Issued:: 2024-02-21
Updated:: 2024-02-21

RHSA-2024:0853 - Moderate: Network Observability 1.5.0 for OpenShift

Synopsis

Moderate: Network Observability 1.5.0 for OpenShift

Type/Severity

Security Advisory Moderate

Topic

Network Observability is an OpenShift operator that deploys a monitoring pipeline to collect and enrich network flows that are produced by the Network Observability eBPF agent.

The operator provides dashboards, metrics, and keeps flows accessible in a queryable log store, Grafana Loki. When a FlowCollector is deployed, new dashboards are available in the Console.

Description

Network Observability 1.5.0

Security Fix(es):

CVE-2023-26159 follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse()

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

Product	Version	Arch
Network Observability (NETOBSERV)	1	x86_64
Network Observability (NETOBSERV) for IBM Z and LinuxONE	1	s390x
Network Observability (NETOBSERV) for IBM Power, little endian	1	ppc64le
Network Observability (NETOBSERV) for ARM 64	1	aarch64

Fixes

CVEs

References

https://access.redhat.com/security/updates/classification/#moderate

Additional information

The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.