RHSA-2025:0014HighCVSS 8.0

Red Hat Security Advisory: OpenShift Container Platform 4.12.71 bug fix and security update

Published
January 9, 2025
Last Modified
September 15, 2026

🔗 CVE IDs covered (2)

CVE-2023-39325 →CVE-2024-6508 →

📋 Description

CVE-2023-39325 — golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) CVE-2024-6508 — openshift-console: OAuth2 insufficient state parameter entropy

🎯 Affected products192

  • Red Hat OpenShift Container Platform 4.12
  • openshift4/cloud-network-config-controller-rhel8@sha256:8f1bef7169ff498d6d0686b1c38aa6556298087275e396406649f28d95508811_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/driver-toolkit-rhel8@sha256:92621c9f085afd595ad5c285ddefc47607019f632dc8d9645510f182479e4857_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/egress-router-cni-rhel8@sha256:b89d7517bc283ff936998b199502c13395c16af14caa5ec39f22058c1e768685_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/kubevirt-csi-driver-rhel8@sha256:57997446b37c6492b5f91c34c0f293a9afdf04647817ecef0d89092f9d874a44_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/network-tools-rhel8@sha256:bd8af5141affa1c21561fa920a54448e7e28e517713c98e0c968e90d12e8b987_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/oc-mirror-plugin-rhel8@sha256:29f9c1303e820796eb55ac9698af978bb34dbf6715c529cd9e8e1bf8a7379300_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/openshift-route-controller-manager-rhel8@sha256:738c17c7f9cfa3a99d1256a99f2e0f030452b8c5bc0ae5d816a0fc6b06111557_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-api-server-rhel8@sha256:17876f54b968358be371190feaf27c9ac43e7950975908c4dd541201296cd8b0_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-csr-approver-rhel8@sha256:4ba65512d2161be76870083ecdbc4aa0808e0cac7377e2252f044e089103d4e4_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-node-agent-rhel8@sha256:73e05756b9a66d5f907a69120392c3c4463bae4e7b447136117791a7e93d9069_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-agent-installer-orchestrator-rhel8@sha256:d2ad6790029d358df0644cf1f0d474d26c36aae516f186990c77dd1a7e4fdf1f_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-alibaba-cloud-controller-manager-rhel8@sha256:64dacfe289e91fcaa732724722c50ebfce41ae57d39e9a3a3f5f95f0fddde90d_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-alibaba-cloud-csi-driver-container-rhel8@sha256:e9124fe6892bc749d0d60cb609118ba44f3a89e911f3a972d314d6d5154cf90a_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-alibaba-disk-csi-driver-operator-container-rhel8@sha256:3ec3f9337c5ddf91add94f106e9e626f12ff56f42b4323f678d66082da8b37ed_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-alibaba-machine-controllers-rhel8@sha256:1c5227551bdc4bd4c7bfb00ad240102d0f7c23dad5a39f15e0b14bb678979c68_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-apiserver-network-proxy-rhel8@sha256:ef2aaa65969aa2e7a16b4aeb11ac7f5e5cb9f09c4bccd9f3f8976befd1267856_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-aws-cloud-controller-manager-rhel8@sha256:52e400e1931761cf33df25172c49f89fbf2bb0c3471913711208105856c7711d_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-aws-cluster-api-controllers-rhel8@sha256:68489980a75af9080cc21252d62c73221d80ceb1ab0696862dd6fbcccdd8d043_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-aws-ebs-csi-driver-rhel8-operator@sha256:f71378c518f771cb1921045a2a83bb1b83e2bf3d770984eda16ee1509dd5681a_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-aws-ebs-csi-driver-rhel8@sha256:1349484f76959a7d7da7b229ae8d0a5bf9e19cb08d3708e2b6299efb601b9698_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-aws-pod-identity-webhook-rhel8@sha256:8ded7fcb54b5735541bf5c214931bf7330277d58b85f98486c8a7d0eca5b583e_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-azure-cloud-controller-manager-rhel8@sha256:f71a0eaaef5d65f45094dbbe0ca67be1941d3819f7b3e45363fc491a7f2a5b3e_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-azure-cloud-node-manager-rhel8@sha256:f707efb0a8f554fbcb649e5969e4168533a10656c10066659f07138dd824f916_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-azure-cluster-api-controllers-rhel8@sha256:e1af0298f112417a9b74685d57298af8ada393c937801e5d4e82303c0c6ea4aa_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-azure-disk-csi-driver-rhel8-operator@sha256:f362446988b8f6d02ce0e43f66990a46c0e475e880c69da82a72219fcea9612d_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-azure-disk-csi-driver-rhel8@sha256:87a9fa7d00d20c16509d2f312708bd45147f085dde87f732a4a21bf1c0707b69_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-azure-file-csi-driver-operator-rhel8@sha256:a7b06a1f2dc7cdbc412395ad856fc1c392af4e9c6ebc20e05a86685b4a03f9af_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-azure-file-csi-driver-rhel8@sha256:eeaf096662c208b3256ebf359094fe1be30a45ccf9c704a2ceff799d56602b0b_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • openshift4/ose-baremetal-installer-rhel8@sha256:66d652fd19611a89718ffb03092686eaac749576d2fc7b474938549ce3f9e53d_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • +162 more not shown

✅ Remediation

For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html You may download the oc tool and use it to inspect release image metadata for the x86_64 architecture. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha value for the release is as follows: (For x86_64 architecture) The image digest is sha256:ede46c671ff7dcd2f9ccff821e24a319297529c9852d7e987ab268e22a21b782 All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html Workaround: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (7)