.0 security update

Published
December 11, 2023
Last Modified
September 6, 2026

🔗 CVE IDs covered (2)

CVE-2023-5528 →CVE-2023-39325 →

📋 Description

CVE-2023-5528 — kubernetes: Insufficient input sanitization in in-tree storage plugin leads to privilege escalation on Windows nodes CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

🎯 Affected products3

  • Red Hat OpenShift Container Platform 4.12
  • openshift4-wincw/windows-machine-config-operator-bundle@sha256:9222ad35752330af411dd263087e7a95af7aff328b3aba12698feec6e4389a10_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4-wincw/windows-machine-config-rhel8-operator@sha256:cf2ff6b8e2067a00fe3c02ed4e238f08031ec3ce2cab3475137adcd6e10c3d10_amd64 as a component of Red Hat OpenShift Container Platform 4.12

✅ Remediation

For Windows Machine Config Operator upgrades, see the following documentation: https://docs.openshift.com/container-platform/latest/windows_containers/windows-node-upgrades.html Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (21)