- Issued:
- 2023-10-30
- Updated:
- 2023-10-30
RHSA-2023:6156 - Security Advisory
Synopsis
Important: Red Hat OpenShift support for Windows Containers 8.1.0 security update
Type/Severity
Security Advisory: Important
Topic
The components for Red Hat OpenShift support for Windows Containers 8.1.0 are now available. This product release includes bug fixes and security updates for the following packages: windows-machine-config-operator and windows-machine-config-operator-bundle.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Description
Red Hat OpenShift support for Windows Containers allows you to deploy Windows container workloads running on Windows Server nodes.
Security Fix(es):
- golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) (CVE-2023-39325)
- kubernetes: Bypass of seccomp profile enforcement (CVE-2023-2431)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Solution
For Windows Machine Config Operator upgrades, see the following documentation:
https://docs.openshift.com/container-platform/latest/windows_containers/windows-node-upgrades.html
Affected Products
- Red Hat OpenShift Container Platform 4.13 for RHEL 9 x86_64
Fixes
- BZ - 2215555 - CVE-2023-2431 kubernetes: Bypass of seccomp profile enforcement
- BZ - 2243296 - CVE-2023-39325 golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)
- WINC-1107 - Red Hat OpenShift support for Windows Containers 8.0.2 Post Release
- OCPBUGS-15838 - Cannot get latest services ConfigMap from custom namespace
- WINC-1096 - Drop AWS support in WMCO 5.x/4.10
- WINC-950 - [e2e] Create a CI job that tests WMCO upgrades triggered by an OCP upgrade
- WINC-805 - Add Support for Windows Server 2022 in AWS
- OCPBUGS-18482 - Failed to install 4.13 Windows workers could not get contents of file: open /payload/csi-proxy/csi-proxy.exe: no such file or directory
- WINC-1023 - Remove WICD RBAC permissions to delete node
- WINC-1025 - CSI Proxy runs as a Windows service on Windows nodes
- OCPBUGS-19084 - BYOH node on AWS server 2022 reconciliation is failing: Unable to connect to the remote server\r\nAt line:1 char:1\r\n+ Invoke-RestMethod -UseBasicParsing -Uri http://169.254.169.254
- WINC-1043 - Test in-tree to CSI volume upgrades in CI
- WINC-1098 - Block WMCO upgrades if in-tree volumes cannot be migrated
x86_64
openshift4-wincw/windows-machine-config-operator-bundle@sha256:ee24ac6ea9ba7c1067327d66b421815f88acff31165e07256de322bd02df4910 |
openshift4-wincw/windows-machine-config-rhel9-operator@sha256:6238c841ed9684453ac6167a666269e16175d724fd3a7c34b230dbf7244932de |
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.