RHSA-2024:1464HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.11.59 bug fix and security update

Published
March 27, 2024
Last Modified
July 31, 2026

🔗 CVE IDs covered (1)

CVE-2023-39325 →

📋 Description

CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.11
  • openshift4/cloud-network-config-controller-rhel8@sha256:1eb3836ca7452177c03a83ef481a0150c428050ae05c5b1a9c1ddc82d011b1c9_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/cloud-network-config-controller-rhel8@sha256:5c13aaaed3d8fecd28ec5dedacb9b2e74f1179eb5c39705a9a0d8c5aea368524_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/cloud-network-config-controller-rhel8@sha256:6c728d6dc26e77de157ed160f88085f15a3a60640d8a372ea6f420247e1e1fab_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/cloud-network-config-controller-rhel8@sha256:aa6910b66a9781bf5d9ea4e467ebb89d8cd340700c72e902ddab1e2c6d943954_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/driver-toolkit-rhel8@sha256:4e6364af8c347711a3912d959f600f5c3d9b77e61db79b35112f75381c044380_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/driver-toolkit-rhel8@sha256:586c70094b8e3ea5a5116431ef97be824a5fdb6f247dd99feff9864ffcff38d8_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/driver-toolkit-rhel8@sha256:6cdc43857860efefbe8a4da3785631003c7a6f2f109729d5552b49822096aebc_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/driver-toolkit-rhel8@sha256:ddecc0d2f89e7b3c34f8fc8e197d13acd08fb718678812c097faeb48c100a04f_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/egress-router-cni-rhel8@sha256:41b29873cf6ca321c181696f336c0b56c0c956b40dbf89169dafac3cd38cb8ca_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/egress-router-cni-rhel8@sha256:7d318c901de3bb9ec2ab4d428791e9f46d59881f27f655904556b4e5c844f5e0_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/egress-router-cni-rhel8@sha256:a862cafc624e8dfde79690352b1e55d2bb08797e38095d13c2f15d625222b43e_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/egress-router-cni-rhel8@sha256:b81b527e5b2fb5998509826a3d69bf515a53b9a894a61d29f571636a34ccc364_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/network-tools-rhel8@sha256:0176d1a928803fc7229e4a1766d342e2c4d8a95f372468cf66a7aa24116240f0_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/network-tools-rhel8@sha256:1d6224a9ba5f9edc265883852ac6ab1113d136224e455b504d5ecccaaf9364b7_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/network-tools-rhel8@sha256:bca66e4a28051a9d80fe54ed71088d52ce5dfa2d8004e1da99cdb8b3f73d2d53_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/network-tools-rhel8@sha256:c81a73965f3cc48997ea035c24077d3e8d349c294636cefdceea039617996064_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/oc-mirror-plugin-rhel8@sha256:1263804d9a7b94057f4810f4aa550a1b42bc8f11a3b7d157faafd4d41b713dfb_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:3632370c741106d3b295f93b45b637974727b57bcab31953e37bab0faed81723_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:39df3bb702a044edbd0d10a2bdd4bc1dc5e51e211010fa54ff1ed520af58369f_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:dce9feb240b3c7c4f501e42a75d083f621e906ce1389473d7950ed40fd9e8bbf_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:f2308e25affbd9b1c72175f6b836efe77821d6b8dc890092d16bf76ce7185090_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:64e0a1fab210d1e7eae4a703ca3119345fc50e964d7608cf66df9d7a24bd340d_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:81121a233b09292b73ab369dc2014d83391917a4e0d4c40dc05f0b53a2933f2f_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:df836fb4f5512e211e180e30ae6fe4497873bf3c3bd70f9b26487f590dce39d0_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:f9c004825c1b68a8837909c6c4f179ec3cc6e99ba9e594eb16d585f7e3d0ed97_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-node-agent-rhel8@sha256:1314c8ef9902d882e0e1a67cf7de34392138fc437fd0a8670e87864035671201_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-node-agent-rhel8@sha256:3675e5e1f1749c5acbfe0cd9b041bf14980fdd1478ec08c05684be1367ea99b5_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-node-agent-rhel8@sha256:e02de470298566fccbda6adabb17564cb23149dc15d11cedee89151aa96703a9_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-node-agent-rhel8@sha256:e8835494aceedcffc9804fe20ad74200b86bac07441e79e5771e8a06cf47f500_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.11 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.11/release_notes/ocp-4-11-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:21cdff7479a52bc09392af6b3bdb6b347b8df8b3c444e5102f7c22325e0330b5 (For s390x architecture) The image digest is sha256:f1bea958d2250346422658ee513431b70333a53f5c1cff1edbe3216980efa09b (For ppc64le architecture) The image digest is sha256:259d68225f95501e895edcc228f08b52ff44459c72941344994b83aad018ee66 (For aarch64 architecture) The image digest is sha256:fcd12b7868b42afa10f980a0e1d563f713994ce525233634292e084fad662dd8 All OpenShift Container Platform 4.11 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.11/updating/updating-cluster-cli.html Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (6)