RHSA-2023:7827HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.13.z security update

Published
January 4, 2024
Last Modified
July 31, 2026

🔗 CVE IDs covered (1)

CVE-2023-39325 →

📋 Description

CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

🎯 Affected products121

  • Red Hat OpenShift Container Platform 4.13
  • openshift4/driver-toolkit-rhel9@sha256:aa2c03b6d69d798cee96d45f3ba2f2e3c647de7ba2a7974b12dd3023dd65f3e9_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/driver-toolkit-rhel9@sha256:ba767bb270b13b641e6907736cfac9b275ffc1407c739ec837b52109eafc61c2_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/driver-toolkit-rhel9@sha256:cf2cec03a469db749bc72141818df09a5ed556a1f4d9293bf4d5b360c34fb80f_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/driver-toolkit-rhel9@sha256:e900d81d4876888cab0a4ba4bc7225a704a3de69f95acc398204c7c4ad13a1ab_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/network-tools-rhel8@sha256:5143e346899e61b74ebc716f322b05def09f79d171dac95f17ad692563e7f14b_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/network-tools-rhel8@sha256:7f1b21415113dd819e5f67e6a616b5d16b7f75e9200491eede1f4fb043bd2c08_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/network-tools-rhel8@sha256:8eb082343e4eb427201b38b5bc10668185d5ea5811a2d4692a1de5a404163271_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/network-tools-rhel8@sha256:fe3e405717b47be296754c0cda2e2ebbbd1ade0be90006425508362d7916569c_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:660fd813280337ec4d7e03fc237d1c1aff9ec09c42b97aeaac14d4147d8d08a5_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:746062b31c47bd20a7da7677e535af808d92fbb0f72fe6579d3730d5de11410d_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:c8bffebc94dbd4fb631c2f784d5bd823db2fd2b1a3733ad4ea16b8617441faf0_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:d91850a48459f8c9226cf767c5e5a6fb2ba9a1dfae64b7a74d3ba23310220627_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:4ede03b3a65808249738d7648e8ad0902c71e94029110b0fdb39753d2cdaad65_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:dccf90eb156838ae81b3244a37f8e7554c933bf043ff26e9f4fcffa0ab3b9009_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:decf7b848fbc9a14d62d09e78534409f61542fb1e0eb273d85c70d11ebcb3f10_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:f17ba0c9f3ed3695cf3a1252dd69a118f68994315b565bc2bc8156dc4ffead74_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-cli-artifacts@sha256:36dd3163691da6cf4f9e73cece472e2a3d908a5c65484837a25cd6085ebb07d9_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-cli-artifacts@sha256:c04b4d15d4feac1076206892ca459a933c097ff0e9fc6362245542f9d9611481_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-cli-artifacts@sha256:c24605a2cdeea41cc9d1cf648c37c45c8de9abcd7b71a8a030b81159454211e3_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-cli-artifacts@sha256:eef30a572f0ba04befb4edd845351171e4aae2d112f7faa1e30570f4d305d316_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-cli@sha256:027a8356a35c8834673de60c1c2c5b343a22bbf661ef9d0d9341b8175de82b12_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-cli@sha256:2ae8fe155ec9cc2cdcd36d5048bc270e6c810dd1fffd242b68e017bb81bbfee6_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-cli@sha256:31969a0182875ebad25eea1755174f0f049ba738d62cdecb68a861e26c2aeb1c_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-cli@sha256:cca8f4eda871b5aee3a6dd5bf6c9f86d4336e3d8364f59a432818239f268ceda_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-cluster-cloud-controller-manager-operator-rhel8@sha256:0d1415f13a00a5780d16f3b2ab669b0dbff879712a41114d9c1e4e0bcafadb40_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-cluster-cloud-controller-manager-operator-rhel8@sha256:197c968a654da95b696ac4e5e60ac9666b8982202f54140d6ae09f89edd522a8_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-cluster-cloud-controller-manager-operator-rhel8@sha256:a730c9f5db7a33d3c1d78428154a594509a9d452ee1e7a93ef9af98e64c19f87_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-cluster-cloud-controller-manager-operator-rhel8@sha256:c78f5dbd2233574378e4b57368b5a65b33a602ed61183b8b58a6bd64f085ef0a_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-cluster-dns-operator@sha256:4a3bf0af1735a9ab6fab03d9a48a9c459235bb04cab98686c0e9f35788011626_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • +91 more not shown

✅ Remediation

For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-12-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags The sha values for the release are: (For x86_64 architecture) The image digest is sha256:7dcc3367f535 (For s390x architecture) The image digest is sha256:b5bc84a1a7d0 (For ppc64le architecture) The image digest is sha256:cdd2cea8e6ad (For aarch64 architecture) The image digest is sha256:5fdca671fcdc All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (13)