This advisory covers two golang-related vulnerabilities affecting Red Hat Network Observability 1.6 for OpenShift on RHEL 9 across multiple architectures (x86_64, aarch64, ppc64le, s390x). CVE-2024-24789 is a flaw in the archive/zip package causing incorrect handling of certain ZIP files, potentially leading to unexpected behavior or security issues. CVE-2024-24790 concerns unexpected behavior from Is methods in the net/netip package when processing IPv4-mapped IPv6 addresses, which could cause incorrect IP address handling. Red Hat has released Network Observability 1.6.1 to address these issues.

The vulnerabilities could lead to incorrect processing of ZIP files and IP addresses within the affected golang components used by Network Observability, potentially causing unexpected behavior or security risks in network monitoring or data handling. Red Hat rates the security impact as moderate. There are no known exploits in the wild at this time.

Red Hat has released Network Observability version 1.6.1 which includes fixes for CVE-2024-24789 and CVE-2024-24790. Users should apply this update to remediate the vulnerabilities. For detailed update instructions, refer to Red Hat's official article at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor.