Red Hat Security Advisory 2023-1817-01
—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
====================================================================
Red Hat Security Advisory
سرور شما نیاز به مدیریت و پشتیبانی دارد؟h3>
پیکربندی، مانیتورینگ و نگهداری حرفهای سرورهای لینوکسی و ویندوزی.
Synopsis: Moderate: Network observability 1.2.0 for Openshift
Advisory ID: RHSA-2023:1817-01
Product: NETOBSERV
Advisory URL: https://access.redhat.com/errata/RHSA-2023:1817
Issue date: 2023-04-18
CVE Names: CVE-2022-41717 CVE-2022-41724 CVE-2022-41725
====================================================================
1. Summary:
Network Observability 1.2.0 for OpenShift
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Description:
Network Observability 1.2.0 is an OpenShift operator that provides a
monitoring pipeline to collect and enrich network flows that are produced
by the Network observability eBPF agent.
The operator provides dashboards, metrics, and keeps flows accessible in a
queryable log store, Grafana Loki. When a FlowCollector is deployed, new
dashboards are available in the Console.
This update contains bug fixes.
Security Fix(es):
* golang: net/http: An attacker can cause excessive memory growth in a Go
server accepting HTTP/2 requests (CVE-2022-41717)
* golang: crypto/tls: large handshake records may cause panics
(CVE-2022-41724)
* golang: net/http, mime/multipart: denial of service from excessive
resource consumption (CVE-2022-41725)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
3. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
4. Bugs fixed (https://bugzilla.redhat.com/):
2161274 – CVE-2022-41717 golang: net/http: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests
2178488 – CVE-2022-41725 golang: net/http, mime/multipart: denial of service from excessive resource consumption
2178492 – CVE-2022-41724 golang: crypto/tls: large handshake records may cause panics
5. JIRA issues fixed (https://issues.jboss.org/):
NETOBSERV-142 – Network Observability infra health
NETOBSERV-350 – Connection tracking
NETOBSERV-521 – Network Observability Operator Seamless Upgrades
NETOBSERV-617 – eBPF agent: Need to split huge GRPC payloads
NETOBSERV-658 – Histogram in NetFlow Table
NETOBSERV-684 – Watch TLS certs & reload
NETOBSERV-696 – Reporter node behaves the opposite of what it says
NETOBSERV-755 – Duplicate flows between pods on different nodes
NETOBSERV-772 – FLP pods and console-plugin doesn’t restart on CACert name change
NETOBSERV-774 – Namespace change in CRD result in duplicated ebpf agents
NETOBSERV-785 – [Maintenance] bump to ubi9 / rhel9
NETOBSERV-793 – flowlogs-pipeline is stuck at ContainerCreating when CA cert is misconfigured
NETOBSERV-844 – Unable to have a working statusUrl in FlowCollector with Loki Operator 5.6
NETOBSERV-857 – After some time, it fails to retrieve flows
NETOBSERV-868 – Migrate ebpf agent to use cilium native golang struct
NETOBSERV-889 – Flows not observed in Single stack cluster
6. References:
https://access.redhat.com/security/cve/CVE-2022-41717
https://access.redhat.com/security/cve/CVE-2022-41724
https://access.redhat.com/security/cve/CVE-2022-41725
https://access.redhat.com/security/updates/classification/#moderate
7. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2023 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIVAwUBZD7LGdzjgjWX9erEAQh6JA/9G1Q3O/6gRVD4As1VnJ+JdMe/JBigYekX
/HKyYR3/eED9bom7Cv7TuHLHYaHYKe3g1hcbi1NQJWf+Mv9NtArcdDcszpFXXZHS
+j2G3wrlt36vaRB/yHiZk6ZUn7BLxFEeWFnA2PG7/wEr3JJd21aQ7I/lvQs2sXoB
1kk2NYjBjxHKZ9mm7K3U8bNiprE1BKQHmpptOgCKl16cFLUcYZ+4LJ5awY+QbQz+
7koMph4zOCTLy8jWoqjyM/xEOdaUoVH2oAmHrDlQmEuXUJXiUnEkFylD+3+1mHrK
oDvO3dEwh0uZedgEQsBODpHK4I1XjkmOlc897qWPLQnFA3phhhV0Ut4U75Ybq0Kn
EnXjhBBm50fxwVGYe0Dx0t8845hoGPcE0gnAYcqQwWcf5p6F+vz+7WcH/JpdYNf2
XSF/sjxb8OdWu3x82zeUJo4VOMpt+Sf1Xd0hoHzNIZtu0E4hF8pZlO/ry6clTYxR
F/aSCtkC4CYxobU+w95eY23wevB7KL5tQo0EwrL088Ttr3DdeOcsbrErIzoRRhaC
qIOmslkFaJa/kAt5h7T+bOSzndRC/2wpPTyet/eBL8bJ8qs+QD4pDd79uvt+R1Ur
E9cL7ysBOY4znysWwuJYyZuHqVUCsDzKbIzQMa4lQGBBkb517Yj/HFsrp3W4O/bA
oMzUlJjo8vY=DWsU
—–END PGP SIGNATURE—–
—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce