Issued:
2024-06-17
Updated:
2024-06-17

RHSA-2024:3868 - Important: Network Observability 1.6.0 for OpenShift

Synopsis

Important: Network Observability 1.6.0 for OpenShift

Type/Severity

Security Advisory Important

Topic

Network Observability 1.6 for Red Hat OpenShift

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Network Observability 1.6.0

Security Fix(es):

  • CVE-2024-29180 webpack-dev-middleware: lack of URL validation may lead to file leak
  • CVE-2024-24786 golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON
  • CVE-2023-42282 nodejs-ip: arbitrary code execution via the isPublic() function
  • CVE-2023-39326 golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests
  • CVE-2024-28849 follow-redirects: Possible credential leak
  • CVE-2024-24783 golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm
  • CVE-2023-45289 golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect
  • CVE-2023-45290 golang: net/http: memory exhaustion in Request.ParseMultipartForm
  • CVE-2024-24785 golang: html/template: errors returned from MarshalJSON methods may break template escaping
  • CVE-2024-29041 express: cause malformed URLs to be evaluated [noo-1]

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

ProductVersionArch
Network Observability (NETOBSERV)1x86_64
Network Observability (NETOBSERV) for IBM Z and LinuxONE1s390x
Network Observability (NETOBSERV) for IBM Power, little endian1ppc64le
Network Observability (NETOBSERV) for ARM 641aarch64

Fixes

CVEs

References

Additional information