RHSA-2024:0050 - Security Advisory

Topic

Red Hat OpenShift Container Platform release 4.14.8 is now available with updates to packages and images that fix several bugs and add enhancements.

This release includes a security update for Red Hat OpenShift Container Platform 4.14.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container Platform 4.14.8. See the following advisory for the RPM packages for this release:

https://access.redhat.com/errata/RHBA-2024:0053

Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html

Security Fix(es):

• golang: net/http, x/net/http2: rapid stream resets can cause excessive work (Rapid Reset Attack) (CVE-2023-39325)

A Red Hat Security Bulletin which addresses further details about the Rapid Reset flaw is available in the References section.

• opentelemetry: DoS vulnerability in otelhttp (CVE-2023-45142)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html

Solution

For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are

(For x86_64 architecture)
The image digest is sha256:073a4e46289be25e2a05f5264c8f1d697410db66b960c9ceeddebd1c61e58717

(For s390x architecture)
The image digest is sha256:b6ba1ea6602cca707e6fdf0f1dd09fcdd2881f8b0e853d0f96cf83942c54bbb1

(For ppc64le architecture)
The image digest is sha256:29fa39db92e471aee54c6a56b20b0a7f684da4d6061c0f5a6a3d81cd7c796ebb

(For aarch64 architecture)
The image digest is sha256:d71ce79db01d0ab7b4a2270ccc4162c107f7959ef9cd48b394557c4ef455cff0

All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html

Affected Products

• Red Hat OpenShift Container Platform 4.14 for RHEL 9 x86_64
• Red Hat OpenShift Container Platform 4.14 for RHEL 8 x86_64
• Red Hat OpenShift Container Platform for Power 4.14 for RHEL 9 ppc64le
• Red Hat OpenShift Container Platform for Power 4.14 for RHEL 8 ppc64le
• Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.14 for RHEL 9 s390x
• Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.14 for RHEL 8 s390x
• Red Hat OpenShift Container Platform for ARM 64 4.14 for RHEL 9 aarch64
• Red Hat OpenShift Container Platform for ARM 64 4.14 for RHEL 8 aarch64

Fixes

• BZ - 2243296 - CVE-2023-39325 golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)
• BZ - 2245180 - CVE-2023-45142 opentelemetry: DoS vulnerability in otelhttp
• OCPBUGS-12720 - Update 4.14 hypershift image to be consistent with ART
• OCPBUGS-19884 - [4.14] Install does not begin if secure boot was enabled for the first time
• OCPBUGS-22267 - Backport ostree admin set-default to 4.14
• OCPBUGS-22771 - Masters are not attached with the provided custom security groups which defined in platform.aws.defaultMachinePlatform
• OCPBUGS-22787 - [release-4.14] Don't set SSL connection on DBs anymore with OVN-IC
• OCPBUGS-23771 - [release-4.14] All resources' yaml tab show TypeError after MCE operator is installed
• OCPBUGS-23968 - Internal NLB issue (OCPBUGS-9026) causes random failures on HCP private cluster without infra nodes
• OCPBUGS-24281 - [4.14] Isolated CPUs included in sched domain on container creation
• OCPBUGS-24320 - [4.14] Can we view status of an adminbased external route policy, if so then how/where?
• OCPBUGS-24346 - Failed to create STS resources in China regions using ccoctl
• OCPBUGS-24349 - Pipeline Builder crashes after a Task was installed from ArtifactHub
• OCPBUGS-24474 - S2I Build Wizard should check for Containerfile in addition to Dockerfile
• OCPBUGS-24489 - [4.14] BMH keep showing power status as off while IMM is powered on
• OCPBUGS-24627 - ignition-server-proxy deployment fails on y-stream upgrade 4.13->4.14
• OCPBUGS-24667 - Console plugin requests show error message with 304 status and "request method or response status code does not allow body"
• OCPBUGS-25384 - [4.14] Cluster Fleet Evaluation Backport to evluate PS violations
• OCPBUGS-25397 - [release-4.14] Node Overview Pane not displaying
• OCPBUGS-25417 - file path used for oci images can result in an error
• OCPBUGS-25458 - Tests failing in CI since base image changes
• OCPBUGS-25685 - pinned packages in ironic-agent-image breaks ART pipeline
• OCPBUGS-25275 - [release 4.14] Azure Workload Identity Management for layered products (OLM operators)
• OCPBUGS-24664 - Clicking on an log based alerts redirects to prometheus metrics

CVEs

• CVE-2023-39325
• CVE-2023-44446
• CVE-2023-45142

References

• https://access.redhat.com/security/updates/classification/#important
• https://access.redhat.com/security/vulnerabilities/RHSB-2023-003