Issued:
2023-02-15
Updated:
2023-02-15

RHSA-2023:0786 - Important: Network observability 1.1.0 security update

Synopsis

Important: Network observability 1.1.0 security update

Type/Severity

Security Advisory Important

Topic

Network observability 1.1.0 release for OpenShift

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Network observability is an OpenShift operator that provides a monitoring pipeline to collect and enrich network flows that are produced by the Network observability eBPF agent.

The operator provides dashboards, metrics, and keeps flows accessible in a queryable log store, Grafana Loki. When a FlowCollector is deployed, new dashboards are available in the Console.

Security Fix(es):

  • network-observability-console-plugin-container: setting Loki authToken configuration to DISABLE or HOST mode leads to authentication longer being enforced (CVE-2023-0813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Apply this errata by upgrading Network observability operator 1.0 to 1.1

Affected Products

ProductVersionArch
Network Observability (NETOBSERV)1x86_64

Fixes

CVEs

References

Additional information