RHSA-2023:7823HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.12.46 bug fix and security update

Published
January 4, 2024
Last Modified
July 31, 2026

🔗 CVE IDs covered (2)

CVE-2022-41723 →CVE-2023-39325 →

📋 Description

CVE-2022-41723 — golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

🎯 Affected products145

  • Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:14fcfcadc8d9622b4575e22ed704d0f1353b07c2b1f5f78a5a6157d283105310_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:187f239cbefe33dda6a32b474e7999d1d0f1040e78894735d1019a2a6b41f19f_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:c48daf6c9878a5018adfa4807e9020256819f9fb03a3ec5824509c2ae0853798_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:e0584452a5a3f1c0e5923fb97eaca7072e0f156190d4eaba354d8d211a3c8cfd_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:1616a025c3477136503dff3e4245f4ddb7e5e1ceec205094b347dc1ce396ebe8_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:c251ae3b9daf0beae321b404104da5ada0aac6fc565b6d63977a3d0a3bd17261_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:ca573794a423c02aaf128e12377c032b79c8e035a2ae8bb962594865316fb2ea_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:f5cfcae4ec0ceb0970535f814ce135da5a2ea9fe7982eea02b55caa6beefe3fb_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:3274114b0e929347df93f983875d1933611fa29978241e3fcf77d79b012afe03_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:439f209d2477f715e373536a60a94313a1a39769101276d77044c9a02f30c1d6_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:b7357713f3f0aa5d5b00ba4d2ef706a283191400c51b0dea203cab0c9eaf19df_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:f684eebdd15aef75d28ea8d356262051d5da0723e554e7225e81ee8f3c2b3c34_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:0b1d353edfe0d8544afe71154dadcdc82c7b4385c37aa6b58d7e499dc02f7fcd_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:9327795e98c2c9defe715af5bcf8229ed3b02467a74ba32fc427405cb388eabc_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:ac05877054b9bcf18dcfbdd124c0058bc5cf2c2f1e02e893e4d74b833f808191_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:e038ee983d047911baffb7dc6d423b4704aeaef97d5ec54c89f65a52f219a7b8_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-apiserver-network-proxy-rhel8@sha256:618eca635c2f7d9c272eddbaf7afd415c3a7791c28e63801f47913501a730f45_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-apiserver-network-proxy-rhel8@sha256:90b166cbdd58053088c32d876867b7a1a3e21209837c1fa205ab5d22071286e0_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-apiserver-network-proxy-rhel8@sha256:bad7c22c05c5ec8770b14e0da54b8fb933a5da49f7cb4c1b19365df88430f3bc_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-apiserver-network-proxy-rhel8@sha256:c26c126235453bd4e9e6a8cd581bfdb206289b57a86df9ce71c713cf85b10295_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-azure-cloud-controller-manager-rhel8@sha256:65abe988a2c30a9bf6273b3fa693e99ab52aa7e9ac5c8e7139036c69e3f2b7c8_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-azure-cloud-controller-manager-rhel8@sha256:8cd981b979371e005683c5b22a9b324cadc72452d71e1448b531de0900617080_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-azure-cloud-node-manager-rhel8@sha256:4c497d01d780c931b6f88d34f68336233174f6a33679406909f4437373dfb00d_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-azure-cloud-node-manager-rhel8@sha256:e94a6d2a3b21e29ea33f261632e99133a19dbf428c32f439e5e637fe0f8ab5f9_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-baremetal-installer-rhel8@sha256:5981c2066b1124ec4187431b4d4e5af5ae6b987768ab787fbdbfb33d0973e474_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-baremetal-installer-rhel8@sha256:9fba5db5e431b2c3fbd6d6ae6b7b5bbea8dad84694b2d42f0df18f1b7839c5b8_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-baremetal-installer-rhel8@sha256:bf6383c8dacbbcd3058abb6f46f3b4f99f6bedbdeeda78e5ec5b4bb9c30674d3_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-baremetal-installer-rhel8@sha256:eb1ca57e210d089250755ab73b8e737a52c2633fd91d43c0b9b2dee8f2ab6646_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-baremetal-rhel8-operator@sha256:13d2f9fd6587d164e595223cea1aab8621bc578440a7d62a914c639d9dc7685f_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • +115 more not shown

✅ Remediation

For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html You can download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests can be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are: (For x86_64 architecture) The image digest is sha256:2dda17736b7b747b463b040cb3b7abba9c4174b0922e2fd84127e3887f6d69c5 (For s390x architecture) The image digest is sha256:e566cf319b78c79252a92e5dcf1aca030f23f3043a2e07d08d0b0a610ae5e50c (For ppc64le architecture) The image digest is sha256:c9b2fadcde663f8af7d015efa91210506b01d226f0a1dd16ca967a846008e508 (For aarch64 architecture) The image digest is sha256:6239b8f84d71ab75e68220d0e1b30f361eb79e18345023a64daeccffbcfbe057 All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (17)