RHSA-2023:1817 - Security Advisory

Topic

Network Observability 1.2.0 for OpenShift

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Network Observability 1.2.0 is an OpenShift operator that provides a monitoring pipeline to collect and enrich network flows that are produced by the Network observability eBPF agent.

The operator provides dashboards, metrics, and keeps flows accessible in a
queryable log store, Grafana Loki. When a FlowCollector is deployed, new
dashboards are available in the Console.

This update contains bug fixes.

Security Fix(es):

• golang: net/http: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)
• golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)
• golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Network Observability (NETOBSERV) 1 for RHEL 9 x86_64

Fixes

• BZ - 2161274 - CVE-2022-41717 golang: net/http: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests
• BZ - 2178488 - CVE-2022-41725 golang: net/http, mime/multipart: denial of service from excessive resource consumption
• BZ - 2178492 - CVE-2022-41724 golang: crypto/tls: large handshake records may cause panics
• NETOBSERV-617 - eBPF agent: Need to split huge GRPC payloads
• NETOBSERV-684 - Watch TLS certs & reload
• NETOBSERV-696 - Reporter node behaves the opposite of what it says
• NETOBSERV-755 - Duplicate flows between pods on different nodes
• NETOBSERV-772 - FLP pods and console-plugin doesn't restart on CACert name change
• NETOBSERV-774 - Namespace change in CRD result in duplicated ebpf agents
• NETOBSERV-785 - [Maintenance] bump to ubi9 / rhel9
• NETOBSERV-793 - flowlogs-pipeline is stuck at ContainerCreating when CA cert is misconfigured
• NETOBSERV-844 - Unable to have a working statusUrl in FlowCollector with Loki Operator 5.6
• NETOBSERV-857 - After some time, it fails to retrieve flows
• NETOBSERV-889 - Flows not observed in Single stack cluster
• NETOBSERV-142 - Network Observability infra health
• NETOBSERV-350 - Connection tracking
• NETOBSERV-521 - Network Observability Operator Seamless Upgrades
• NETOBSERV-658 - Histogram in NetFlow Table
• NETOBSERV-868 - Migrate ebpf agent to use cilium native golang struct

CVEs

• CVE-2022-41717
• CVE-2022-41724
• CVE-2022-41725

References

• https://access.redhat.com/security/updates/classification/#moderate