RHSA-2024:0290HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.14.10 bug fix and security update

Published
January 23, 2024
Last Modified
July 31, 2026

🔗 CVE IDs covered (1)

CVE-2023-39325 →

📋 Description

CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.14
  • openshift4/cloud-network-config-controller-rhel8@sha256:22c0537c2053f3b296d6c03f888f438fddc35e3149e61faa63d2d6e21b6eb311_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/cloud-network-config-controller-rhel8@sha256:5052dfd0d8e5f58f33a909f9b5616efa29fb13507e891dd537418c58ce2485a8_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/cloud-network-config-controller-rhel8@sha256:c992216911fb2e770d63c3bd87886208822e4e6592724eedf1ba292c5bb5abef_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/cloud-network-config-controller-rhel8@sha256:f58026ef12476847ead9f9b32d4162d238ac3e822a2cb2f55ab0804634e3697e_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/driver-toolkit-rhel9@sha256:39c942fbc405cdee22e4b497f3c586c1e8e54335796aa58b8deeff59c8fe29b3_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/driver-toolkit-rhel9@sha256:80f3b3c9e62a0e75625773e3c8a2302ec7215bfdb5c67e0d90e2f021c7969cfa_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/driver-toolkit-rhel9@sha256:df9c5bc43a40c715289ad49bd012d0c4edcda48de01b79280ef43ee86cd237d9_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/driver-toolkit-rhel9@sha256:fe9030cdc3b48a5acf464ec9c06c7b105cd4e5511232e6e3629a39b62849ffaa_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/egress-router-cni-rhel8@sha256:25d12c2b798271acc59ef6ab7a547e6a13ed52ec01ce670912e05c7883298d22_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/egress-router-cni-rhel8@sha256:4cb02db3ad4eaa4cb0c963b10280868f5e637f91b75407823c18843136e2509e_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/egress-router-cni-rhel8@sha256:5ef666d2e6042b8aaca3add035da177bf38e940f4704b59bca81d2e984f8f9b8_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/egress-router-cni-rhel8@sha256:fd59f9538a89f5eae77147a4e60c9e25b82881905d431b6a16ad0807472edbc7_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/kubevirt-csi-driver-rhel8@sha256:04d94327fee06e591268343c7c53fc95c669188e5c841c70e688579621ae40a2_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/kubevirt-csi-driver-rhel8@sha256:250c6c5655a4ed7f01aa33b5f6da3b9be316e24f7eb707af34f9189cf29afbc8_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/kubevirt-csi-driver-rhel8@sha256:5dc214ac8b423fe568dfddff545c109d8e2e3f519c1a4ca424e70a28c43d3da0_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/kubevirt-csi-driver-rhel8@sha256:8d0c8b87418105b1e12a3f681cd3c6e023590d28604731159a230287f678be77_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:487a1dc96e72a13127c9493525a88671051b6d54e2aecc2bf4b9252e9960f8e7_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:7f70ff868bb117f4f8fb82f0bef8a3b667e3c69b1c6defaff653e6c559d3c0bb_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:eb26caaebac6808fe630908f3132c1f4e72c243aad84865c1ffe00b25eb52645_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:f229ddcbea4dd46f49d9efddfafff50a5fcebf8c5b8a917431b4136e3e0e572f_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/oc-mirror-plugin-rhel8@sha256:61185efc6bef61792c0d5b8ab469e338015c8067915ea541d4e4a830992c2c38_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/oc-mirror-plugin-rhel8@sha256:7d9c69f35bd37422689d782421d7ab0bfe22e5a58f54cefbfe7feeca3edec1a1_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/oc-mirror-plugin-rhel8@sha256:8f73c92a13d472e63ea839fea6a116ab9481d60a531cfedf508323713158af8a_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/oc-mirror-plugin-rhel8@sha256:d9adf914644d69bd4a6110b4a85b3dafca69b036c06544b520757f6e340c1e7f_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/openshift-route-controller-manager-rhel8@sha256:3f757f8b35fbbea9365a45933b100ee2801bbe90a7d77ad96f23e4c28a05690d_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/openshift-route-controller-manager-rhel8@sha256:623e8e969da07c9414b2fcd9f21ba143d77c2e7d9c35a80214a3ec465c805ca9_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/openshift-route-controller-manager-rhel8@sha256:9c171e8f0814c384be6566880283dbbe8a8759f7017d1689fafaf0a7b7a5974b_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/openshift-route-controller-manager-rhel8@sha256:cf31f0f10aec372258fe4d15c7771d9f528735121568da329ea3354e776f5eff_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:1c3713dc35a7904a7928a5203add83e8a229f720348d312a52a522b06fa33de9_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at . The sha values for the release are (For x86_64 architecture) The image digest is sha256:03cc63c0c48b2416889e9ee53f2efc2c940323c15f08384b439c00de8e66e8aa (For s390x architecture) The image digest is sha256:c5e3315ca74a64483860589449d109dfe16ac3e57e3bdce3cf68e93379d2d697 (For ppc64le architecture) The image digest is sha256:7711541e18a0baebc6a95143152782f3d54dd9f4c7e1b504130bbccd4da3335f (For aarch64 architecture) The image digest is sha256:b8e2bbbf3f2fd2d4be3ad3c99ed5a74f3b95e87b14bab9311dfdf07c788aa4ca All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (23)