RHSA-2023:0574CriticalCVSS 9.1

Red Hat Security Advisory: OpenShift Container Platform 4.9.55 security update

Published
February 13, 2023
Last Modified
October 14, 2026

🔗 CVE IDs covered (3)

CVE-2021-4238 →CVE-2022-41912 →CVE-2023-0296 →

📋 Description

CVE-2021-4238 — goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be CVE-2022-41912 — crewjam/saml: Authentication bypass when processing SAML responses containing multiple Assertion elements CVE-2023-0296 — openshift: etcd grpc-proxy vulnerable to The Birthday attack against 64-bit block cipher

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.9
  • openshift4/driver-toolkit-rhel8@sha256:01bef154b32c713f7c6d3b1d812a4db27b173cc51bfc2bc3f7f0771acd51741c_s390x as a component of Red Hat OpenShift Container Platform 4.9
  • openshift4/driver-toolkit-rhel8@sha256:1b4fe3217c3139b9d0dedab9d3be89199ee7a2c43df78bf77eac752246e33881_arm64 as a component of Red Hat OpenShift Container Platform 4.9
  • openshift4/driver-toolkit-rhel8@sha256:c43892a66f015b3b5cfe850c4d5834499c39b7b57161122713b3ca9edc92bff3_amd64 as a component of Red Hat OpenShift Container Platform 4.9
  • openshift4/driver-toolkit-rhel8@sha256:db79f1b6933bfe116a0ee119ff56efe99648c4f6b38656c58c2fa2323334d631_ppc64le as a component of Red Hat OpenShift Container Platform 4.9
  • openshift4/egress-router-cni-alt-rhel8@sha256:76cf222b474407c14f2e19ac63312b944beb7b6a8bcd2e5eb3ff59a0390dd4dd_amd64 as a component of Red Hat OpenShift Container Platform 4.9
  • openshift4/egress-router-cni-rhel8@sha256:0bf9b8a15fb1b319d53a19a866d856bd413d3cfb93a8755b17257ae7b6d322a6_ppc64le as a component of Red Hat OpenShift Container Platform 4.9
  • openshift4/egress-router-cni-rhel8@sha256:47e197bcb9730bcf86092e1972dee6121005bf602b74556ea03656524557012f_s390x as a component of Red Hat OpenShift Container Platform 4.9
  • openshift4/egress-router-cni-rhel8@sha256:5b6f8753cbf15f5b8284f0be35fc329ea04ee8ba6664c9c2ece02dec145ee16e_arm64 as a component of Red Hat OpenShift Container Platform 4.9
  • openshift4/egress-router-cni-rhel8@sha256:aceb0dd4064f67ee3172c0ddf16309c589cb304d91a9ce36f67b2f5d18c9fe09_amd64 as a component of Red Hat OpenShift Container Platform 4.9
  • openshift4/network-tools-rhel8@sha256:3a246ef2ad59dcaa0652f4b52edcaae8dac2040545933db90f37d8c60951e3e4_ppc64le as a component of Red Hat OpenShift Container Platform 4.9
  • openshift4/network-tools-rhel8@sha256:42506beca78b9d51d82b6743bca9169cf3975c4233b6a0c1057827ee4188671b_arm64 as a component of Red Hat OpenShift Container Platform 4.9
  • openshift4/network-tools-rhel8@sha256:7e5b21f19590908a365f8345cb17b437d94f278fb8d5c62fff5b5d942ce2b7c8_amd64 as a component of Red Hat OpenShift Container Platform 4.9
  • openshift4/network-tools-rhel8@sha256:bd0469c4218bde5315b12718a1536dc7b014576443d84e569bc6b30f88ffeda5_s390x as a component of Red Hat OpenShift Container Platform 4.9
  • openshift4/ose-aws-cloud-controller-manager-rhel8@sha256:55b27f0888547296733b1c206f9e66c61ab260a48c40940306e4e90e91565543_amd64 as a component of Red Hat OpenShift Container Platform 4.9
  • openshift4/ose-aws-cloud-controller-manager-rhel8@sha256:ed1f7694316bd1c8751c1a79bdce6288263b27faadf16c2e60ab6be5651ea031_arm64 as a component of Red Hat OpenShift Container Platform 4.9
  • openshift4/ose-aws-ebs-csi-driver-rhel8-operator@sha256:73e5ed06bcce63ef22bfcb0eb829f5ecfb0e2c8b2f994339b0e4a99f654a4772_arm64 as a component of Red Hat OpenShift Container Platform 4.9
  • openshift4/ose-aws-ebs-csi-driver-rhel8-operator@sha256:89a7e12225c95bb74ca61da308ee9b1602611b8f1922ac6cd390c78a3e345984_amd64 as a component of Red Hat OpenShift Container Platform 4.9
  • openshift4/ose-aws-ebs-csi-driver-rhel8@sha256:4d90be0d2c5da6abe1baa6832a6065a4bddd130a5c20a3b2df61dfe69ec45b58_arm64 as a component of Red Hat OpenShift Container Platform 4.9
  • openshift4/ose-aws-ebs-csi-driver-rhel8@sha256:6977a86d709df8533b6d34d005540383359c3a72cf997e13f5989e8c985ee10c_amd64 as a component of Red Hat OpenShift Container Platform 4.9
  • openshift4/ose-aws-machine-controllers@sha256:393d29373b85691788d3aa59b0b2d4b12b88dfea06583d2be070eb2f112e154d_arm64 as a component of Red Hat OpenShift Container Platform 4.9
  • openshift4/ose-aws-machine-controllers@sha256:b849b24328a3eb3a1537f12be7e4bbb5a6e082b77e5b2f47c9ef113305467e19_amd64 as a component of Red Hat OpenShift Container Platform 4.9
  • openshift4/ose-aws-pod-identity-webhook-rhel8@sha256:5dac6db34f695a09adfac26e9250f03f177e8e76b8622faff20bb5af1cd1ac90_amd64 as a component of Red Hat OpenShift Container Platform 4.9
  • openshift4/ose-aws-pod-identity-webhook-rhel8@sha256:fd87deec82c6e4935ca1179beb6f4df0bebb209207b31e040f9b2abf75b1f8c9_arm64 as a component of Red Hat OpenShift Container Platform 4.9
  • openshift4/ose-azure-cloud-controller-manager-rhel8@sha256:76942f864dfe53c809c7cca5d65edab566d7fbd1e5423eddd8f969de2ad94bf4_amd64 as a component of Red Hat OpenShift Container Platform 4.9
  • openshift4/ose-azure-cloud-node-manager-rhel8@sha256:9b71ffc76ccccc320c1240d5e89de932ee1b46a55b726fc014aeeb7bfd6ac21a_amd64 as a component of Red Hat OpenShift Container Platform 4.9
  • openshift4/ose-azure-disk-csi-driver-rhel8-operator@sha256:deea143369ef3215512aa286beea13f7dd505ad8b7bd7ee87a9c6245a6e219f7_amd64 as a component of Red Hat OpenShift Container Platform 4.9
  • openshift4/ose-azure-disk-csi-driver-rhel8@sha256:fe3996ef47e39e2e0566a6d150b17b4eb2f2cdf54fb1d99de76bb343d4893db2_amd64 as a component of Red Hat OpenShift Container Platform 4.9
  • openshift4/ose-azure-machine-controllers@sha256:deea2155798e9deea506ed67edd11fc91227a612909119ab489e9398795eb1c7_amd64 as a component of Red Hat OpenShift Container Platform 4.9
  • openshift4/ose-baremetal-installer-rhel8@sha256:35a6f28d8264c9a6f9244c8376a0ad2fde65863134c0c4e0eb04b662c978fbf9_ppc64le as a component of Red Hat OpenShift Container Platform 4.9
  • +170 more not shown

✅ Remediation

See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html You can download the oc tool and use it to inspect release image metadata for x86_64, s390x, and ppc64le architectures. The image digests can be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are: (For x86_64 architecture) The image digest is sha256:cdf6e83f94d6a9beec65a429ebea6a8f5f80c19df49feb1a78b17981132b922b (For s390x architecture) The image digest is sha256:4784b43052f3041059e2cc586f2c3c80591ff92338817a83d3039288e1258eef (For ppc64le architecture) The image digest is sha256:5f1124780604fb8de06732bd407c24ac5d6d47df52ec74531d803bd187363bcf (For aarch64 architecture) The image digest is sha256: 2595defd3ac3d1b41acbf3284d9bf3eb73ac1f58aecffa77e82766e90ee511dc All OpenShift Container Platform 4.9 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at: https://docs.openshift.com/container-platform/4.9/updating/updating-cluster-cli.html

🔗 References (11)