Red Hat Security Advisory

RHSA-2023:7479

OpenShift Container Platform 4.11.54 bug fix and security update

Released 2023-11-29 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.11 openshift4/ose-aws-cloud-controller-manager-rhel8, openshift4/ose-azure-disk-csi-driver-rhel8-operator, openshift4/ose-cluster-config-operator +28

Fixes 2 records

TI-2023-20466 CVE-2023-39325 · GHSA-4374-p667-p6c8

HTTP/2 rapid reset can cause excessive work in net/http

LOW 39

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03796 Published 2023-10-11 Partial fix · 1.20.10, 1.21.3 +1 CWE-770

TI-2023-04979 CVE-2023-5408 · GHSA-7664-m5hw-r7q8

Openshift: modification of node role labels

LOW 37

A privilege escalation flaw was found in the node restriction admission plugin of the kubernetes api server of OpenShift.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01512 Published 2023-11-02 Fixed in v4.11.0-202311211130.p0.g7021090.assembly.stream, v4.12.0-202311021630.p0.gfe5e2a1.assembly.stream +2 CWE-269