红帽产品勘误 RHSA-2023:3905 - Security Advisory
发布：
2023-06-28
已更新：
2023-06-28

RHSA-2023:3905 - Security Advisory

概述

Important: Network observability 1.3.0 for Openshift

类型/严重性

Security Advisory: Important

标题

Network Observability 1.3.0 for OpenShift

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

描述

Network Observability 1.3.0 is an OpenShift operator that provides a monitoring pipeline to collect and enrich network flows that are produced by the Network observability eBPF agent.

The operator provides dashboards, metrics, and keeps flows accessible in a queryable log store, Grafana Loki. When a FlowCollector is deployed, new dashboards are available in the Console.

This update contains bug fixes.

Security Fix(es):

  • golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)
  • golang: html/template: improper sanitization of CSS values (CVE-2023-24539)
  • golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

解决方案

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

受影响的产品

  • Network Observability (NETOBSERV) 1 for RHEL 9 x86_64
  • Network Observability (NETOBSERV) for ARM 64 1 for RHEL 9 aarch64
  • Network Observability (NETOBSERV) for IBM Power, little endian 1 for RHEL 9 ppc64le

修复

  • BZ - 2196026 - CVE-2023-24539 golang: html/template: improper sanitization of CSS values
  • BZ - 2196027 - CVE-2023-24540 golang: html/template: improper handling of JavaScript whitespace
  • BZ - 2196029 - CVE-2023-29400 golang: html/template: improper handling of empty HTML attributes
  • NETOBSERV-1003 - include metrics role and rolebinding in operator bundle
  • NETOBSERV-166 - Multitenancy support in Network Observability for project admins
  • NETOBSERV-391 - Metrics & prometheus setup - flow based dashboards and metrics
  • NETOBSERV-576 - Multi-arch builds - amd64, ppc64le, arm64
  • NETOBSERV-765 - Plugin's ServiceMonitor doesn't work
  • NETOBSERV-773 - Copy certificates across namespaces
  • NETOBSERV-776 - Implement RBAC control in Loki Gateway
  • NETOBSERV-901 - Console integration (admin perspective)
  • NETOBSERV-934 - Add SCTP/ICMPv4/ICMPv6 support to ebpf agent
  • NETOBSERV-971 - portNaming cannot be disabled
  • NETOBSERV-972 - user authentication fails for non-kubeadmin users despite they're in cluster-admin groups
  • NETOBSERV-976 - Not able to disable alerts
  • NETOBSERV-981 - add must-gather support for network-observability
  • NETOBSERV-984 - KafkaInterBrokerProtocalVersion throws warning and has ingestion errors
  • NETOBSERV-1070 - FLP metrics is not populated with TLS scheme

aarch64

network-observability/network-observability-console-plugin-rhel9@sha256:f3ecfcc041d2c01287f437125df492a7781f9094850513170ebcd54c94737103
network-observability/network-observability-ebpf-agent-rhel9@sha256:47801e613c40d0a07f22d3aea6f95708f512acbf09e4c30b683dba7dfea53e9f
network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:23e28210806e49df576c16d1e599e8a0ed5dea19154f1c5baf9add9fa2d2833c
network-observability/network-observability-operator-bundle@sha256:22a408f5b24c1ca916a80f15cfe3cb9059a3dc5677d297c7386c00cb751be487
network-observability/network-observability-rhel9-operator@sha256:a06a3a4a5604d0e2bad7eaa63b98a12acc86ddbb2e9cbf3470fd5157a02f7bf1

ppc64le

network-observability/network-observability-console-plugin-rhel9@sha256:37a3f439c5a55366727163512a1eccbb7962dbc086d8a79287b7476207d212dc
network-observability/network-observability-ebpf-agent-rhel9@sha256:589f15ee6f2d80e7d4e9e28fc63ca7e5d56f5a388634ce276dc57f4e27a0a89b
network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c45986d378f644b5824b03c29ce6033de81219603446121fee0833e5158a702e
network-observability/network-observability-operator-bundle@sha256:80788b01b0a853ca8dde3b7351f5af8b7622453616f2ee4a4cb064f65bebaa60
network-observability/network-observability-rhel9-operator@sha256:414cd50dc5e204226eb32b21da876aad3edba2c7b5a8a935e8e275773e63d56a

s390x

network-observability/network-observability-console-plugin-rhel9@sha256:da2ef6762243a73fbb67cf3b5d70194e69c1d10bcac02e59caedea03061e4577
network-observability/network-observability-ebpf-agent-rhel9@sha256:7e340285995d87c203cf9125dba0ec9c6fbce7eca90e9979e1f81611eae0f736
network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:c096d0c061cc92ec7db12111cd95117960c970a10043a4c77b0c0506a23f2d65
network-observability/network-observability-operator-bundle@sha256:5dbc838683ee0b38a6aa6829ef98d64dcff1be89f58ac2a57ed5dce03ed3713b
network-observability/network-observability-rhel9-operator@sha256:4c485468c25f82c49c68b4b7a489c636f834b09f0c52debfd6311a54b0366505

x86_64

network-observability/network-observability-console-plugin-rhel9@sha256:df7740057c2c606ba8480ea52bd633f20959a458d533a9a3210c4a13e475ca21
network-observability/network-observability-ebpf-agent-rhel9@sha256:d40cf50e30d0f475dad272520f332ee437b35b6ca4b786513e73a930e3a88eab
network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:bacfb687cad8a421e7d1c6743c16ce1296af9bee1a845d7cf337deba3df809da
network-observability/network-observability-operator-bundle@sha256:b03f4e88ab1fed4744356a584d673fb2fdb15de7e1de7786bdd222b853690670
network-observability/network-observability-rhel9-operator@sha256:38b57c0ea502708bdc49fb47fb9c50bbc93ddb22b941160e4a1cac0f2afc6856

Red Hat 安全团队联络方式为 secalert@redhat.com。 更多联络细节请参考 https://access.redhat.com/security/team/contact/。