RHSA-2024:0059HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.11.56 bug fix and security update

Published
January 10, 2024
Last Modified
July 31, 2026

🔗 CVE IDs covered (1)

CVE-2023-39325 →

📋 Description

CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

🎯 Affected products72

  • Red Hat OpenShift Container Platform 4.11
  • openshift4/driver-toolkit-rhel8@sha256:1d26666efe99141af24771e3c14d6231a91e3fbbc392cde30fc45d6233559aa6_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/driver-toolkit-rhel8@sha256:7ce7e097277a68fe3097ee67d632a4d05fb13f1b459321370479c4317ac5a5f7_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/driver-toolkit-rhel8@sha256:8f91a1c86fc33c81de5f79050ad6df71f1ab95548579ffb3d28cc1b76cc6b315_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/driver-toolkit-rhel8@sha256:ad7d0ab3816ddfc9a6fa8c68d682b423eb68cd50327a09e8d9300a92d491b59f_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/network-tools-rhel8@sha256:0161510f22136a4f373fa25ea492f5cd2c10701d0539dff08360cbffd5a999e9_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/network-tools-rhel8@sha256:4003789b18e6ab72479aa16a16960c42479b0f128a45a5cdb5d283d55b7584e7_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/network-tools-rhel8@sha256:916f57aaf945d9d4ce8e38a4373184749ed9cf0178fef4002cc80cde7e3b43cf_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/network-tools-rhel8@sha256:e9ea92bacbe0fbcdb37e951740582f52f994666e51d786796b5685cfd51a650a_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:0b3f8562a402ad14611bb176c678a6d97fa5a17d54961ad731479f027e3c7f12_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:746980c38d3af569d83ea204847c13f9bca0aa8b4c1d46fe9cb855d032b3969d_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:ad4454016894c5aa1d95ba990fdfadb36c97788db072c248df8e69c64abfd7ce_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:c95df595dbbac0756c0f022647c1a6677b436df95276344831d17c7c5f38221a_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-aws-cluster-api-controllers-rhel8@sha256:7b469ae184648cb2f37a5488f4665fb6b8882801bf35071dd57e3a24f9182178_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-aws-cluster-api-controllers-rhel8@sha256:c87163a4a92f9ff786a17cd9ed26bb8774055e8fd7985dbe858029bb5c27baf3_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-cluster-autoscaler-operator@sha256:42051ead300888858be3f844ae005339e91c773c339e82ea443981fc8b92a16f_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-cluster-autoscaler-operator@sha256:49372d48bf26acff7ee508119e011a2707eacacddcf8a0cd35bd3e8b2a116a19_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-cluster-autoscaler-operator@sha256:80357e14894cdb81bcfac2f601a3b9cf399e3895d8daa8705ce284e16671f704_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-cluster-autoscaler-operator@sha256:d528404236e307fe250745dff63637c5fc41330662f702516a1035cf5b4de3ea_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-cluster-machine-approver@sha256:7727ba67c03a2f250bdc4eaca52a7811bed809620d11d4954e3ec1038511b7bd_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-cluster-machine-approver@sha256:e4dff42d8c6faa9471c6846f896a64573ae4bab27d4499d97238656ec374c9ab_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-cluster-machine-approver@sha256:e7ed3681a8f0cb2fcdad6f0fb5ed7064492498ace61002b7a5a3ee0a1ef7fd08_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-cluster-machine-approver@sha256:f094ecc61ed6116967ee5534a45db95147a5b93206effce2d78ae9f5d3cfbca5_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-cluster-network-operator@sha256:40995e1b204cba46ca7c3d1c762f82c54508494625a3b9d1ea0ad610b6cb7963_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-cluster-network-operator@sha256:58ec3903f3d96b84214a2d4c373e4e3dcca84ee7dde56d797e10fc982b8c412c_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-cluster-network-operator@sha256:648a25174f54f1ade0237ce7c4374007d040b71c76665582f81b78e55729c92e_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-cluster-network-operator@sha256:a97f1ac1d2a70c9a150d28ca7684fb94a606079c4f9e251101c560e56792258b_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-cluster-node-tuning-operator@sha256:809837c8ec9da235815e517bccad2f448f800732493873d4b369e9c0ee8540a9_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-cluster-node-tuning-operator@sha256:a09e3e948f8da17e668143672bcbe86f3f99d2cf34c89655eb785062ca92e798_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-cluster-node-tuning-operator@sha256:dca2fdb80ec01a699f5c98d995e0034e0129c1d14e4df12fa4956c88657977cd_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • +42 more not shown

✅ Remediation

For OpenShift Container Platform 4.11 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.11/release_notes/ocp-4-11-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:6fcfee1b6d7e4d2f9c0e05ec2b0ad159809ea93736ac0acdc710df0584510892 (For s390x architecture) The image digest is sha256:550b4ae7b75f6ea2bdd0895c5532865e8a891810dbc333f19255b149fa8c1da3 (For ppc64le architecture) The image digest is sha256:05e65dbd2b568351fdd96dc713f6c3fa04754680a826db2f6a19e59f2e36639f (For aarch64 architecture) The image digest is sha256:689044f88cc34d0b343b717ca231c48827d0b41317269c7148edf25f3712e562 All OpenShift Container Platform 4.11 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.11/updating/updating-cluster-cli.html Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (7)