RHSA-2024:0485HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.12.48 bug fix and security update

Published
January 31, 2024
Last Modified
August 24, 2026

🔗 CVE IDs covered (5)

CVE-2022-32190 →CVE-2022-41723 →CVE-2023-3978 →CVE-2023-6596 →CVE-2023-39325 →

📋 Description

CVE-2022-32190 — golang: net/url: JoinPath does not strip relative path components in all circumstances CVE-2022-41723 — golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding CVE-2023-3978 — golang.org/x/net/html: Cross site scripting CVE-2023-6596 — openshift: incomplete fix for Rapid Reset (CVE-2023-44487/CVE-2023-39325) CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.12
  • openshift4/cloud-network-config-controller-rhel8@sha256:238422c1838cb75005d6326bd093a25d585c5caa62e2adf72e362b995ac198cc_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/cloud-network-config-controller-rhel8@sha256:39917cf2a62e1b5b479cab803fd6039e6dc340078b19b9e8f707c0e7153379b4_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/cloud-network-config-controller-rhel8@sha256:45de5aad8dac694544d4eeae7c4d9fb511f6e33ed4e525bb73d225413ee02a20_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/cloud-network-config-controller-rhel8@sha256:5ec6639e7d5630b9fbb58db669eea767978a53497c32cdb4284ba7daeeb8c3d7_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:1bb7d44ea22dd9b72228cdef43f642bcb23c92b7219c2af951800968a4763bb8_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:1f191e3e27d7266a2a3ac41791af3eaeeab0010874056c7258ecff6092429d8f_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:8f7903829571184c271a3ca81eff6fa7ee653c0b0564aabdf1788ceb7ca40352_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:d993a0dd4ea82d2b9d90211f0a26b47171c413e92267ce9f168424d5df2f4aed_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/egress-router-cni-rhel8@sha256:11efd3faa2d66a2c6c3cc797cc71012cfed5450351aeb915b41d57419b3f1354_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/egress-router-cni-rhel8@sha256:2542c64fc0be764e125461f21268fe378d94be14503ee8d5120919af782fc997_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/egress-router-cni-rhel8@sha256:37a3f965c750ce46c8dd8a4d2293e96f650f5977018da340d68b4bf748218df2_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/egress-router-cni-rhel8@sha256:3ac48d07c726edf0e3f75c3addde60a58b0e6a5b9100fbccc951ee79d0c88fc2_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/kubevirt-csi-driver-rhel8@sha256:32d2d303a01619be01d259552da501a38e9d68638ea8663e7ebb22deedf57a79_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/kubevirt-csi-driver-rhel8@sha256:46c47ced20c68733112d52b48a628e0c942c370fc70e5a7dc89e7bc1fce033c0_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/kubevirt-csi-driver-rhel8@sha256:69d67ad1be2a31dd838941737ff44fa40ed69fc61eeb2ec40d9d9b37dcf4caf0_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/kubevirt-csi-driver-rhel8@sha256:d2a4d4fa7b3b1784065dee45e81ba57d0164f5ac5f95436772536e213255fd1b_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:083ed41304eea174517997a228db1de4ac8d5b9256caf07ae6d6eed6f17a9f72_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:7c0020f094ed36ff60401bc45c1e42c44db649489c745d7595a8302edeccc7c3_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:b09feddfe60efe429ab8dc9662611da8d481eebe25be41f3c23f8a9965047070_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:dbeec5e05de4a4bc0f59008d86ef750113b035663c0f4eb7f8dc6303ffd95c51_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/oc-mirror-plugin-rhel8@sha256:e4aceb83f34bc5485d3e010fb51bc6bce150e3e247b71eca104b709cf72274ae_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/openshift-route-controller-manager-rhel8@sha256:20a7212e3ff7b315d6cfbc764712a5171d4685ee226687cddadc5dbeb5814a93_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/openshift-route-controller-manager-rhel8@sha256:521d48ac440c54c191683a82ab5a7ff28a0d103a16a7dbb8ee5fa1dfccc323b2_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/openshift-route-controller-manager-rhel8@sha256:bcc517fa355ebd10917331789694bd2b71a215a85177dd12b545dfa8747a3bf8_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/openshift-route-controller-manager-rhel8@sha256:e87f0d1fed2a1bf5edce18dc1cd5f2fd643eb5b3a8dec666ebd8691414b018a1_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:966631180cfc0fb52a27aa99df1d4f1af8625922c4797707a8d65bd405fa05fd_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:ba1cb7b5c546e287eff82bc108165966a84b9872318cee35a1c915220fd1cd3a_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:e444677d1964ff539e1b2fa8854d695b2fcca2cf0cafda55c686cfa54e3f2891_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:f95aff4abaf7c20f8330cc26354fe4fc65ce63c014119258c9c570c4ab74152b_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:c31b9b63b8c21d4327201fd0e78a4b6b0af7f1f8162acd29e4cde1cd65a56d19 (For s390x architecture) The image digest is sha256:e8e4cfb3ca12a11ee0879d34727769cd5fa00fb7eeba0ee41a345e616e4387b4 (For ppc64le architecture) The image digest is sha256:9c9a4f60a1e11cd1b40daba2128506eb94fcc15f07e7768eec0a0bc927ff7435 (For aarch64 architecture) The image digest is sha256:99051c82c2677c95e38a2b68d6d7ac8757f9d481cb236fd0f1aad2d333906167 All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (19)