Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Red Hat: RHSA-2022-0585-01 Important: sg-core-container Security Update

red hat
Calendar Grey February 21, 2022
Dist Redhat Esm H88
A significant security patch for Red Hat's Service Telemetry Framework version 1.4 has been released, resolving urgent vulnerabilities.
An update for sg-core-container is now available for Service Telemetry Framework 1.4

Solution

The Service Telemetry Framework container image provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container Catalog (see References). Dockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.

Summary

Service Telemetry Framework (STF) provides automated collection of measurements and data from remote clients, such as Red Hat OpenStack Platform or third-party nodes. STF then transmits the information to a centralized, receiving Red Hat OpenShift Container Platform (OCP) deployment for storage, retrieval, and monitoring.
Security fixes:
* golang: net/http: limit growth of header canonicalization cache (CVE-2021-44716) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Bug fixes:
* In some cases, Ceilometer metrics were not handled properly by sg-core. This resulted in some Ceilometer metrics not being stored in Prometheus. In this release, the processing of metrics has been enhanced to be more robust. While the sg-core has been enhanced to support larger messages from Ceilometer, an additional change is required to support passing the larger messages through the sg-bridge ring buffer. The changes required to fully support this functionality is being tracked in RHBZ#2053681. (BZ#2051615)

Topics%20covered

Topics Covered

security advisory security update red hat important container security service telemetry framework sg-core-container

References

https://access.redhat.com/security/cve/CVE-2021-3521 https://access.redhat.com/security/cve/CVE-2021-44716 https://access.redhat.com/security/updates/classification#important

Package List


Severity
important
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2022:0585-01
Product: Red Hat OpenStack Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2022:0585
Issue date: 2022-02-21

Topic

An update for sg-core-container is now available for Service TelemetryFramework 1.4.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory security update red hat important container security service telemetry framework sg-core-container

Relevant Releases Architectures

Bugs Fixed

2030801 - CVE-2021-44716 golang: net/http: limit growth of header canonicalization cache

2051615 - [STF 1.4] sg-core fails handling some messages due to some invalid escape char

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here