(RHSA-2024:3868) Important: Network Observability 1.6.0 for OpenShift

Network Observability 1.6.0

Security Fix(es):

• CVE-2024-29180 webpack-dev-middleware: lack of URL validation may lead to file leak
• CVE-2024-24786 golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON
• CVE-2023-42282 nodejs-ip: arbitrary code execution via the isPublic() function
• CVE-2023-39326 golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests
• CVE-2024-28849 follow-redirects: Possible credential leak
• CVE-2024-24783 golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm
• CVE-2023-45289 golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect
• CVE-2023-45290 golang: net/http: memory exhaustion in Request.ParseMultipartForm
• CVE-2024-24785 golang: html/template: errors returned from MarshalJSON methods may break template escaping
• CVE-2024-29041 express: cause malformed URLs to be evaluated [noo-1]

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.