RHSA-2024:0306HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.11.57 bug fix and security update

Published
January 24, 2024
Last Modified
July 31, 2026

🔗 CVE IDs covered (1)

CVE-2023-39325 →

📋 Description

CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.11
  • openshift4/cloud-network-config-controller-rhel8@sha256:3465c5630173a2301f90b25323b917d2fb04643c6a762b74d313ae8f359f12a0_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/cloud-network-config-controller-rhel8@sha256:6db59b531a2c951038117dc5d308258746df40ffb794bdb4faf2185f6b33d3c9_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/cloud-network-config-controller-rhel8@sha256:931af0e48085b266aab144ca0afd44f63f2cb76b860a615d920f0ae6d1e320fa_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/cloud-network-config-controller-rhel8@sha256:dfd05f0612d744d1a62a4a576cddf174aeb776965d460e701bf0a16fb897ff07_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/driver-toolkit-rhel8@sha256:56bf81b5d5ffe14d6d2a813d24025940ebbbbd4395e8e11a969cd02c6b989252_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/driver-toolkit-rhel8@sha256:66cf3fecc930c28c75c0c453bd44862eddc7fab76caa044b0426ca0445647b03_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/driver-toolkit-rhel8@sha256:6a5e0cf9d1a61ed0c9095fea028418b79b792949c031ce65230628052d61295e_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/driver-toolkit-rhel8@sha256:895249af67fc93d6da91f9fb4e234da68fa2403d18d12b7f34f3ff47189e98d2_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/egress-router-cni-rhel8@sha256:78d9bdeb15dc8ba71115205193c97514a51bbd80de09339747d8cf308be4d4e0_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/egress-router-cni-rhel8@sha256:a39453afa37da6fbc2f67681eec0c200fa8f8b6f0b68d9bc59e782da42444be0_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/egress-router-cni-rhel8@sha256:ea8e6f2dac2f3cfea5d1e7fc89d4fdf7baa39565341f1d2d5ab8860a75c15bac_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/egress-router-cni-rhel8@sha256:fc0c1ebac229cdcdc2a96dc4a8352ce8f9d359de7474150587b7ac3a69a000e8_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/network-tools-rhel8@sha256:183ba35d3759408a305660f114f1f423fbc344d0edb4f1534d115350d7faf490_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/network-tools-rhel8@sha256:5c685485771ff6f3da170d2e373fa7072ce807e4911402b2e7875bb9ac175f63_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/network-tools-rhel8@sha256:8ea5a2f40de8d17a6af6e5b21edc0e5dd5dc5c28bdaaf9708ca0655446f004c9_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/network-tools-rhel8@sha256:99b190f51f088acf0ab7d8b36adeb1ff4663f75893f8066627d1856a84a09872_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/oc-mirror-plugin-rhel8@sha256:3cdfd3de95dbddc2821c732382435d187abd51da3e91ed9650cf3990bea413a9_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:05a6d643a50635bcb91e4e4b1c3842adbf46a765ee631beaf7f5bbf2e30ecdcd_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:3ef847dc4c55d271dd67ffae72939fdcd4a2cd591967f8b922605051f768bf92_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:74e2e7876972b3a590e6daae446f70864192807b5d5d3be007ba531248044b3f_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:ecb2de61d6e380b7af9e7d9afc882d4338976dde49e7554f3b709d0665ae022d_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:471c28f6913fbf6e712cb74bf03aacc819396e64e2b5b9c5bb97c61ff429f851_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:99a9c62851e7d6f2aebcb8e01d2d0b7b13dad42f1052d8cfc9b8346a5b72682c_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:c5bbbfe41efb8a8e4561b01f9ec0ce2fe9e469529f636d78de9dc2e14910b3d5_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:db3546b200a46a1d4b0f37cf4e5d7733466408396ad4deff026c55976ff2bb72_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-node-agent-rhel8@sha256:0e559026c71af2237f25ce7ea767c41afa2c08e4ee4dbf0ac475f94e8633e612_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-node-agent-rhel8@sha256:1acf30739f50427761a2b0984507fa2ce68d5d95cf9a082d4a6e8008146a5975_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-node-agent-rhel8@sha256:c11876ba49a57ae186346535754fe73d65f3c41211c5101a4ee1f56dd29d62f1_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-node-agent-rhel8@sha256:d080ebd51da575fede6af46c12345ba8c8ca5839d3ae794c240515b356835fe5_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.11 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.11/release_notes/ocp-4-11-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:e06117543fc10003c12017829bf7707fcc9f847c9aabcc7ac6150f7babf17ed1 (For s390x architecture) The image digest is sha256:a8ca94bbd21ebba6e6813cd81c9e701caed1bbec5399b7865c22f95bcd2ecc98 (For ppc64le architecture) The image digest is sha256:417c8815b3c3feb3d3bbcb7a1f2fd6d3fdefbaf7651dfab4024015ec0c08dd93 (For aarch64 architecture) The image digest is sha256:461c2401eb042e9edc63ede592b16e80dea3cd9956e50ad10b5ac0370a689e45 All OpenShift Container Platform 4.11 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.11/updating/updating-cluster-cli.html Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (8)