Important: Network observability 1.1.0 security update

Topic

Network observability 1.1.0 release for OpenShift

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Network observability is an OpenShift operator that provides a monitoring
pipeline to collect and enrich network flows that are produced by the
Network observability eBPF agent.

The operator provides dashboards, metrics, and keeps flows accessible in a
queryable log store, Grafana Loki. When a FlowCollector is deployed, new
dashboards are available in the Console.

Security Fix(es):

• network-observability-console-plugin-container: setting Loki authToken configuration to DISABLE or HOST mode leads to authentication longer being enforced (CVE-2023-0813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Apply this errata by upgrading Network observability operator 1.0 to 1.1

Affected Products

• Network Observability (NETOBSERV) 1 x86_64

Fixes

• BZ - 2169468 - CVE-2023-0813 network-observability-console-plugin-container: setting Loki authToken configuration to DISABLE or HOST mode leads to authentication longer being enforced

CVEs

• CVE-2021-46848
• CVE-2022-1271
• CVE-2022-1304
• CVE-2022-2509
• CVE-2022-3515
• CVE-2022-3602
• CVE-2022-3715
• CVE-2022-3786
• CVE-2022-3821
• CVE-2022-33099
• CVE-2022-34903
• CVE-2022-35737
• CVE-2022-40303
• CVE-2022-40304
• CVE-2022-42898
• CVE-2022-47629
• CVE-2023-0813

References

• https://access.redhat.com/security/updates/classification/#important