RHSA-2024:0200MediumCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.12.47 security update

Published
January 17, 2024
Last Modified
November 6, 2026

🔗 CVE IDs covered (1)

CVE-2023-40225 →

📋 Description

CVE-2023-40225 — haproxy: Proxy forwards malformed empty Content-Length headers

🎯 Affected products194

  • Red Hat OpenShift Container Platform 4.12
  • bpftool-0:4.18.0-372.87.1.el8_6.aarch64 as a component of Red Hat OpenShift Container Platform 4.12
  • bpftool-0:4.18.0-372.87.1.el8_6.ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • bpftool-0:4.18.0-372.87.1.el8_6.s390x as a component of Red Hat OpenShift Container Platform 4.12
  • bpftool-0:4.18.0-372.87.1.el8_6.x86_64 as a component of Red Hat OpenShift Container Platform 4.12
  • bpftool-debuginfo-0:4.18.0-372.87.1.el8_6.aarch64 as a component of Red Hat OpenShift Container Platform 4.12
  • bpftool-debuginfo-0:4.18.0-372.87.1.el8_6.ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • bpftool-debuginfo-0:4.18.0-372.87.1.el8_6.s390x as a component of Red Hat OpenShift Container Platform 4.12
  • bpftool-debuginfo-0:4.18.0-372.87.1.el8_6.x86_64 as a component of Red Hat OpenShift Container Platform 4.12
  • containernetworking-plugins-1:1.4.0-1.rhaos4.12.el8.aarch64 as a component of Red Hat OpenShift Container Platform 4.12
  • containernetworking-plugins-1:1.4.0-1.rhaos4.12.el8.ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • containernetworking-plugins-1:1.4.0-1.rhaos4.12.el8.s390x as a component of Red Hat OpenShift Container Platform 4.12
  • containernetworking-plugins-1:1.4.0-1.rhaos4.12.el8.src as a component of Red Hat OpenShift Container Platform 4.12
  • containernetworking-plugins-1:1.4.0-1.rhaos4.12.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.12
  • containernetworking-plugins-debuginfo-1:1.4.0-1.rhaos4.12.el8.aarch64 as a component of Red Hat OpenShift Container Platform 4.12
  • containernetworking-plugins-debuginfo-1:1.4.0-1.rhaos4.12.el8.ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • containernetworking-plugins-debuginfo-1:1.4.0-1.rhaos4.12.el8.s390x as a component of Red Hat OpenShift Container Platform 4.12
  • containernetworking-plugins-debuginfo-1:1.4.0-1.rhaos4.12.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.12
  • containernetworking-plugins-debugsource-1:1.4.0-1.rhaos4.12.el8.aarch64 as a component of Red Hat OpenShift Container Platform 4.12
  • containernetworking-plugins-debugsource-1:1.4.0-1.rhaos4.12.el8.ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • containernetworking-plugins-debugsource-1:1.4.0-1.rhaos4.12.el8.s390x as a component of Red Hat OpenShift Container Platform 4.12
  • containernetworking-plugins-debugsource-1:1.4.0-1.rhaos4.12.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.12
  • cri-o-0:1.25.5-4.rhaos4.12.git778644f.el8.aarch64 as a component of Red Hat OpenShift Container Platform 4.12
  • cri-o-0:1.25.5-4.rhaos4.12.git778644f.el8.ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • cri-o-0:1.25.5-4.rhaos4.12.git778644f.el8.s390x as a component of Red Hat OpenShift Container Platform 4.12
  • cri-o-0:1.25.5-4.rhaos4.12.git778644f.el8.src as a component of Red Hat OpenShift Container Platform 4.12
  • cri-o-0:1.25.5-4.rhaos4.12.git778644f.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.12
  • cri-o-debuginfo-0:1.25.5-4.rhaos4.12.git778644f.el8.aarch64 as a component of Red Hat OpenShift Container Platform 4.12
  • cri-o-debuginfo-0:1.25.5-4.rhaos4.12.git778644f.el8.ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • cri-o-debuginfo-0:1.25.5-4.rhaos4.12.git778644f.el8.s390x as a component of Red Hat OpenShift Container Platform 4.12
  • +164 more not shown

✅ Remediation

See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html Workaround: This flaw can be mitigated by applying a rule to explicitly reject any requests with an empty Content-Lenght header. The following line can be added to any frontend configurations at the /etc/haproxy/haproxy.cfg file. ~~~ http-request deny if { hdr_len(content-length) 0 } ~~~

🔗 References (4)