Service Telemetry Framework (STF) provides automated collection of measurements and data from remote clients, such as Red Hat OpenStack Platform or third-party nodes. STF then transmits the information to a centralized, receiving Red Hat OpenShift Container Platform (OCP) deployment for storage, retrieval, and monitoring.<br>Security Fix(es):<br><li> golang: crypto/elliptic: IsOnCurve returns true for invalid field elements (CVE-2022-23806)</li> <li> golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString (CVE-2022-23772)</li> <li> golang: cmd/go: misinterpretation of branch names can lead to incorrect access control (CVE-2022-23773)</li> <li> golang: encoding/pem: fix stack overflow in Decode (CVE-2022-24675)</li> <li> golang: crypto/elliptic: panic caused by oversized scalar (CVE-2022-28327)</li> <li> golang: syscall: faccessat checks wrong group (CVE-2022-29526)</li> <li> golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)</li> <li> golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)</li> <li> golang: net/<a href="http:" target="blank">http:</a> improper sanitization of Transfer-Encoding header (CVE-2022-1705)</li> <li> golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)</li> <li> golang: net/<a href="http:" target="blank">http:</a> handle server errors after sending GOAWAY (CVE-2022-27664)</li> <li> golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)</li> <li> golang: net/<a href="http:" target="blank">http:</a> An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)</li> <li> golang: crypto/tls: session tickets lack random ticketageadd (CVE-2022-30629)</li> <li> golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service (CVE-2022-32189)</li> For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Service Telemetry Framework (STF) provides automated collection of measurements and data from remote clients, such as Red Hat OpenStack Platform or third-party nodes. STF then transmits the information to a centralized, receiving Red Hat OpenShift Container Platform (OCP) deployment for storage, retrieval, and monitoring.<br>Security Fix(es):<br><li> golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Service Telemetry Framework (STF) provides automated collection of measurements and data from remote clients, such as Red Hat OpenStack Platform or third-party nodes. STF then transmits the information to a centralized, receiving Red Hat OpenShift Container Platform (OCP) deployment for storage, retrieval, and monitoring.<br>Security fixes:<br><li> golang: net/<a href="http:" target="blank">http:</a> limit growth of header canonicalization cache (CVE-2021-44716) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.</li> Bug fixes:<br><li> In some cases, Ceilometer metrics were not handled properly by sg-core. This resulted in some Ceilometer metrics not being stored in Prometheus. In this release, the processing of metrics has been enhanced to be more robust. While the sg-core has been enhanced to support larger messages from Ceilometer, an additional change is required to support passing the larger messages through the sg-bridge ring buffer. The changes required to fully support this functionality is being tracked in RHBZ#2053681. (BZ#2051615)</li>