RHSA-2024:3885HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.13.44 bug fix and security update

Published
June 19, 2024
Last Modified
August 14, 2026

🔗 CVE IDs covered (2)

CVE-2022-21708 →CVE-2023-45288 →

📋 Description

CVE-2022-21708 — graphql-go: Denial of service via stack overflow panics CVE-2023-45288 — golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS

🎯 Affected products73

  • Red Hat OpenShift Container Platform 4.13
  • openshift4/driver-toolkit-rhel9@sha256:04e62881d62f29c42c34315c168e95be05638319f837a95ce33a4a809bcc34eb_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/driver-toolkit-rhel9@sha256:32a45fe91d772fcd95caf1eb8f22e0b563e21afc047cc55306d2066d60b03d53_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/driver-toolkit-rhel9@sha256:9e83556fe05a7f0a554b391c648b532c6c1cce1ac84a2c8ff6a4a4b82a05f076_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/driver-toolkit-rhel9@sha256:d0b757b2637e87c5cfde5f9f062814992c7f77625c128874454b8089a41176c2_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/network-tools-rhel8@sha256:4a55677949b70e49176e6a52233a44ff6af73d9276a9e65d2a8bd707f082c265_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/network-tools-rhel8@sha256:81153b28d936bfeb15c65153696a64942cfcc8b69eb8137950209209e49af5db_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/network-tools-rhel8@sha256:c064b412015c3c399872dd5cf7f9220c467178dbe0653337c1980236af1f4e3f_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/network-tools-rhel8@sha256:c759ae5dbcaf87ea38f254c6b282f12b77d0dc91f96685d4e496f6d5a194e310_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-agent-installer-node-agent-rhel8@sha256:13547c5ae19aeec8f4505023863e122ecf3246420641c026912a4a70730fd450_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-agent-installer-node-agent-rhel8@sha256:5430e3a67259c562dac5cd6d49eb21b1c3f5b82938d089b17437394ebcf50684_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-agent-installer-node-agent-rhel8@sha256:89c8114f190c3ad7306c1cb256583d283f428c86291261625f858252415ca248_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-agent-installer-node-agent-rhel8@sha256:de9ea9a2075755dd539046b8b756ed83d31c358955199ae2b9fe64f8b84a7f09_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-cluster-autoscaler-operator@sha256:08597e654d3b884aa8a6904da579a4b68e79959207b5535e87c28dae02674928_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-cluster-autoscaler-operator@sha256:421243bbe109af18ff3f10f181bd5c6d651359ab79d60acfa1e24702407873c6_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-cluster-autoscaler-operator@sha256:66cb2e01f515314f01de1befa449cb222d1c93321e60737dace8a9028ad05cb6_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-cluster-autoscaler-operator@sha256:a894c5551d75f8ce74ea97c1a11af018ca0bb842ff78092ae4214c0e86297c0a_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-cluster-ingress-operator@sha256:6fdb4f7d6f11a91f7254c0224ec37cf74de1e3366d21ca1b0f08e0d252509dcb_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-cluster-ingress-operator@sha256:aab2b06ee3becd839427ef3debbeb7b006a1b9d90aebcd9e539c52603f8a5fa0_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-cluster-ingress-operator@sha256:b7158ede2d812f766fa6364d7329c847ae1fc851684936498eaa2272774fa994_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-cluster-ingress-operator@sha256:e3ac9a9f0979237ffd23c4c6d395fc69bfc3b1a827e7d24af82c82c01abe5e05_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-cluster-node-tuning-rhel9-operator@sha256:04598d386cf4eab0a880589b2bb9505eaf76e858e50df1a22dd1c3bf9ced4b93_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-cluster-node-tuning-rhel9-operator@sha256:3b7ea7a2b4fbd8ea2f0086fc3b67043a2b062f568098e9ab7a1cfca6cef88116_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-cluster-node-tuning-rhel9-operator@sha256:a151b256071e0d3d067830feb8800356fe1775711c7854d2f60b95c8fd026d97_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-cluster-node-tuning-rhel9-operator@sha256:ef9041e97e2561fb88e7e40d138b7fda085ed35a028ea9ccc7ef08a48ee3455c_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-console@sha256:208cfbe094f34cb1c9b9064598e575012e0b628be823649554ad17c4786e9d2f_s390x as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-console@sha256:62c54f6490f52ee55767bbe5474c31c471a81d3d1c03aebb6c12d6a927311910_arm64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-console@sha256:ac33bfcd74a11aace44e9831b95ccb215b3258d87a3ec6c70f8d69dc2201d85e_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-console@sha256:cf1399e886f5f4767794f023170fb01f29122b0760c3835d2eceae371fd08bff_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • openshift4/ose-etcd-rhel9@sha256:3f09a9f6bd5eef92e8e78b4c62777bbae658d9d7adc7dcaf0b434f6d9fb75b22_ppc64le as a component of Red Hat OpenShift Container Platform 4.13
  • +43 more not shown

✅ Remediation

For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.[y]/release_notes/ocp-4-13-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:e58807c46fab369428af73bdfec64ad4b509dcbdb4586694059013c69856e8a5 (For s390x architecture) The image digest is sha256:ce1a217cebc8be9d6872ef6b4058f5b3b80904b4acd1dc519ea57fb072d6bbb4 (For ppc64le architecture) The image digest is sha256:f1597234f6ef6b7831998396d9174502756da2af2cc441c0659b5f57ced36a38 (For aarch64 architecture) The image digest is sha256:36e4d2535e5079c733c987011c74fdae2d3ef206376a8ffc8c35015176619a00 All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.[y]/updating/updating-cluster-cli.html Workaround: In some environments where http/2 support is not required, it may be possible to disable this feature to reduce risk.

🔗 References (14)