RHSA-2024:0941HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.14.14 bug fix and security update

Published
February 28, 2024
Last Modified
July 31, 2026

🔗 CVE IDs covered (1)

CVE-2023-39325 →

📋 Description

CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

🎯 Affected products110

  • Red Hat OpenShift Container Platform 4.14
  • openshift4/driver-toolkit-rhel9@sha256:11fc03189d2977f7824a5fc8025c642ed04701870ff40f793fc446b0b408461a_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/driver-toolkit-rhel9@sha256:43e3a5c1a1d541891fd23b7ca0b2ba8e853f0fb259194b8f9e71c47b49af868b_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/driver-toolkit-rhel9@sha256:b03a3c6dfc71b940b1f42cbe699a5bbb57f591c561ce0363c55ab1bd0c530f9d_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/driver-toolkit-rhel9@sha256:b0e11d4edb6dbfbfd194c3a00786a8426a4b5242503e2add988ce0b0cd12cb55_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:179582e232bdbf3ccad53fd76bc7f60d57f38c69d91e5907998126e7fbe78bfb_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:54560e0921a4f45d138c0582812d7b504c257ed2881b35c6416bab6a9528a11f_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:90afbb5d4e59f973c9a92d6c3c865070e53253c85ad6fd2bac0b3b886cf21015_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:d9f3dde96fd6dd3094678d359e8aafed192045f6b484ea83e72fb78f0074d3bc_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:1e2df0abfdb2c3878c24f62311a02abb27cedf517f5bb32d73a56085a03302e2_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:27c5328e1d9a0d7db874c6e52efae631ab3c29a3d4da50c50b2e783dcb784128_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:a0e1b681aa147c77e8783e023a9841318ab16737de558715f31425e43def6538_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:ff300db02b19e40c6d796e50dee2d0ddd2db490e83f43250d76d4c5780978738_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:31d3496477ff56cea44e6edad133fdab64dd8052000bc3f6a432a11f31b6b44c_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:4b3daca74ad515845d5f8dcf384f0e51d58751a2785414edc3f20969a6fc0403_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:7361d59c863d4bc653ef7913653ece564c8eb749f4311a231809b35e4af23c30_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:bc497e6ba9b44bd7a969f7fb429b61e47c8cdf79afacd538278cb3ff83306923_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-cloud-credential-operator@sha256:1ca7e1a92677e8700298c5340e7c41fca21a325e52050418ca33b2f36a83151d_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-cloud-credential-operator@sha256:9befd2c3201737fa71487d14669c3a5e9dac2589e56017c12cad3a8360bf5b94_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-cloud-credential-operator@sha256:d5e0f7f14c13cbca4f743dd016595d19ef17611d98e37181f253108efc0f91cc_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-cloud-credential-operator@sha256:f094e0af6fd027ec39c15f664812b9a09a70dc15f7cf3f926ae534c38e36fcd9_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-cluster-network-operator@sha256:0d147ced66e00ebc5f3d1a4bf8002612213d05a1ea5de067dbd69849b350db67_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-cluster-network-operator@sha256:0ffa691e0ad652e1ab2d6bb457a3244dff37a761159dfd51e2fa385249dae1ad_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-cluster-network-operator@sha256:432ce9f8245a2fe6a09f0dd7af6edfc006e2edfc6b94f936a2893752752208eb_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-cluster-network-operator@sha256:a9a41e5ae11b774c7b90fbe228a3de7454006fb594a84d6faa64cf6322c46cad_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-console-operator@sha256:2a011ea7ddabc7ff605f5f46a961841344cb46d3d9f55e862529ae7804fa32c7_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-console-operator@sha256:43b364907a6e52b76534579f71a48b6e64dca95c274f39f304152e44d760f8a4_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-console-operator@sha256:6de7c47bc0b6d4f7df0e54da5f3d80644a7150fd4c53375f76a6d5450922b1b6_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-console-operator@sha256:ef5089db5b44324a3baa7fc11360a33b4a5eb9bab9bb6724e6d35fc40ab475e9_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-console@sha256:32cf0923824f5d1cbee63a952577c6bace5d8c23661b5972b2090900393b099f_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • +80 more not shown

✅ Remediation

For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags The sha values for the release are: (For x86_64 architecture) The image digest is sha256:d8e8ed089a72fe100fb48f56c1a777fcd985fd81ee96cc1ec2f349a625097621 (For s390x architecture) The image digest is sha256:4ec22b4603bd44694392ebfb666468a0faa619b3ea2855bbdc294f3f976a9161 (For ppc64le architecture) The image digest is sha256:9435acf1e77a56fa2f952bced7faef0a5480ac90e205bcb92a06f31eea3c6dbc (For aarch64 architecture) The image digest is sha256:71263e6384a6a143a07fa63af6966472c36770980b166a3d0cf4c120f2395d8e All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (19)