Network observability 1.2.0 for Openshift has been released.
RHSA-2023:1817-01: Moderate: Network observability 1.2.0 for Openshift
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: Network observability 1.2.0 for Openshift
Advisory ID: RHSA-2023:1817-01
Product: NETOBSERV
Advisory URL: https://access.redhat.com/errata/RHSA-2023:1817
Issue date: 2023-04-18
CVE Names: CVE-2022-41717 CVE-2022-41724 CVE-2022-41725
=====================================================================
1. Summary:
Network Observability 1.2.0 for OpenShift
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Description:
Network Observability 1.2.0 is an OpenShift operator that provides a
monitoring pipeline to collect and enrich network flows that are produced
by the Network observability eBPF agent.
The operator provides dashboards, metrics, and keeps flows accessible in a
queryable log store, Grafana Loki. When a FlowCollector is deployed, new
dashboards are available in the Console.
This update contains bug fixes.
Security Fix(es):
* golang: net/http: An attacker can cause excessive memory growth in a Go
server accepting HTTP/2 requests (CVE-2022-41717)
* golang: crypto/tls: large handshake records may cause panics
(CVE-2022-41724)
* golang: net/http, mime/multipart: denial of service from excessive
resource consumption (CVE-2022-41725)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
3. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
4. Bugs fixed ( https://bugzilla.redhat.com/):
2161274 - CVE-2022-41717 golang: net/http: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests
2178488 - CVE-2022-41725 golang: net/http, mime/multipart: denial of service from excessive resource consumption
2178492 - CVE-2022-41724 golang: crypto/tls: large handshake records may cause panics
5. JIRA issues fixed ( https://issues.jboss.org/):
NETOBSERV-142 - Network Observability infra health
NETOBSERV-350 - Connection tracking
NETOBSERV-521 - Network Observability Operator Seamless Upgrades
NETOBSERV-617 - eBPF agent: Need to split huge GRPC payloads
NETOBSERV-658 - Histogram in NetFlow Table
NETOBSERV-684 - Watch TLS certs & reload
NETOBSERV-696 - Reporter node behaves the opposite of what it says
NETOBSERV-755 - Duplicate flows between pods on different nodes
NETOBSERV-772 - FLP pods and console-plugin doesn't restart on CACert name change
NETOBSERV-774 - Namespace change in CRD result in duplicated ebpf agents
NETOBSERV-785 - [Maintenance] bump to ubi9 / rhel9
NETOBSERV-793 - flowlogs-pipeline is stuck at ContainerCreating when CA cert is misconfigured
NETOBSERV-844 - Unable to have a working statusUrl in FlowCollector with Loki Operator 5.6
NETOBSERV-857 - After some time, it fails to retrieve flows
NETOBSERV-868 - Migrate ebpf agent to use cilium native golang struct
NETOBSERV-889 - Flows not observed in Single stack cluster
6. References:
https://access.redhat.com/security/cve/CVE-2022-41717
https://access.redhat.com/security/cve/CVE-2022-41724
https://access.redhat.com/security/cve/CVE-2022-41725
https://access.redhat.com/security/updates/classification/#moderate
7. Contact:
The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2023 Red Hat, Inc.
