RHSA-2024:3889HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.15.18 security update

Published
June 18, 2024
Last Modified
August 14, 2026

🔗 CVE IDs covered (3)

CVE-2023-45288 →CVE-2023-49568 →CVE-2024-4369 →

📋 Description

CVE-2023-45288 — golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS CVE-2023-49568 — go-git: Maliciously crafted Git server replies can cause DoS on go-git clients CVE-2024-4369 — cluster-image-registry-operator: Exposes a secret via env variable in pod definition on Azure

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.15
  • openshift4/driver-toolkit-rhel9@sha256:6cb4a6001f358ec517d8961c9ac4e7e8effbf1e5f0c2c8f4cc240ccfedb8114f_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/driver-toolkit-rhel9@sha256:a066a8ebb8426649a5c97ae5d738d27d3c59f01c3a1894ccba9ea9fc37fec120_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/driver-toolkit-rhel9@sha256:d3e2beb36968fc6d343a1da814af12560c98183e6b7ed25e9c747ece757ab9ce_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/driver-toolkit-rhel9@sha256:efa99ae171e7db22aa2d320b7bc78e950db01987889b6a8529e1945670e80792_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:59f9a5a312c50c216b3482525d52925172724d6aaa65935ae29a01a4d5d3e620_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:9e9ddf722c88b0bd604f3740e5ee78f661e7a12b46e0064b3b00dc663ff3cf98_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:ad03d9dd15d2f5b6aa3e85411a3b44e59b3ad261e89c56ac5d30f76a92906867_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/network-tools-rhel8@sha256:f9d9ef4d504a24a640414f36e4e2c54973c231dc544e852abe403da73c21a6a1_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/oc-mirror-plugin-rhel9@sha256:55de167130427db6fb2150e0d95aa2e10d494be2cace106fc64ecd9f0f1310b9_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/oc-mirror-plugin-rhel9@sha256:8617fddf9478f1e4620e2025de9df8b03a8ec0e599fcb7014ce5a995b5da3158_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/oc-mirror-plugin-rhel9@sha256:e5aeaff5299f74b0997c4de4947c0a177710f0ec15869940df153f02f443d404_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/oc-mirror-plugin-rhel9@sha256:ef5bc52a0e517ffef1b399921e5de5c73e8d10de4c06062e53ab06e5ec50eddb_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:637e31a397a66c4a84f5ab2c9f8996c972ed65785d115a233c92df3f5b154c77_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:7c14d68a7fccf34adcdefc320e544115d1ebff389973ffe59721ee8991d5609c_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:85539cfa69e177b6551d55366517193849df1968a59c39d7c419d9b00c1a1665_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:d9473abc4cb2fe8c58381ddc0a606fa39a163733a803a727921200b006f525e0_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:02b146da7bc5f147a816ff50a67e839246d74393d21ae0330e4683ff19afb28a_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:34567f4292fad4f14c71da7cd6154759e2f949bb798be0b23ca0efc85362ba71_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:c30777fd5a2f84236e569a52d8525eb7214c6319be17c6d63a91776ae0d52563_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:cfaf5ac2b2f74ca0bf3d13a9dd4c9ccc11a9dd501cef2cd807bd4562911798bd_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:00029007cf2e962d67f99aad29b696bb49591c9a1f1f72cb2e03ffe37b8b23cf_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:a562637c1b5fc36aedd0752bcab4256666a26c227bc78d453459072c929afaa0_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:a70e7ea653b52be17ef8a4ec9dd21609ea90fcf7bc5f2407bdab125066397175_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:cdc06912d402cc35f8a79c7b6cb1271ef612a9e226fc50343fd63b92fdcf913b_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-utils-rhel9@sha256:31e571fc4d5ddf95ae39a4a693fcca0c39364579f412c85e132bd5f37cfd9625_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-utils-rhel9@sha256:8305103f3ee7e77c40e888ef6f3b6ad30269989988d65161108ea9f8240230e6_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-utils-rhel9@sha256:e6606a56ac6d3985669f192fe9b2e24856b5cabcde49091e5ef637b65a0898c7_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-agent-installer-utils-rhel9@sha256:f43fbda7eae898867f6a3fc826a6cb235b3fc404ecc6b98f9e21c4bb87a84c9e_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • openshift4/ose-alibaba-cloud-controller-manager-rhel9@sha256:879aca9191c199e0d93d59b514e1a18a0b41b21f275a82c44b78b764a4377ca8_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.15/release_notes/ocp-4-15-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:0f55261077557d1bb909c06b115e0c79b0025677be57ba2f045495c11e2443ee (For s390x architecture) The image digest is sha256:51333a191236aa122045b0016a35a3501605e544f561015568cd58b4a1b93260 (For ppc64le architecture) The image digest is sha256:db6e7bae8b5ee4d9b39ab13932b55ea861d5e2c5d17a17ad730deb4224ab3296 (For aarch64 architecture) The image digest is sha256:bea5c0d194d622934cc7dee330b66cf49f5be3f4ae98e07c1cb6c8fd102ee42f All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.15/updating/updating_a_cluster/updating-cluster-cli.html Workaround: In some environments where http/2 support is not required, it may be possible to disable this feature to reduce risk. Workaround: In cases where a bump to the latest version of go-git is not possible, a recommendation to reduce the exposure of this threat is limiting its use to only trust-worthy Git servers.

🔗 References (28)