RHSA-2024:1681HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.14.20 bug fix and security update

Published
April 8, 2024
Last Modified
August 14, 2026

🔗 CVE IDs covered (1)

CVE-2023-45288 →

📋 Description

CVE-2023-45288 — golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS

🎯 Affected products9

  • Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-hyperkube-rhel9@sha256:8b1f20d39e7d561bf6a16c9bbbe684ebcd74a32ba4607bddc14ee55e382737b5_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-hyperkube-rhel9@sha256:a28d7d13bea532cbf4ed7eab7f1938d2bb8a4b0c5b0b1b881c08f62cf90d1480_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-hyperkube-rhel9@sha256:c74999c46d4ffefd7ba95c2de266c25f88ede3cddbd7e8f8991adb0d09f65cb2_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-hyperkube-rhel9@sha256:fee9325d33ee3018137ac887e6a643a0c1e33aa55990793f78ef25a78bd2b36f_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-pod@sha256:7e02c7eb49a1f1999d8d15d66585f007e56c9d8e14e1f7ce344dd18a2cc9fc77_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-pod@sha256:a84d2a4c63f9a9822c850702cd6a52183fd938491c4367bcf591c32d4fc77d70_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-pod@sha256:ce1ace9c48b371094fb51ccc5d5a8466c821acadbbcec607d27731ef631859dd_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-pod@sha256:ed78be79d7cd9d49777884df951ed0eb74a9277a76d3ed089878350c6fa1d233_ppc64le as a component of Red Hat OpenShift Container Platform 4.14

✅ Remediation

For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:e64464879cd1acdfa7112c1ac1d90039e1689189e0af197f34881c79decda933 (For s390x architecture) The image digest is sha256:d0301beb82f562d108825ab74a6217eb1cc7d906a30b60c5e0a0ab442158c8e4 (For ppc64le architecture) The image digest is sha256:73d75ab90d1b96a19519b0d21e424d72b83bd2e46125758f7d0768918468fc65 (For aarch64 architecture) The image digest is sha256:33678732f853fb4edc1b0882c6773d8589a67ba7118342f2e5a36027abf2b634 All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html Workaround: In some environments where http/2 support is not required, it may be possible to disable this feature to reduce risk.

🔗 References (4)