Red Hat Security Advisory 2023-1817-01 - Network Observability 1.2.0 is an OpenShift operator that provides a monitoring pipeline to collect and enrich network flows that are produced by the Network observability eBPF agent. The operator provides dashboards, metrics, and keeps flows accessible in a queryable log store, Grafana Loki. When a FlowCollector is deployed, new dashboards are available in the Console. This update contains bug fixes. Issues addressed include a denial of service vulnerability.
640a19c8a23588d2bc0937910dfaaca347ae01806b49a391217d7fc3e3c1857c
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Moderate: Network observability 1.2.0 for Openshift
Advisory ID: RHSA-2023:1817-01
Product: NETOBSERV
Advisory URL: https://access.redhat.com/errata/RHSA-2023:1817
Issue date: 2023-04-18
CVE Names: CVE-2022-41717 CVE-2022-41724 CVE-2022-41725
====================================================================
1. Summary:
Network Observability 1.2.0 for OpenShift
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Description:
Network Observability 1.2.0 is an OpenShift operator that provides a
monitoring pipeline to collect and enrich network flows that are produced
by the Network observability eBPF agent.
The operator provides dashboards, metrics, and keeps flows accessible in a
queryable log store, Grafana Loki. When a FlowCollector is deployed, new
dashboards are available in the Console.
This update contains bug fixes.
Security Fix(es):
* golang: net/http: An attacker can cause excessive memory growth in a Go
server accepting HTTP/2 requests (CVE-2022-41717)
* golang: crypto/tls: large handshake records may cause panics
(CVE-2022-41724)
* golang: net/http, mime/multipart: denial of service from excessive
resource consumption (CVE-2022-41725)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
3. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
4. Bugs fixed (https://bugzilla.redhat.com/):
2161274 - CVE-2022-41717 golang: net/http: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests
2178488 - CVE-2022-41725 golang: net/http, mime/multipart: denial of service from excessive resource consumption
2178492 - CVE-2022-41724 golang: crypto/tls: large handshake records may cause panics
5. JIRA issues fixed (https://issues.jboss.org/):
NETOBSERV-142 - Network Observability infra health
NETOBSERV-350 - Connection tracking
NETOBSERV-521 - Network Observability Operator Seamless Upgrades
NETOBSERV-617 - eBPF agent: Need to split huge GRPC payloads
NETOBSERV-658 - Histogram in NetFlow Table
NETOBSERV-684 - Watch TLS certs & reload
NETOBSERV-696 - Reporter node behaves the opposite of what it says
NETOBSERV-755 - Duplicate flows between pods on different nodes
NETOBSERV-772 - FLP pods and console-plugin doesn't restart on CACert name change
NETOBSERV-774 - Namespace change in CRD result in duplicated ebpf agents
NETOBSERV-785 - [Maintenance] bump to ubi9 / rhel9
NETOBSERV-793 - flowlogs-pipeline is stuck at ContainerCreating when CA cert is misconfigured
NETOBSERV-844 - Unable to have a working statusUrl in FlowCollector with Loki Operator 5.6
NETOBSERV-857 - After some time, it fails to retrieve flows
NETOBSERV-868 - Migrate ebpf agent to use cilium native golang struct
NETOBSERV-889 - Flows not observed in Single stack cluster
6. References:
https://access.redhat.com/security/cve/CVE-2022-41717
https://access.redhat.com/security/cve/CVE-2022-41724
https://access.redhat.com/security/cve/CVE-2022-41725
https://access.redhat.com/security/updates/classification/#moderate
7. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBZD7LGdzjgjWX9erEAQh6JA/9G1Q3O/6gRVD4As1VnJ+JdMe/JBigYekX
/HKyYR3/eED9bom7Cv7TuHLHYaHYKe3g1hcbi1NQJWf+Mv9NtArcdDcszpFXXZHS
+j2G3wrlt36vaRB/yHiZk6ZUn7BLxFEeWFnA2PG7/wEr3JJd21aQ7I/lvQs2sXoB
1kk2NYjBjxHKZ9mm7K3U8bNiprE1BKQHmpptOgCKl16cFLUcYZ+4LJ5awY+QbQz+
7koMph4zOCTLy8jWoqjyM/xEOdaUoVH2oAmHrDlQmEuXUJXiUnEkFylD+3+1mHrK
oDvO3dEwh0uZedgEQsBODpHK4I1XjkmOlc897qWPLQnFA3phhhV0Ut4U75Ybq0Kn
EnXjhBBm50fxwVGYe0Dx0t8845hoGPcE0gnAYcqQwWcf5p6F+vz+7WcH/JpdYNf2
XSF/sjxb8OdWu3x82zeUJo4VOMpt+Sf1Xd0hoHzNIZtu0E4hF8pZlO/ry6clTYxR
F/aSCtkC4CYxobU+w95eY23wevB7KL5tQo0EwrL088Ttr3DdeOcsbrErIzoRRhaC
qIOmslkFaJa/kAt5h7T+bOSzndRC/2wpPTyet/eBL8bJ8qs+QD4pDd79uvt+R1Ur
E9cL7ysBOY4znysWwuJYyZuHqVUCsDzKbIzQMa4lQGBBkb517Yj/HFsrp3W4O/bA
oMzUlJjo8vY=DWsU
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce