RHSA-2025:0029MediumCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.14.44 bug fix and security update

Published
January 9, 2025
Last Modified
August 4, 2026

🔗 CVE IDs covered (2)

CVE-2023-47108 →CVE-2024-6104 →

📋 Description

CVE-2023-47108 — opentelemetry-go-contrib: DoS vulnerability in otelgrpc due to unbound cardinality metrics CVE-2024-6104 — go-retryablehttp: url might write sensitive information to log file

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.14
  • openshift4/cloud-network-config-controller-rhel8@sha256:3e2ec8e28365fad1739ddc79d39f6569b0a550188d17ba69aab191b671014595_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/cloud-network-config-controller-rhel8@sha256:b0d01bb1cc795284f441aee36316a180b48ae3cdc16b94252125defbf2926ed8_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/cloud-network-config-controller-rhel8@sha256:c0fc5dabe373f70bc584b4c1257b8381243605bb5b9a0679d8e7f86c2b4cba9a_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/cloud-network-config-controller-rhel8@sha256:ca08e3e28b485d3d6c21f0fa81713ea95541571efea591e3bf4507e4bd6188df_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/driver-toolkit-rhel9@sha256:0381d45ddf65793d36166122580f8e3d1622f51006a36209dc9382b9cd651e0c_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/driver-toolkit-rhel9@sha256:4beabb66c7a90c998bc40ec098b1ff0aa9ba92db71038e4d5062171766e97525_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/driver-toolkit-rhel9@sha256:8188c1162cc17c02135842bf50f572c8db207dfa0f6592f13c52c386456799eb_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/driver-toolkit-rhel9@sha256:ed41c8c5fcd81fedcc0e245f3d409ac11c8cf181bd7b85b5b0d1d86a1757ae97_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/egress-router-cni-rhel8@sha256:a5a88657647344b20231939422651da1a24a7a2690b6909c5b7828d68bfb0096_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/egress-router-cni-rhel8@sha256:ac0316a927e1acd5f08431bbdde31044d5ee805625be2c47fa3b3290b48ed029_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/egress-router-cni-rhel8@sha256:e4fca043e03bc54a6b33f227f69927c4916cfa3c07f5addec28793da66a70f21_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/egress-router-cni-rhel8@sha256:f56e4b05b4f3dbdc27a2fe164e9ce473d0aaa696d7f892d353cb2aff1c984716_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/kubevirt-csi-driver-rhel8@sha256:01b0fb836579a8c0b749e48d4b20d467b1c0ef7621263f97aef1f4ee9174cb43_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/kubevirt-csi-driver-rhel8@sha256:cc333ac4d0cbb2e19063ed110c2b1cdf3fe2d5d387ac73452a86631cc97bb127_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/kubevirt-csi-driver-rhel8@sha256:ce14ad7dca03fd1483460c93fc157cc93686bf815dccf5e7a23131e5e2f4ca08_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/kubevirt-csi-driver-rhel8@sha256:dbd9ffcd8f9510d89514c97c653182819469efca646e52d9da3a29eb188bd9e1_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:162bae6469ce1002e71874b2d2c5dc88b7d35a7d6941e00aed12994d40107722_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:1b2aadf3c84f65e5ec02035a2fb91216a5b1bf0c2b3597c186e8140ca3c52887_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:28efb1168c39ec562529d80345a78b57362baf59c34e5fb17ed00c35094a8668_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:c28d33f13428dfa997b1bc6065420b37f3043216b1369819379ac2e2400e1026_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/oc-mirror-plugin-rhel8@sha256:31c863f891453b5275dc6447495f435e34eea6272cd8cb647ab18f5ef8ea805d_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/oc-mirror-plugin-rhel8@sha256:7e8e9a1c3cf8653521d6d7c4cfe9b1cb9b9b8778fa17245b9a5ed8a0f783621f_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/oc-mirror-plugin-rhel8@sha256:937af2a9c9875cf2606338ace54355bac71ca93205e27895f7d4480c9a45d469_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/oc-mirror-plugin-rhel8@sha256:b86bb68e753eb4f39ef2acf75d573ebfddca3d289098d2072c3df5d7279f6c04_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/openshift-route-controller-manager-rhel8@sha256:4e6c76404c464bccc61e638b49556e2644901dba2d8a43a5435a44a893068b56_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/openshift-route-controller-manager-rhel8@sha256:74a32a850c3455f01529ae74dcecb3c213a5603cf0f5c6f69b24a467f48c0c6b_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/openshift-route-controller-manager-rhel8@sha256:80273a79f0ed2d108603f719fe11d4b5e12a3a4b05803e4968288dcfe5cfef74_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/openshift-route-controller-manager-rhel8@sha256:8ae7ebdd8520ba9455c29b0475411b7675d6fef875078e4fd7de87efcf6a59e2_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:1db734f80fd64e8ccc9cf46890ab82a7ad81d62d5250aba4fca24b4ec1d053fa_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:09aa91aa34ff624766cf989c849cd6c0d843f655eb45cb9dbab2f32e30092dca (For s390x architecture) The image digest is sha256:29a98df3cc653059dae27ba0321c9b7ac7d93bfc5666519062d19a9966e304a7 (For ppc64le architecture) The image digest is sha256:b4b2a2df9b048a922f9c835b0bdf58b0b2ede6a8e40df54375e7a91d8eea2295 (For aarch64 architecture) The image digest is sha256:ac92b944142b1bed9deb50ca6310537c391bd3f2bfaeac2a712800f4d654f907 All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html Workaround: As a workaround, use a view removing the attributes. Another possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (14)