RHSA-2024:6642HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.12.65 bug fix and security update

Published
September 18, 2024
Last Modified
August 18, 2026

🔗 CVE IDs covered (4)

CVE-2023-45288 →CVE-2024-1737 →CVE-2024-1975 →CVE-2024-6104 →

📋 Description

CVE-2023-45288 — golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS CVE-2024-1737 — bind: bind9: BIND's database will be slow if a very large number of RRs exist at the same nam CVE-2024-1975 — bind9: bind: SIG(0) can be used to exhaust CPU resources CVE-2024-6104 — go-retryablehttp: url might write sensitive information to log file

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.12
  • openshift4/cloud-network-config-controller-rhel8@sha256:0bc0a3abe42c1d4d00f8c40bc0d37f1fc7e50b4f2400a2a64febeee04f1a3749_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/cloud-network-config-controller-rhel8@sha256:7bc01621644cbeafb5b466b906a6bc0ded472d42a885a814a677d965d61a84dd_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:4a86ecce18180d41796f96d2999a63c4246cee9fa4622f623f0079e854b5167c_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:4f03de3dcc9c22fc8978f7d6e28f0ca94b4f8fd1bb5089a9afd80754b888dab6_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/egress-router-cni-rhel8@sha256:2ede36711da904cb2f22c49f46dce4cc516a6f2de3ae0dfa16972a8cfa61eb42_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/egress-router-cni-rhel8@sha256:adc7b464ced27b3b306659d538618a4b0324abf778f7c03019e77d1c5969158c_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/kubevirt-csi-driver-rhel8@sha256:231003dfca8c1b17b62b8d7fcfeea15ed69b816ab1419954f320fb795577ef81_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/kubevirt-csi-driver-rhel8@sha256:9d3cea39f19e6ff4db8d6b77bda770d724187c1f6536aa7f7ee2c0115be4c22e_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:c50d84192afe967271557fb31bd62972054fb8f828a519ab3db7a8ab28ce3b66_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:d2b5dfaa5f5e21b59482fc3578e8643b9db16cc2f79a64a8b2f26d7aca09bb88_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/oc-mirror-plugin-rhel8@sha256:fbdde3d961b256d51f04c8e808a34965f675d1b885559dee87c8c77fcb2aaaae_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/openshift-route-controller-manager-rhel8@sha256:56b11436695adc1c15e90891b12082b287fd924cb35c4b51d2c3c821bdb9b05c_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/openshift-route-controller-manager-rhel8@sha256:816a8a8cab217315a52aeefb92efec852e966b22916c6efba8c839b1038ee178_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:0526fa7e32d4cd5e844b5892f2e2d4566b30503e182639334c84dd7cba3ce8d2_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:48f1429f204cf35cb65354ebde8a360c9f4e7d7481eea7eac05898c1da0eb812_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:2b50cf0748eb52191896942fdd4b0fb741b12b4538d2316d216d58edd9c43889_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:5b0a9e6c9219574ad4be1167a4a720c5030cb2e1c1ef8e9f684a3995c5ea97c6_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-node-agent-rhel8@sha256:691630798fabfe8259b3aa5e7628449e0a01d377e9f8a823b3f352567fceb138_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-node-agent-rhel8@sha256:9aa085d23f4dd6e11f4b9f40da1957c8d69a6afbef095af37e5a007cad099724_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-orchestrator-rhel8@sha256:7e7596bbb70eef8176009c11fbf7659243e599fa3c5e961e5726305f6d5abe69_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-orchestrator-rhel8@sha256:e985cefbae0d954f7250f63cd4476ef6118bcf73de672c9545a27edf12274e12_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-alibaba-cloud-controller-manager-rhel8@sha256:9cde0ed5e7148fab6d3d6aa6e2b158aaca28afedbf2b3bc4bafb81eca12fb806_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-alibaba-cloud-csi-driver-container-rhel8@sha256:61afbe6000e93292a61867afe8360db29f65cdd14668ac568c4202de66b5eef2_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-alibaba-disk-csi-driver-operator-container-rhel8@sha256:de1ab514f2f15229797f5286590d15b3dc256f557170f762765cc2ed46ff69ad_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-alibaba-machine-controllers-rhel8@sha256:d499a9439b830866e6fe743d27977fa29623895bac671cc0c0d6eb9c5ceb05ed_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-apiserver-network-proxy-rhel8@sha256:2498286182ffe47553155b046af0d930da889d2913acce336423ef60aad35fab_s390x as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-apiserver-network-proxy-rhel8@sha256:505949ad62c4c1ef879771692a1a62cddb6715c380ae2107f0d9ed66f944b1c7_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-aws-cloud-controller-manager-rhel8@sha256:c2c3d17760f7c61c06d35c315a335b27de7359dbf38e4b48c4d9048dec88e98d_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-aws-cluster-api-controllers-rhel8@sha256:0552b4b3886697d1c008024ce4cd08e7e898fd27c9a217aebb85231079ac0f04_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:9814dcb2e5fd5def12b0103feef3a7651f30b65c4259a8c1864a2f0d5dc5b1c6 (For s390x architecture) The image digest is sha256:040dae16155ee888e8b9a91f00dc6fede262d2b8024dc1df949f0dc2480f0976 All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html Workaround: In some environments where http/2 support is not required, it may be possible to disable this feature to reduce risk. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (8)