RHSA-2024:0837HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.14.13 security update

Published
February 20, 2024
Last Modified
July 31, 2026

🔗 CVE IDs covered (1)

CVE-2023-39325 →

📋 Description

CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.14
  • openshift4/cloud-network-config-controller-rhel8@sha256:07b0757913bddedeb2108597bd002d1e77ef76cdcb1729ad862266d01cefe6d2_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/cloud-network-config-controller-rhel8@sha256:22c2180c72163653a6c9d710b66dbc65b8fe83af1394f85d4bcf61ba1890f1aa_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/cloud-network-config-controller-rhel8@sha256:58c57918fc24746226e9f04cb4d77fe59a695fcfcdbe5172216f17243b073385_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/cloud-network-config-controller-rhel8@sha256:7aa0e8179fb85ed955bbf484a1460af6f37b54e4a479598bd00c0eaf9a2044c8_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/egress-router-cni-rhel8@sha256:12406b92cd0f0fa5dd8a6cbf2dbe065548c7d33876c537e8f57810bcc72cb5f0_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/egress-router-cni-rhel8@sha256:48d1c8c7a50f988d08d3e4943086434f5ff07135f2af7124594a894ecc3740f9_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/egress-router-cni-rhel8@sha256:bae1c43ad895bf85ea535042f71842b60148a25a0e356a081913bf67c83f5855_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/egress-router-cni-rhel8@sha256:e3811e86871c4cadec51a270b4729a230e4c83af85876f24a1a47876502eddea_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/kubevirt-csi-driver-rhel8@sha256:35844ffbd6cb8db7e78c6b59e94f0cb8b0169904b746609eb7f7e6aa75a886cf_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/kubevirt-csi-driver-rhel8@sha256:46887c51b0ff74452acb80ddf522ce223695faaa1dd40e7e997791585a265451_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/kubevirt-csi-driver-rhel8@sha256:a8bdc6b549ef7739b6bef7b74b1ac2d24c007502a88db59ec28747d481f7f1eb_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/kubevirt-csi-driver-rhel8@sha256:f1fc3af50e9227f749aa0bfa6f148896e1bc970bff10ac33b3e3316076544d0f_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:060cc91456c5ef27b2fe175f092ab4b991c40b8c44ba826c210eca869cbb22b3_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:344addbca5c3017f7057a66413862344e1ddb2da98f9124ce0f11ff877113cf9_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:96c7ff1a86e0e44bc2fcfc1c5879260aa8b04932683e2042276d61b41b6ce04d_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:ab04de885164800eeb61c7af3234fe0623d508a61a0c176f8156ff1513a1429b_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/oc-mirror-plugin-rhel8@sha256:04181c0239bfd1dbd6e437eaf65186f3c076ddd8fc777a752193e13ee2a481b7_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/oc-mirror-plugin-rhel8@sha256:3757e2dec5566f339b89a7dcf0de48b9063fe2c1b624be6441dd162b22c45f93_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/oc-mirror-plugin-rhel8@sha256:aead2784849593b28aab7b949518a1e0e3e27b2b1f37bbe39ba7b15c22b770e7_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/oc-mirror-plugin-rhel8@sha256:ec5e8299e91d045e28e7a7c72a228231b3121d602d51f2ab80e2d9156c4953de_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/openshift-route-controller-manager-rhel8@sha256:4b98915231fe48e0f398e50d024aa2d1a1afc307bc600e4f58e92694643cddbe_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/openshift-route-controller-manager-rhel8@sha256:b40807acbd72ea6facc9aa8094d571fca708d8b0e437d12b04d4ba0fd02eddfc_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/openshift-route-controller-manager-rhel8@sha256:c0bb889b47abcce4e0b784106569397f7047e3d4781c79ac4ff7d99cb19e8021_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/openshift-route-controller-manager-rhel8@sha256:df0e03fc0a6d73742f004cae3f970f10e6bb7d9d70b55c4622744aeec4a53b01_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:10c65b956b33b433385c7320ef4334466d221d4827c4bf09ead8d625203822f0_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:1e0165fc801f27a1b192dcc2c62e54fe831b4ce7820401120d366a039a7968c1_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:ab5f9d87dc5f2905e9706cfb5f3a6cc4b8f76d3cb51e61f75fed721fddd86095_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:d488c4499f14688648e8bbfc0a258b328063f98eaab254783db14a5998d72fd4_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:12145827bb6e0325a4b0ed1eb7e550b7efea835f83ca7a19ee3deb65dbafa96d_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags The sha values for the release are: (For x86_64 architecture) The image digest is sha256:ff004c122db9d494abedc1630ef5e2e535cc4529b3450ff58aaacf6b6cbba30c (For s390x architecture) The image digest is sha256:9cc038f5b3f8f0377b505553d5b74107237799a99eadd92f23ca83b291ee85a2 (For ppc64le architecture) The image digest is sha256:931963aa36076e0b07d73ecaf04e8c149da742ec070aae8b3410d6e8a4007962 (For aarch64 architecture) The image digest is sha256:74ce708fc18a97a8325d6afe380b3b57ad656a4246a4f3ffc13991fa2dbfd4bf All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (15)