RHSA-2024:3523HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.14.28 bug fix and security update

Published
June 10, 2024
Last Modified
August 2, 2026

🔗 CVE IDs covered (2)

CVE-2023-45288 →CVE-2024-28180 →

📋 Description

CVE-2023-45288 — golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS CVE-2024-28180 — jose-go: improper handling of highly compressed data

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.14
  • openshift4/cloud-network-config-controller-rhel8@sha256:104c1072ebf1c5f584519115e7aea1ef552e9cf498bb80d39e13e5b90aa17afa_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/cloud-network-config-controller-rhel8@sha256:367e021b38394dee87d29199851464898403c083a68c0b4086d3dd741fbed02f_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/cloud-network-config-controller-rhel8@sha256:c3a8125352b48d219aad322391954684ee0d9fea606b63ecb8049f3396f1c3da_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/cloud-network-config-controller-rhel8@sha256:d6b064e107c98bf9b9fe5099ea3c3ebcf5e7036908a3dd7b96d59cbcc2206445_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/driver-toolkit-rhel9@sha256:1a658c8d15d3f3cc6b7ee4beed19076e2fdbff3087ce32570142570da8509e35_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/driver-toolkit-rhel9@sha256:4225dcbd31188f1fcedceff57215cc6a18b6631e2713f3c6c9d7a0558e82499e_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/driver-toolkit-rhel9@sha256:50b7b5b0278a1307bdc3bc89498aeaa1af63df53f3718fd5fb30f47c2311a763_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/driver-toolkit-rhel9@sha256:a8fb995dffc8a5e711cde1c61fc4b638a19789b92422dc09b41134fb3f901478_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/egress-router-cni-rhel8@sha256:020257efc7de8baccfb09653aa35cc9575a3a94d47a6c7a3e9a1a3cd6894da7a_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/egress-router-cni-rhel8@sha256:0f7265ac1d38fc747c17ee0b8b24215d1066a78d30293f41b9f12883e99910df_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/egress-router-cni-rhel8@sha256:eb082c4ce5f7c9012108371bb358ba5ee767bbb5477c61aab897dfaf15697a7d_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/egress-router-cni-rhel8@sha256:ede56917fcd57fffa422a411f988bc251efae0627164a8da0e7287f1581907b8_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/kubevirt-csi-driver-rhel8@sha256:03543d584346240269fccc4209f1ae0d8036cd23bbf9f7a35c0f53ef4d2466d3_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/kubevirt-csi-driver-rhel8@sha256:2b0d232206af97211c1ada24de7af642a3fbf1882e32a0fc5ff8fed979bd5ec7_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/kubevirt-csi-driver-rhel8@sha256:5bf6b437eeebd5ba1f6b2d9dcf8691dbe3708b9cc8469d4bf59b9280b9d8acf6_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/kubevirt-csi-driver-rhel8@sha256:e6e633adb8b220bfa2b7896b3cd1c70bb9fd5af91220678efbc0e9f381d30c46_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:258baf2f189049b31aa1881710dc01d0d29e15be770a9fab4b926144fbe6c653_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:48f97623ce77b3e72dacf45fd505d3112f76276d8050a187b5e5480ae886c53b_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:8e71ee6b2964730cc8dd5a16e1e97f484bd88145279f585a7dd5d884b229d3e0_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:9ef78e1bda5ae0f104d4be6c2191efae417d1a1b393bd4ebb6cd2986e5562e72_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/oc-mirror-plugin-rhel8@sha256:07a3c275307c78dd7c3ac7f3f5fbb556c307935e6ddae4abe129a6d400658657_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/oc-mirror-plugin-rhel8@sha256:1430a0d3a31cbb3ecd0732e61795d677d8d17a9fbb3fd11f3d328f632c93910b_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/oc-mirror-plugin-rhel8@sha256:75795f73874e9c0b1317bf042c0770cb130428b9b918617ae134950d6060becb_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/oc-mirror-plugin-rhel8@sha256:95afd5c92205477405a4b489530bd1f31642942c1e609742dcc7875925fcecf6_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/openshift-route-controller-manager-rhel8@sha256:657301ebc191a8a4b760e704484b531dd98d8ac86e71f4867ce616d222f4bff1_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/openshift-route-controller-manager-rhel8@sha256:69fca66c9570ea4b3bac4e0a557394779f90e7873b2f00c8465bae4846009011_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/openshift-route-controller-manager-rhel8@sha256:7c8c9cfa51e7add71b55bbab465b547f9fb428a7e49c99ecc8c3f9ac8b9139b2_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/openshift-route-controller-manager-rhel8@sha256:88cf881a35292d4319b604f90b8564255a397f7c512cc927609011bda8b2a50b_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:e195a6c0376d797e75e2fc8cf8d236ddcc19e701b5ff604f71d8174440fd48d6_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:c5bcd0298deee99caaf3ec88de246f3af84f80225202df46527b6f2b4d0eb3c3 (For s390x architecture) The image digest is sha256:5defdf47eb8a3c49588177c95f106940c8742274146ce2132dffbeda78a7d23d (For ppc64le architecture) The image digest is sha256:039c7dcc2e4e3a852f420d4633849a964f37aeb842e759ca57f13433cf2cb027 (For aarch64 architecture) The image digest is sha256:0c16bcda52b57ff491b094201fa40fb8aecd67b1f79e412e6f694168798a9363 All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html Workaround: In some environments where http/2 support is not required, it may be possible to disable this feature to reduce risk. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (20)