RHSA-2023:3905: Important: Network observability 1.3.0 for Openshift
Network Observability 1.3.0 is an OpenShift operator that provides a monitoring pipeline to collect and enrich network flows that are produced by the Network observability eBPF agent.The operator provides dashboards, metrics, and keeps flows accessible in a queryable log store, Grafana Loki. When a FlowCollector is deployed, new dashboards are available in the Console.This update contains bug fixes.Security Fix(es): golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540) golang: html/template: improper sanitization of CSS values (CVE-2023-24539) golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2023:3905?
The severity of RHSA-2023:3905 is classified as moderate.
How do I fix RHSA-2023:3905?
To fix RHSA-2023:3905, upgrade to the latest version of Red Hat Network Observability as specified in the advisory.
What vulnerabilities are addressed in RHSA-2023:3905?
RHSA-2023:3905 addresses multiple vulnerabilities affecting the Network Observability operator.
Is RHSA-2023:3905 applicable to my environment?
RHSA-2023:3905 is applicable if you are using Red Hat Network Observability version 1.3.0.
What is the impact of not addressing RHSA-2023:3905?
Not addressing RHSA-2023:3905 may lead to potential security risks associated with undetected network flows in your observability setup.