RHSA-2023:5005 - Security Advisory

Topic

Red Hat OpenShift Container Platform release 4.14.0 is now available with updates to packages and images that fix several bugs.

This release includes a security update for Red Hat OpenShift Container Platform 4.14.

Red Hat Product Security has rated this update as having a security impact of [impact]. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.14.0. See the following advisory for the container images for this release:

https://access.redhat.com/errata/RHSA-2023:5006

Security Fix(es):

• golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) (CVE-2023-39325)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenShift Container Platform 4.14 for RHEL 9 x86_64
• Red Hat OpenShift Container Platform 4.14 for RHEL 8 x86_64
• Red Hat OpenShift Container Platform for Power 4.14 for RHEL 9 ppc64le
• Red Hat OpenShift Container Platform for Power 4.14 for RHEL 8 ppc64le
• Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.14 for RHEL 9 s390x
• Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.14 for RHEL 8 s390x
• Red Hat OpenShift Container Platform for ARM 64 4.14 for RHEL 9 aarch64
• Red Hat OpenShift Container Platform for ARM 64 4.14 for RHEL 8 aarch64

Fixes

• BZ - 2243296 - CVE-2023-39325 golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)
• OCPBUGS-10323 - SR-IOV VFs are not created until all the nodes in the pools are updated
• OCPBUGS-10415 - [4.14] vDPA vf cannot be created
• OCPBUGS-10700 - Fixing Topology DS pods startup
• OCPBUGS-10783 - Fixing the the release manifests directory to point to stable
• OCPBUGS-10865 - LSO must-gather does not contain nodes
• OCPBUGS-10884 - mpath device type missing in LocalVolumeDiscovery CR
• OCPBUGS-12312 - Update 4.14 local-storage-operator image to be consistent with ART
• OCPBUGS-12856 - Smart-NIC VF Management Port Feature
• OCPBUGS-13048 - Sync IB-SRIOV-CNI downstream with upstream
• OCPBUGS-13382 - DPU Network operator version (incl. RHEL) is incorrect
• OCPBUGS-13724 - bump up sriov operator to 4.14
• OCPBUGS-13849 - SRIOV Fails on Intel XXV710 Interface
• OCPBUGS-13898 - NFD in Error state after upgrading from 4.12 to 4.13
• OCPBUGS-14084 - Default namespace for openshift-dpu-network-operator is set to 'Openshift Operators'
• OCPBUGS-14154 - bf2-switch-mode.sh fails to apply changes
• OCPBUGS-14179 - Automatically determine DPU configuration for Host PF Rep and Switchdev
• OCPBUGS-14591 - bf2-switch-mode.sh fails if multiple devices are detected
• OCPBUGS-14984 - Must Gather does not include BF-2 firmware information
• OCPBUGS-15183 - Internal error occurred: add operation does not apply: doc is missing path: "/spec/containers/0/volumeMounts/-": missing value
• OCPBUGS-15358 - LocalStorageOperator does not create PersistentVolumes
• OCPBUGS-16595 - No nodeSelector option in form view while creating LocalVolume from OCP webconsole
• OCPBUGS-16745 - Prefer wwn- and scsi- prefixed device-ids in LSO
• OCPBUGS-17047 - Add BCM57504 ID to supported Nics
• OCPBUGS-17131 - local-storage operator specification is missing related image registry.redhat.io/openshift4/ose-local-storage-mustgather-rhel8
• OCPBUGS-17945 - cloud Event Proxy error in log after editing ptp config
• OCPBUGS-5892 - SRIOV: Intel E810: Creating a pod takes up to 2 minutes.
• OCPBUGS-7023 - NodeFeatureDiscovery CR Status is not populated/updated anymore
• OCPBUGS-7039 - [GCP] worker node with Sriov operator installed fails to come up online after reboot
• OCPBUGS-8318 - Pod annotaion key k8s.v1.cni.cncf.io/networks-status is changed
• OCPBUGS-16906 - SR-IOV should reject bad MTU config in policy
• OCPBUGS-18515 - Update 4.14 sriov-cni image to be consistent with ART
• OCPBUGS-18799 - SRIOV operator fails to deploy from stable channel
• OCPBUGS-18712 - Update 4.14 cluster-nfd-operator image to be consistent with ART
• OCPBUGS-21603 - Lowering verbosity of kube-rbac-proxy

CVEs

• CVE-2023-39325

References

• https://access.redhat.com/security/updates/classification/#important