RHSA-2024:1572HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.12.54 bug fix and security update

Published
April 3, 2024
Last Modified
July 31, 2026

🔗 CVE IDs covered (1)

CVE-2023-39325 →

📋 Description

CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.12
  • openshift4/cloud-network-config-controller-rhel8@sha256:1bfc4173a222e9a8fc6fb6929a82eca81ab14b8521b0f5472f15fef6ca158b1b_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/cloud-network-config-controller-rhel8@sha256:445e4328c46ab8b8410b3ea8f2a7b4c44c6d4a4a19fed4477811a3c2ab691612_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/cloud-network-config-controller-rhel8@sha256:9afa06e38e4e8858779af842e9d7d561c205ef2cbf383f7421f4c5563c630780_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/cloud-network-config-controller-rhel8@sha256:eade2e556e8b7778b4e6456724f62ace3c5e8f7f312a9591a17a755142df072c_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:425301031f818d6740c12d96364fc234e51f3573388d9f176d377f6ab7fcf842_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:7880025666c9b3f40804d42833497bed6616107ab62954e5af5ec75209aeb02e_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:a2de076d5b77a0a059dbfbed2c6b6870544664f8f5a8f82e41aa5b696d5dcbf1_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:c32f3e8f436e38444f7d592313357ce870ae1c99032a55a524d77680e90776ec_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/egress-router-cni-rhel8@sha256:6c1c817d69eaf62c43078505b7a0751fa9852a9dc5c8f94fcb403737c51f0caa_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/egress-router-cni-rhel8@sha256:d847db171e717b9344f88466f6e1f782f24002055d91dfdcdbb3c61cbeee26ff_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/egress-router-cni-rhel8@sha256:e70e1c6754626d7cbb974fb63e846ee0a73410d44bbdd138d46de096a82bde88_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/egress-router-cni-rhel8@sha256:ec43bfcc5ac8748795fe5d7c99568654518c25fc350a9a3d11196700f41ca838_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/kubevirt-csi-driver-rhel8@sha256:3b31073cea3589a351735549b528832348183a5fbef2d92540def2ddf3c6caed_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/kubevirt-csi-driver-rhel8@sha256:8ad63946ae768a773492e43940a690d40a15db17b935a820619507545342513f_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/kubevirt-csi-driver-rhel8@sha256:bd7a7f3a52e2eb2f2cc61165969e2d9030c49ef4abdef3c10b388250ae8bd129_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/kubevirt-csi-driver-rhel8@sha256:e0e9faf61898920d0a119f88179cac8b9dcc617c92370629cddbfae96b59f166_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:2141ee19131cfdf2cf3777bb82b90548ae782ac909c6e39fabcca5f00a59447f_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:287eadc0c8f1b7e85660ce132c5194233e6e53e65c86689d5da234435befa2ca_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:68593cb07e92c043136afa3a13253b25f5bf35bb917e1922d64038a1253ad8d6_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:7ddd3597c5a0cec45698f71b5dd0a4f0142070e306528af67d9cee9c9f06e889_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/oc-mirror-plugin-rhel8@sha256:4f50eb4802fb66c99e72855a802e3ad740f6e2a363cc152f0226121de9debab7_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/openshift-route-controller-manager-rhel8@sha256:ab218de0d227fc86c10e0e9cbb3893e199da8ca3e61cbe40a9e10781473f1972_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/openshift-route-controller-manager-rhel8@sha256:beb07f5d97e2f8aede9a06c12b0ce3bd696f7a0f8e42a42a35bc476cde92c861_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/openshift-route-controller-manager-rhel8@sha256:c952f75c8164dbe71b8f46eb309b6476e301b6ad67386e8d6738bcab8305953b_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/openshift-route-controller-manager-rhel8@sha256:c95758c5694628dc1d9350866961e5347ad67c8ec1bafb01444eb0868a702acb_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:0b7728b7a25a109c827d1bc100e32dcc5d828e1ae66499ca885ea5442aa33722_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:93fcb7976b9cc5595316906e95decc3b7db14a3ae23fb141632bcd8e4819c1a4_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:edd61b9ecad2c4b9dfca84cbf30138e8332aa3751cf771d0fabf09e0991a7312_ppc64le as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:f1f62815005bbee8ceb1659b73992fd9b2f5c4f066e0f77f5c647d01137edbc1_arm64 as a component of Red Hat OpenShift Container Platform 4.12
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:5bbeeae3698249a41d6bd9987aac42cecbe862e1dd3710ab16ff4da651fc66a8 (For s390x architecture) The image digest is sha256:bede95b13f664d88047872e9bd33f279409bd0855b656d19f7680ece58202c4d (For ppc64le architecture) The image digest is sha256:2039dd7e398f378342c7a7da22f2d0256ac667786530f7e84c9774e1c52ed654 (For aarch64 architecture) The image digest is sha256:cbfa54f51753de26dbf452f30c7e105ea80c653ef3d381f6c31f6724854b3322 All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (12)