RHSA-2024:6632MediumCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.16.12 security update

Published
September 17, 2024
Last Modified
August 4, 2026

🔗 CVE IDs covered (1)

CVE-2023-47108 →

📋 Description

CVE-2023-47108 — opentelemetry-go-contrib: DoS vulnerability in otelgrpc due to unbound cardinality metrics

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.16
  • openshift4/aws-kms-encryption-provider-rhel9@sha256:59ba3b40896043afdf550515c32d77d4552884309826e76b38108c42a95c23cf_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/aws-kms-encryption-provider-rhel9@sha256:70b2530b207bc0b05fdd003f9c8b5025a7e8b3d6f5f98e6770efdff13aeb8f15_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/aws-kms-encryption-provider-rhel9@sha256:7e00fac9b2036aec8b23cd23b79f4a065c264d3b7ad82ee5e9851098dcab3610_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/aws-kms-encryption-provider-rhel9@sha256:8abe1fdebb80c699929b91d455d4ea1e9ef8456e344bcdfa0a7fc12c18f0ade3_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/azure-kms-encryption-provider-rhel9@sha256:07e806065ff2fb503a720bfde9e202ede9e6673ac525a46ef4d19fd36e84b5e4_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/azure-kms-encryption-provider-rhel9@sha256:142f3d3508e4363cc5340a1ebc02c46f9d35e9d8950d319e22eba9317dd0a40a_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/azure-kms-encryption-provider-rhel9@sha256:28a496adea96adb9bc4351439a27c3293123f591e0a0924384fff08dfaeea717_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/azure-kms-encryption-provider-rhel9@sha256:68524f267c2aca4324dbac4844892e7c728e24ae4cedc820b20890461555ae37_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/cloud-network-config-controller-rhel9@sha256:112cd2de0d7ffeab4e23e0c5cdba84a8ab45f82cef49c90e14b91228573ed041_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/cloud-network-config-controller-rhel9@sha256:2906f1c7e98f874365d6501dc2c59d40e0fc8dedfbff66e5db9a1248c65d2a9b_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/cloud-network-config-controller-rhel9@sha256:86391af106782ad3935dd969fe7ced1862d9dc57cfd449d7b8a333cf2187e55d_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/cloud-network-config-controller-rhel9@sha256:f48e9611092e211e0fbc5c6554165b2686cfdf4cee00b0d553b7e4464432a22e_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/container-networking-plugins-microshift-rhel9@sha256:4a002bce483e68ca6913c955c521d4bb284954b83326d2c62b96822b92884026_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/container-networking-plugins-microshift-rhel9@sha256:7d2e6c93bea439fb1699295391297ffcd0741f03cb88502ea72cf9c1e9ba3214_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/container-networking-plugins-microshift-rhel9@sha256:8693f0ceb6d9c822a1900cdfa22dfca82084ba79cb2ae2769742316dc5e564d8_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/container-networking-plugins-microshift-rhel9@sha256:b5b04c9255270547438a86d10fb7738e793085f40b410f5ed51db10eacd207ef_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/driver-toolkit-rhel9@sha256:bea64961d7d13237b320e7f7a0c5a330549510da0da0e860674a4e9024b56406_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/driver-toolkit-rhel9@sha256:da79a292c75b71152f7693ce63de586f1d083ccc2d271913b6f64bb4deadf4d2_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/driver-toolkit-rhel9@sha256:f0760a244ba091901679aafc75da3c8e338c3ca5125451cbb82f31d02d97b686_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/driver-toolkit-rhel9@sha256:fd892a4fd86e34a255f3c28ef8b2a84b076a7ccf152793bdf5373a15e301c51e_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/egress-router-cni-rhel9@sha256:29fc4bccf8c63fd1bab26d5933441db391d31bffe42c59660165ba9126e3018a_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/egress-router-cni-rhel9@sha256:37658d3f38c023db302becadbea0c295f3caf925de321d3bfd9930ee8bdf8e95_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/egress-router-cni-rhel9@sha256:77f42208bc3689dd0815b9f84c0bef47e70031541cda504a3ab8bc9f906aa078_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/egress-router-cni-rhel9@sha256:f2ff2e35efa8fd4c96e163dde69e34164df3728e04346e6557d9825a06ad75a3_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/kube-metrics-server-rhel9@sha256:16246d2b68afef1dfa4cd32ced56b2f81dd36ecb1b79b9da0cad2946419a6802_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/kube-metrics-server-rhel9@sha256:8e53e584613c165387698ee2165a3d037d8b27537f64ce376f6bd1cc3762c157_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/kube-metrics-server-rhel9@sha256:ab65fe7313574d5511b7d3447889d2f46339a23b1207438e2c4fc9cf2186ef23_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/kube-metrics-server-rhel9@sha256:f73dafd24a1f92812ff03e1bac5cd940270b1b5c1c62307cfdf84abfa168807c_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • openshift4/kubevirt-csi-driver-rhel9@sha256:0314af3e9e6374f07d13811e2ce2fbcec57809b679cd07919c3741814bdbb59a_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.16/release_notes/ocp-4-16-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:2a50e5d5267916078145731db740bbc85ee764e1a194715fd986ab5bf9a3414e (For s390x architecture) The image digest is sha256:3b7185cda1eb48ab49e675adf68fa8f43764513ccd30e68614bc897dd3ef8f8b (For ppc64le architecture) The image digest is sha256:033e475aaa8f0438bcd642bbe481f596a6bb5c13d61f844e7ea66d7ee205de19 (For aarch64 architecture) The image digest is sha256:00ba85049b9ed37766c07ab4d7b6ec207a48c8c469e22d1ea2038b5850425600 All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.16/updating/updating_a_cluster/updating-cluster-cli.html Workaround: As a workaround, use a view removing the attributes. Another possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.

🔗 References (25)