RHSA-2024:7074 - Security Advisory

Topic

Network Observability 1.6 for Red Hat OpenShift

Red Hat Product Security has rated this update as having a security impact of
Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives
a detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.

Description

Network Observability 1.6.2

Security Fix(es):

• CVE-2024-24791 golang: net/http: Denial of service due to improper 100-continue handling in net/http

Solution

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Network Observability (NETOBSERV) 1 for RHEL 9 x86_64
• Network Observability (NETOBSERV) for ARM 64 1 for RHEL 9 aarch64
• Network Observability (NETOBSERV) for IBM Power, little endian 1 for RHEL 9 ppc64le
• Network Observability (NETOBSERV) for IBM Z and LinuxONE 1 for RHEL 9 s390x

Fixes

• BZ - 2295310 - CVE-2024-24791 net/http: Denial of service due to improper 100-continue handling in net/http
• NETOBSERV-1737 - consolePlugin fails to get deployed on 4.17 cluster

CVEs

• CVE-2024-2398
• CVE-2024-24791
• CVE-2024-34397
• CVE-2024-37370
• CVE-2024-37371

References

• https://access.redhat.com/security/updates/classification/#moderate