-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Network observability 1.2.0 for Openshift Advisory ID: RHSA-2023:1817-01 Product: NETOBSERV Advisory URL: https://access.redhat.com/errata/RHSA-2023:1817 Issue date: 2023-04-18 CVE Names: CVE-2022-41717 CVE-2022-41724 CVE-2022-41725 ==================================================================== 1. Summary: Network Observability 1.2.0 for OpenShift Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Network Observability 1.2.0 is an OpenShift operator that provides a monitoring pipeline to collect and enrich network flows that are produced by the Network observability eBPF agent. The operator provides dashboards, metrics, and keeps flows accessible in a queryable log store, Grafana Loki. When a FlowCollector is deployed, new dashboards are available in the Console. This update contains bug fixes. Security Fix(es): * golang: net/http: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717) * golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724) * golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 4. Bugs fixed (https://bugzilla.redhat.com/): 2161274 - CVE-2022-41717 golang: net/http: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests 2178488 - CVE-2022-41725 golang: net/http, mime/multipart: denial of service from excessive resource consumption 2178492 - CVE-2022-41724 golang: crypto/tls: large handshake records may cause panics 5. JIRA issues fixed (https://issues.jboss.org/): NETOBSERV-142 - Network Observability infra health NETOBSERV-350 - Connection tracking NETOBSERV-521 - Network Observability Operator Seamless Upgrades NETOBSERV-617 - eBPF agent: Need to split huge GRPC payloads NETOBSERV-658 - Histogram in NetFlow Table NETOBSERV-684 - Watch TLS certs & reload NETOBSERV-696 - Reporter node behaves the opposite of what it says NETOBSERV-755 - Duplicate flows between pods on different nodes NETOBSERV-772 - FLP pods and console-plugin doesn't restart on CACert name change NETOBSERV-774 - Namespace change in CRD result in duplicated ebpf agents NETOBSERV-785 - [Maintenance] bump to ubi9 / rhel9 NETOBSERV-793 - flowlogs-pipeline is stuck at ContainerCreating when CA cert is misconfigured NETOBSERV-844 - Unable to have a working statusUrl in FlowCollector with Loki Operator 5.6 NETOBSERV-857 - After some time, it fails to retrieve flows NETOBSERV-868 - Migrate ebpf agent to use cilium native golang struct NETOBSERV-889 - Flows not observed in Single stack cluster 6. References: https://access.redhat.com/security/cve/CVE-2022-41717 https://access.redhat.com/security/cve/CVE-2022-41724 https://access.redhat.com/security/cve/CVE-2022-41725 https://access.redhat.com/security/updates/classification/#moderate 7. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBZD7LGdzjgjWX9erEAQh6JA/9G1Q3O/6gRVD4As1VnJ+JdMe/JBigYekX /HKyYR3/eED9bom7Cv7TuHLHYaHYKe3g1hcbi1NQJWf+Mv9NtArcdDcszpFXXZHS +j2G3wrlt36vaRB/yHiZk6ZUn7BLxFEeWFnA2PG7/wEr3JJd21aQ7I/lvQs2sXoB 1kk2NYjBjxHKZ9mm7K3U8bNiprE1BKQHmpptOgCKl16cFLUcYZ+4LJ5awY+QbQz+ 7koMph4zOCTLy8jWoqjyM/xEOdaUoVH2oAmHrDlQmEuXUJXiUnEkFylD+3+1mHrK oDvO3dEwh0uZedgEQsBODpHK4I1XjkmOlc897qWPLQnFA3phhhV0Ut4U75Ybq0Kn EnXjhBBm50fxwVGYe0Dx0t8845hoGPcE0gnAYcqQwWcf5p6F+vz+7WcH/JpdYNf2 XSF/sjxb8OdWu3x82zeUJo4VOMpt+Sf1Xd0hoHzNIZtu0E4hF8pZlO/ry6clTYxR F/aSCtkC4CYxobU+w95eY23wevB7KL5tQo0EwrL088Ttr3DdeOcsbrErIzoRRhaC qIOmslkFaJa/kAt5h7T+bOSzndRC/2wpPTyet/eBL8bJ8qs+QD4pDd79uvt+R1Ur E9cL7ysBOY4znysWwuJYyZuHqVUCsDzKbIzQMa4lQGBBkb517Yj/HFsrp3W4O/bA oMzUlJjo8vY=DWsU -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce