RHSA-2024:3868 - Security Advisory

Topic

Network Observability 1.6 for Red Hat OpenShift

Red Hat Product Security has rated this update as having a security impact of
Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Network Observability 1.6.0

Security Fix(es):

• CVE-2024-29180 webpack-dev-middleware: lack of URL validation may lead to file leak
• CVE-2024-24786 golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON
• CVE-2023-42282 nodejs-ip: arbitrary code execution via the isPublic() function
• CVE-2023-39326 golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests
• CVE-2024-28849 follow-redirects: Possible credential leak
• CVE-2024-24783 golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm
• CVE-2023-45289 golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect
• CVE-2023-45290 golang: net/http: memory exhaustion in Request.ParseMultipartForm
• CVE-2024-24785 golang: html/template: errors returned from MarshalJSON methods may break template escaping
• CVE-2024-29041 express: cause malformed URLs to be evaluated [noo-1]

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

Solution

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Network Observability (NETOBSERV) 1 for RHEL 9 x86_64
• Network Observability (NETOBSERV) for ARM 64 1 for RHEL 9 aarch64
• Network Observability (NETOBSERV) for IBM Power, little endian 1 for RHEL 9 ppc64le
• Network Observability (NETOBSERV) for IBM Z and LinuxONE 1 for RHEL 9 s390x

Fixes

• BZ - 2253330 - CVE-2023-39326 golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests
• BZ - 2265161 - CVE-2023-42282 nodejs-ip: arbitrary code execution via the isPublic() function
• BZ - 2268017 - CVE-2023-45290 golang: net/http: memory exhaustion in Request.ParseMultipartForm
• BZ - 2268018 - CVE-2023-45289 golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect
• BZ - 2268019 - CVE-2024-24783 golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm
• BZ - 2268022 - CVE-2024-24785 golang: html/template: errors returned from MarshalJSON methods may break template escaping
• BZ - 2268046 - CVE-2024-24786 golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON
• BZ - 2269576 - CVE-2024-28849 follow-redirects: Possible credential leak
• BZ - 2270863 - CVE-2024-29180 webpack-dev-middleware: lack of URL validation may lead to file leak
• BZ - 2290901 - CVE-2024-29041 express: cause malformed URLs to be evaluated
• NETOBSERV-1544 - Dead link in Network Observability Operator page
• NETOBSERV-1607 - metrics API has invalid link to json flows format page
• NETOBSERV-1647 - Reconcile errors for lokistack-gateway-ca-bundle when loki.enable=false and loki.mode=LokiStack
• NETOBSERV-1279 - Netobserv CLI
• NETOBSERV-1408 - use TCX ebpf hook instead of TC and remove dependency on netlink and qdisc
• NETOBSERV-1424 - Custom metrics API GA
• NETOBSERV-1453 - Improve eBPF agent performance 1.6
• NETOBSERV-1459 - Deduper merge mode enablement
• NETOBSERV-1462 - New metrics datasource for console plugin
• NETOBSERV-1598 - Deployment & Collection filtering capabilities
• NETOBSERV-1606 - Add Pods toleration support
• NETOBSERV-1630 - Can't create a filtering rule with a NOT, i.e., NOT <CIDR>
• NETOBSERV-1621 - When user is not admin overview and table view page doesn't show error message

CVEs

• CVE-2022-48554
• CVE-2023-2975
• CVE-2023-3446
• CVE-2023-3817
• CVE-2023-5678
• CVE-2023-6129
• CVE-2023-6237
• CVE-2023-7008
• CVE-2023-39326
• CVE-2023-42282
• CVE-2023-45289
• CVE-2023-45290
• CVE-2024-0727
• CVE-2024-2961
• CVE-2024-24783
• CVE-2024-24785
• CVE-2024-24786
• CVE-2024-25062
• CVE-2024-28182
• CVE-2024-28834
• CVE-2024-28835
• CVE-2024-28849
• CVE-2024-29041
• CVE-2024-29180
• CVE-2024-33599
• CVE-2024-33600
• CVE-2024-33601
• CVE-2024-33602

References

• https://access.redhat.com/security/updates/classification/#important