(RHSA-2019:3906) Important: OpenShift Container Platform 3.11 HTTP/2 security update

Red Hat OpenShift Container Platform is Red Hat’s cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

The following RPM packages have been rebuilt with updated version of Go, which includes the security fixes listed further below:

atomic-enterprise-service-catalog
atomic-openshift-cluster-autoscaler
atomic-openshift-descheduler
atomic-openshift-metrics-server
atomic-openshift-node-problem-detector
atomic-openshift-service-idler
atomic-openshift-web-console
cockpit
csi-attacher
csi-driver-registrar
csi-livenessprobe
csi-provisioner
golang-github-openshift-oauth-proxy
golang-github-openshift-prometheus-alert-buffer
golang-github-prometheus-alertmanager
golang-github-prometheus-node_exporter
golang-github-prometheus-prometheus
hawkular-openshift-agent
heapster
image-inspector
openshift-enterprise-autoheal
openshift-enterprise-cluster-capacity
openshift-eventrouter
openshift-external-storage

Security Fix(es):

• HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

• HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.