RHSA-2024:3331HighCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.14.27 bug fix and security update

Published
May 30, 2024
Last Modified
August 14, 2026

🔗 CVE IDs covered (2)

CVE-2023-45288 →CVE-2024-1135 →

📋 Description

CVE-2023-45288 — golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS CVE-2024-1135 — python-gunicorn: HTTP Request Smuggling due to improper validation of Transfer-Encoding headers

🎯 Affected products99

  • Red Hat OpenShift Container Platform 4.14
  • openshift4/driver-toolkit-rhel9@sha256:02f4854c8a2ac829fa497f433f52e39a8b2a2c5230a2c14193080510dba95552_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/driver-toolkit-rhel9@sha256:4feae2e6bb59f667431e11e832d294fc5900c1ab38a3bb845191ee93524208e4_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/driver-toolkit-rhel9@sha256:6e25f541de9ad53e8c7a3b4a275b49982e24ff10a2913300504e14c1f488288f_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/driver-toolkit-rhel9@sha256:c8e04075d322724a81051290db2b36914ee8d8fd06f1f9c28377142465caa6a6_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:03c12c7a04c36a795378d09378b5d47e659442e8e8b9aeccca30dc0fe2eb6038_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:17ad9e6e79cfde04c5e4bb2be1cccd4b82328938b59edb91834b0458a29e3a87_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:b98c393c434204abe7b8eda190ed072bb74e349728a438a28f243cfff6135931_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/network-tools-rhel8@sha256:d12787bea010edfd8a6072dfbc61880ec8df8b4bee0a5a38b83e2e9a04cad342_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:02430a1170b02a2029b95b62ba7079ad5b09e9c0ec17175027d5b503bb289c5c_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:2288fc3efbd342efb4066d6f1e9d296939b9ca3485ec49ffd683fab80942cef2_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:933a16569c4c19d5264e31acb6ef7184c80410227f8b5bbff57ee62dfb2d6956_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-node-agent-rhel9@sha256:f14613d6e2a6082539b34ab5a97af96cece75778c5aaff79f4a05814546c7d8e_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-utils-rhel9@sha256:0aa0651c884c16f456894c11c96a411c6564988861519fd77506754ebe79ffbd_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-utils-rhel9@sha256:b9f10623f9400e59c9ab8eaab08d422a3eb5fd2a9c32f02547f741ca3a3d38f1_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-utils-rhel9@sha256:c294d0e0a08c16b1ec0a2fca681c2e95a95e5a2fbdd73d866ca006fe65225c99_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-agent-installer-utils-rhel9@sha256:e741a9543c853313f16c6fd3a30c187f9aa274d9570e035f842267314097da22_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-baremetal-installer-rhel8@sha256:0a600ebd6495daea79a53cbf136adb3866e6406f7e6615ac136103c8eb821043_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-baremetal-installer-rhel8@sha256:b959cea9c22829ada32fc4efa55265153952b3be5da430132aa8880d88f8338d_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-baremetal-installer-rhel8@sha256:d81bedd24ef68bab60a00620923a02ed9666ee3089ea175624524c2af29f4502_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-baremetal-installer-rhel8@sha256:ddc445eeee2bf0ae040b83ef0a098854821216be3b1a08a497561ae53bdd6581_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-cluster-autoscaler-operator@sha256:3e39ad193ce8732aeb73f4e903c0f8e8f43abb7590ae9c848f5f2d68d4921743_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-cluster-autoscaler-operator@sha256:ad18da2c0f3bbcf912d3fe0cba164cf0365120841ec67fa8c79945eb0694432b_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-cluster-autoscaler-operator@sha256:d0d9c15acde214d2b88f6fac223aa3622b36b06fa9fc2ae6a1a8a775fa544166_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-cluster-autoscaler-operator@sha256:f93a29b2665dd9423966162461c32756322c44b01c358ff3eacc57fb0f7a0048_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-cluster-node-tuning-operator@sha256:23b51e53985b50d0c528358d5557b12ac2897fa020bd92e61c7d4fd1e683e993_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-cluster-node-tuning-operator@sha256:50a34f4cdb25748514ca688375bfc4ef3ed379818243214e62dd3360be44aa71_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-cluster-node-tuning-operator@sha256:be407bccfcbdaa82015c867efb9b038d3c14770bcebc4636d889f41afe65914e_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-cluster-node-tuning-operator@sha256:c8b34839c66c8bb190790dbfebc9f81bbb5c4e758df4d1ad49154a9bc9e09620_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • openshift4/ose-cluster-node-tuning-rhel9-operator@sha256:23b51e53985b50d0c528358d5557b12ac2897fa020bd92e61c7d4fd1e683e993_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • +69 more not shown

✅ Remediation

For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:4d30b359aa6600a89ed49ce6a9a5fdab54092bcb821a25480fdfbc47e66af9ec (For s390x architecture) The image digest is sha256:e9c1f125eadb37b95f4f7d33b883bb3b2a2f8fb1fc76ef019d41ce568cc65f32 (For ppc64le architecture) The image digest is sha256:8ba7ba6c183719007a4d5f8fc221eace8ce3c5d0042b231c49be25a41656aacc (For aarch64 architecture) The image digest is sha256:0fed37d60b1d0e28cb3960e1cd53a8ce1c6d1d51abf48d78dac6751a56ec5ed3 All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html Workaround: In some environments where http/2 support is not required, it may be possible to disable this feature to reduce risk. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.

🔗 References (11)