RHSA-2025:0832HighCVSS 7.8

Red Hat Security Advisory: OpenShift Container Platform 4.12.72 bug fix and security update

Published
February 6, 2025
Last Modified
September 4, 2026

🔗 CVE IDs covered (4)

CVE-2023-6597 →CVE-2023-39325 →CVE-2023-45288 →CVE-2024-45338 →

📋 Description

CVE-2023-6597 — python: Path traversal on tempfile.TemporaryDirectory CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) CVE-2023-45288 — golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS CVE-2024-45338 — golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html

🎯 Affected products19

  • Red Hat OpenShift Container Platform 4.12
  • openshift4/oc-mirror-plugin-rhel8@sha256:6b3b209bac78e19a10cae1a695ef9eda467d63267408807d6d17ce29330331e4_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-baremetal-installer-rhel8@sha256:ab108b15d95163b090a662ae675a8b49162a4f2619176f0c4a44dedfa5e330c1_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-baremetal-machine-controllers@sha256:4dae70d81c731a9fcf182d5319fd43cfcededdbdc7385a18400ca86bc2b7d92f_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-cluster-control-plane-machine-set-operator-rhel8@sha256:a7329dd56c7889cce9ea35c768e228a553a7430a54d31cef08f77a4fd905a002_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-cluster-version-operator@sha256:0107d7cca7e45386e05c715b6c7d23974c69f2132a86cffdbc22f902cff93d4e_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-docker-builder@sha256:b2c7f40116d217c3b39a38e53988dd72aeb32c7250cd9a8c1125686485ef887c_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-installer-artifacts@sha256:9d405ef717d381d8f036b7f6a1435e17bc52945f8bdd83d683de294ce651400d_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-installer@sha256:88c983b01cff2ee2fb3a9fe2ab3f04b3aad9288734426046f365b9092d302929_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-ironic-machine-os-downloader-rhel9@sha256:1890b1da10883d2995bd2585647d126d146f49732442ef0bd22d69d41a6ee56b_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-ironic-rhel9@sha256:86b1d13fe787b8c1f22dd0ccd7af3c8f99b0dc0baa9a7dc9f627cb9609eef770_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-kuryr-cni-rhel8@sha256:935d855e895729b572b4a8b312704cec4a215e1aea6201ebc7f3241d85f0029c_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-kuryr-controller-rhel8@sha256:93727bc97db674dc84a35ea3ae1ccd35c50fac9bd997500aa0ecd07e5dfafc25_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-machine-os-images-rhel8@sha256:55b4d70c0807df31290bdd29779f21bca82c6e58a945d6e01c024b8a2c81eb70_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-nutanix-machine-controllers-rhel8@sha256:2c753982551504bf5177f83d537b47a5239a4368f45fe1e025102c23e38681e8_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-openshift-apiserver-rhel8@sha256:2b51f7a6b335445ccead3e05a3ea052f603d7687c29e4ab0a9d33a9442af8af5_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-operator-lifecycle-manager@sha256:2a3c3dbbcdbcb06fcf6cfcfbd7c8814348732171af789a08c56c34df88884b82_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-operator-registry@sha256:4ed8196c1caa5101001b302818cb74068db130a3850a5b9c9d219223e00a7c44_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • rhcos@sha256:e2715538db20b6d971b16b7c52d2137113aefc4830440cb257e570cc31b4de86_x86_64 as a component of Red Hat OpenShift Container Platform 4.12

✅ Remediation

For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html You can download the oc tool and use it to inspect release image metadata for x86_64 architecture. The image digest can be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha value for the release is: (For x86_64 architecture) The image digest is sha256:678a46017c31128166b20c11ae17bb17ab2c6cc4320a8c3ba552cc08f9430a9a All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2. Workaround: In some environments where http/2 support is not required, it may be possible to disable this feature to reduce risk.

🔗 References (15)