RHSA-2024:0664HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.12.49 bug fix update and security update

Published
February 8, 2024
Last Modified
July 31, 2026

🔗 CVE IDs covered (1)

CVE-2023-39325 →

📋 Description

CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.12
  • openshift4/cloud-network-config-controller-rhel8@sha256:0a557218b45de3e8ca4e687433d07123ff75b28861a3b3e81111657751ad01d1_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/cloud-network-config-controller-rhel8@sha256:2ea1bab0477395188dc21099f62933fea2a2a09c4077d321c9e98ccede06fe46_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/cloud-network-config-controller-rhel8@sha256:912798d33be713a6dfcc4da1c31d2ef2366868815ffed8c2ee5c6b58fcd8a5c1_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/cloud-network-config-controller-rhel8@sha256:96a79bd214fe5e695366009d8157baa1ab58cacc860a36e4ecc7593b367ef252_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:2c29883d9ac122863a13ba6139788c6ae6b331448c7081a983a15ab051855780_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:527ee40ad5627983dedb7d7217aa0b5cc6f6cd5a9acf1680e4599d8a142dc29a_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:d97fed557cfb8a973f0251d5f4bccf99b73713bee8ef384444444795218cb9c5_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:e8ed79876725785e94457ae8dc3e0ff017b9491fb7ae3044c89af480eb58ddb6_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/egress-router-cni-rhel8@sha256:48f41c3f7c38608ce10afdfe7e0b33b4b2230801737a6afe20a7a7c1cd427466_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/egress-router-cni-rhel8@sha256:53f07822f2a176ae78fbf87668a12b8acdaf7317269207d91b39cfec53b7181b_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/egress-router-cni-rhel8@sha256:a15656b4489f2c3241f1fba2ec9484a4f23b3260e3fcd68eeade95ea1228b4e1_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/egress-router-cni-rhel8@sha256:f4ef54e0959c86c26c8a00f7c65567e198cfeea6ab6f55f9dcb2085540afe47a_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/kubevirt-csi-driver-rhel8@sha256:34ba2331851326a8e7027ab081dcdc710a1c8cecba5473310f058710039b8ff5_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/kubevirt-csi-driver-rhel8@sha256:503e110cd5320d73633acdda01adbbd93e3981a101a12fc28d25857b973a0c32_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/kubevirt-csi-driver-rhel8@sha256:6666572593a02ea7c045a949ad2b6ab874a573911435faf18bf8220565ed8a7f_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/kubevirt-csi-driver-rhel8@sha256:92b080275e284147c0fe9ca7c9f9d96fcc519ebe92ca1e9f9b86f3bd05dbe2d8_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:1f784fbb44c0c8a4e99833e0ccde104862591c600f8816a1b57c4c921d189228_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:50ca53e51d9a1a59e0d0fecaa38075fcd6f0d860a049231e9b896bfa9714efc0_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:695e4b7f568171ec0940619fb28ef741bd5daa07c4a9483cbf31dddedb557615_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:bbc49ba92c096e9fc2154efae9201cf94968a797cf9012458c0482729951e0ac_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/oc-mirror-plugin-rhel8@sha256:50aabbdca3eb00bd2fe6c2859ddab847a7ff8f65e4fea04710f86b1fbe0bf9aa_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/openshift-route-controller-manager-rhel8@sha256:002d41b904aafa4eb061e63282319bee4e17be72c4dc49425425df741bd28e96_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/openshift-route-controller-manager-rhel8@sha256:27b66dee67820bed8994417757117143b1bb253f612266b91584e6999a43cfac_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/openshift-route-controller-manager-rhel8@sha256:776ebf4b1b5c4f044aec1cebb7fde54dce9f4fbec69f691dd1c364efa9c14244_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/openshift-route-controller-manager-rhel8@sha256:c65a439311999b56f2a96f367d8b006231b16c324edc019d51048de811f92c3a_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:2c735d4cd2e3c2fcfd3a4457530cd30b2d57c015040da156bc77e266159ef532_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:a2810bb02833165d9fd14e2b54ae7c105f308d4aa5f3f6539938cb77fafa90b5_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:eff43f3f362dc8c0728d08eba68a81b6db4e5b93e297524d67cdf5bbdd1b39d9_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:f2ee585df0696ef8452ee67a56c16390fda6997cf64ed54a15382aa44e3291e0_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:c93133ca1ccb35ea8552065ed7a74dccf5c7ee133e581f5211e465f1914c62d7 (For s390x architecture) The image digest is sha256:7cb92a163cd6c8d9c66699bb5108f96791aa361b406c1110d5d5f504097d9054 (For ppc64le architecture) The image digest is sha256:e8fd775453b9c488f027d446bad79dce303e9b955794898a4bce18ebc2492e06 (For aarch64 architecture) The image digest is sha256:fe0f0f2722cdab6887dd33acb01a9dfc98a3ee25daaf4096b19f294d01d35204 All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (10)