[RHSA-2023:1817-01] Moderate: Network observability 1.2.0 for Openshift

[Security announcements for all Red Hat products and services.]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: Network observability 1.2.0 for Openshift
Advisory ID:       RHSA-2023:1817-01
Product:           NETOBSERV
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:1817
Issue date:        2023-04-18
CVE Names:         CVE-2022-41717 CVE-2022-41724 CVE-2022-41725 
=====================================================================

1. Summary:

Network Observability 1.2.0 for OpenShift

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Network Observability 1.2.0 is an OpenShift operator that provides a
monitoring pipeline to collect and enrich network flows that are produced
by the Network observability eBPF agent.

The operator provides dashboards, metrics, and keeps flows accessible in a
queryable log store, Grafana Loki. When a FlowCollector is deployed, new
dashboards are available in the Console.

This update contains bug fixes.

Security Fix(es):

* golang: net/http: An attacker can cause excessive memory growth in a Go
server accepting HTTP/2 requests (CVE-2022-41717)

* golang: crypto/tls: large handshake records may cause panics
(CVE-2022-41724)

* golang: net/http, mime/multipart: denial of service from excessive
resource consumption (CVE-2022-41725)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

4. Bugs fixed (https://bugzilla.redhat.com/):

2161274 - CVE-2022-41717 golang: net/http: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests
2178488 - CVE-2022-41725 golang: net/http, mime/multipart: denial of service from excessive resource consumption
2178492 - CVE-2022-41724 golang: crypto/tls: large handshake records may cause panics

5. JIRA issues fixed (https://issues.jboss.org/):

NETOBSERV-142 - Network Observability infra health
NETOBSERV-350 - Connection tracking
NETOBSERV-521 - Network Observability Operator Seamless Upgrades
NETOBSERV-617 - eBPF agent: Need to split huge GRPC payloads
NETOBSERV-658 - Histogram in NetFlow Table
NETOBSERV-684 - Watch TLS certs & reload
NETOBSERV-696 - Reporter node behaves the opposite of what it says
NETOBSERV-755 - Duplicate flows between pods on different nodes
NETOBSERV-772 - FLP pods and console-plugin doesn't restart on CACert name change
NETOBSERV-774 - Namespace change in CRD result in duplicated ebpf agents
NETOBSERV-785 - [Maintenance] bump to ubi9 / rhel9
NETOBSERV-793 - flowlogs-pipeline is stuck at ContainerCreating when CA cert is misconfigured
NETOBSERV-844 - Unable to have a working statusUrl in FlowCollector with Loki Operator 5.6
NETOBSERV-857 - After some time, it fails to retrieve flows
NETOBSERV-868 - Migrate ebpf agent to use cilium native golang struct
NETOBSERV-889 - Flows not observed in Single stack cluster

6. References:

https://access.redhat.com/security/cve/CVE-2022-41717
https://access.redhat.com/security/cve/CVE-2022-41724
https://access.redhat.com/security/cve/CVE-2022-41725
https://access.redhat.com/security/updates/classification/#moderate

7. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBZD7LGdzjgjWX9erEAQh6JA/9G1Q3O/6gRVD4As1VnJ+JdMe/JBigYekX
/HKyYR3/eED9bom7Cv7TuHLHYaHYKe3g1hcbi1NQJWf+Mv9NtArcdDcszpFXXZHS
+j2G3wrlt36vaRB/yHiZk6ZUn7BLxFEeWFnA2PG7/wEr3JJd21aQ7I/lvQs2sXoB
1kk2NYjBjxHKZ9mm7K3U8bNiprE1BKQHmpptOgCKl16cFLUcYZ+4LJ5awY+QbQz+
7koMph4zOCTLy8jWoqjyM/xEOdaUoVH2oAmHrDlQmEuXUJXiUnEkFylD+3+1mHrK
oDvO3dEwh0uZedgEQsBODpHK4I1XjkmOlc897qWPLQnFA3phhhV0Ut4U75Ybq0Kn
EnXjhBBm50fxwVGYe0Dx0t8845hoGPcE0gnAYcqQwWcf5p6F+vz+7WcH/JpdYNf2
XSF/sjxb8OdWu3x82zeUJo4VOMpt+Sf1Xd0hoHzNIZtu0E4hF8pZlO/ry6clTYxR
F/aSCtkC4CYxobU+w95eY23wevB7KL5tQo0EwrL088Ttr3DdeOcsbrErIzoRRhaC
qIOmslkFaJa/kAt5h7T+bOSzndRC/2wpPTyet/eBL8bJ8qs+QD4pDd79uvt+R1Ur
E9cL7ysBOY4znysWwuJYyZuHqVUCsDzKbIzQMa4lQGBBkb517Yj/HFsrp3W4O/bA
oMzUlJjo8vY=
=DWsU
-----END PGP SIGNATURE-----