RHSA-2023:5697HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.11.52 bug fix and security update

Published
October 18, 2023
Last Modified
September 17, 2026

🔗 CVE IDs covered (2)

CVE-2023-2253 →CVE-2023-39325 →

📋 Description

CVE-2023-2253 — distribution/distribution: DoS from malicious API request CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.11
  • openshift4/cloud-network-config-controller-rhel8@sha256:194fa87f55a11dd11b9dac974d9bc91e7e4c366230cf723d97259c52dac0eca7_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/cloud-network-config-controller-rhel8@sha256:244d55c7df02c4375d673a371708245f1db2f7971a8c10e51776430f83ee98c4_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/cloud-network-config-controller-rhel8@sha256:2c99ba1d73ac4552890b26f3511c3eb0994d481d27dec87c043e85d168fda71d_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/cloud-network-config-controller-rhel8@sha256:df3c5fc3f511127c00c5a3194a4490420e3532e30196417fb4455f3f61a5e402_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/driver-toolkit-rhel8@sha256:1c0e72b411a074e2586a9630addeea1e73e8697c3fa3d7896b29844a45e1760e_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/driver-toolkit-rhel8@sha256:90316067929551c2ff8eec52efc782cab327c7b29cc43030755296267b6d61f8_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/driver-toolkit-rhel8@sha256:bd30e72812c138720fe75e5ecc8519ec369c50450bd247e17f487ff4dde26b7e_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/driver-toolkit-rhel8@sha256:f898c07bacb1bdfc932f1c8500dd742b4e6ae0e1f5d945404f025f760905801b_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/egress-router-cni-rhel8@sha256:36dc80383c5b255fde3ebd0bb13595d2a1dab5a62bfe143bb37df245a6c4b31f_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/egress-router-cni-rhel8@sha256:3d14a9e857a9b14b1289fb00cc2d6712a932ff15f94db10b4e950b539f007033_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/egress-router-cni-rhel8@sha256:843c4640c3b8b17f59264d6d7b3d48562d03775494c836b69efef47f67a7d62e_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/egress-router-cni-rhel8@sha256:9b28cdf1976ae66f8cd2076699c69ee924c588f677c81ebea5e513dfe9eff285_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/network-tools-rhel8@sha256:690a185927f44c1772ff3515590e1c8c0c1f1b53562cd0d5b50026140aaeceac_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/network-tools-rhel8@sha256:6ba4ceb577c7514d6a3da2658bfc1130d7c4cb5fa3041751290e1dc15be89bbc_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/network-tools-rhel8@sha256:7256aa6d8ea143fff3aabe8fa9245dc02324c46d11d4ac560e4b332fef749404_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/network-tools-rhel8@sha256:a2bbbfa49db50e96f9ff19d9ca9f4f2346d052898444d6099b4ec752f7eeea9e_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/oc-mirror-plugin-rhel8@sha256:cb611f4cdafac6421df1ce22eccdadae7d85f189252633d6419f544567d540d8_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:1e56ec0cac28ebc8a5d8c154d828122e046ce3eb25173116d367eae4c5373269_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:3f0af3a30e2c0d06dde4e81787f3512eb8c0b11c42885957ca4f65d1223aac16_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:97602915419ac7566946c88f3fa1e936656d5645efe5d290d30cc4780f0896d6_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:dfa094a02af33973061529b747458f0238f79658517c31a03877bb1a7fdee480_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:2d2fadaa852375e85b13f6930162252f0d7734728fe91fc2934465bff7d0d4c6_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:446a41737aa8c64c776c2962ca0282d31dc5243edd48e05fe939cf3428924016_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:721718b539e0549d73ae13b938193ab1d206d601b1539978b1a5cc242c4e1aab_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:92fe9e7f290919e474ce95f04f6660317cb74d5ca609345e8f91102eba519233_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-node-agent-rhel8@sha256:3c33ffb8ada7db5c493542f037c8890e1ba94cf023f80f8a57f49d6d309d1e05_ppc64le as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-node-agent-rhel8@sha256:511202df4546bad8d82aec54ff24440e7fb5227913f5a3e4a1d5b46cad0682f5_s390x as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-node-agent-rhel8@sha256:599c6c66e4d54ca2293a789c1ca6ff91e7b0644809802d9b627b95981ae471f7_amd64 as a component of Red Hat OpenShift Container Platform 4.11
  • openshift4/ose-agent-installer-node-agent-rhel8@sha256:ac207d6b28f6ca6d941126e31c8394ef1981d552e369dbda9114165b62e87cf6_arm64 as a component of Red Hat OpenShift Container Platform 4.11
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.11 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.11/release_notes/ocp-4-11-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:39d2479528d17b7b8a2238af4b0dfd69658b0f33edb416ed1ffb72bf6911befa (For s390x architecture) The image digest is sha256:f39ea313651e183d91a16f2037069bb15693897f68b625c0ad7ac89eaa7c433e (For ppc64le architecture) The image digest is sha256:9a11483be22643151037d96a9d895b8898f389e48aebff86d85b0d47979a3241 (For aarch64 architecture) The image digest is sha256:639348d182763804c625b0e8fde4d0fe5817f77e57a687d6fd2370a615233df9 All OpenShift Container Platform 4.11 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.11/updating/updating-cluster-cli.html Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.

🔗 References (15)