CVE and known issues

Author: CarmiWisemon

modules/oadp-release-notes-1-3-0.adoc

@@ -71,6 +71,24 @@ During interoperability testing, Red Hat OpenShift Container Platform 4.14 had t
 There was a regresssion in Pod Volume Backup (PVB) functionality when Velero was installed in several namespaces. The pod volume backup controller was not properly limiting itself to PVBs in its own namespace.
 link:https://issues.redhat.com/browse/OADP-2308[OADP-2308]
 
+.CVE-2023-39325 A flaw was found in handling multiplexed streams in the HTTP/2 protocol.
+A flaw was found in handling multiplexed streams in the HTTP/2 protocol. In previous releases of OADP, a client could repeatedly make a request for a new multiplex stream and immediately send an RST_STREAM frame to cancel it. This created extra work for the server setting up and tearing down the streams while not hitting any server-side limit for the maximum number of active streams per connection, which resulted in a denial of service due to server resource consumption.
+
+The following issues have been listed under this issue:
+
+* link:https://issues.redhat.com/browse/OADP-2886[OADP-2886]
+* link:https://issues.redhat.com/browse/OADP-2895[OADP-2895]
+* link:https://issues.redhat.com/browse/OADP-2869[OADP-2869]
+* link:https://issues.redhat.com/browse/OADP-2898[OADP-2898]
+* link:https://issues.redhat.com/browse/OADP-2904[OADP-2904]
+* link:https://issues.redhat.com/browse/OADP-2907[OADP-2907]
+* link:https://issues.redhat.com/browse/OADP-2910[OADP-2910]
+* link:https://issues.redhat.com/browse/OADP-2889[OADP-2889]
+* link:https://issues.redhat.com/browse/OADP-2892[OADP-2892]
+* link:https://issues.redhat.com/browse/OADP-2901[OADP-2901]
+
+For more information, see link:https://access.redhat.com/security/cve/cve-2023-39325[CVE-2023-39325 (Rapid Reset Attack)]
+
 
 For a complete list of all issues resolved in this release, see the list of link:https://issues.redhat.com/browse/OADP-2819?filter=12422837[OADP 1.3.0 resolved issues] in Jira.
 
@@ -80,6 +98,16 @@ For a complete list of all issues resolved in this release, see the list of link
 .CSI plugin panics on nil pointer when csiSnapshotTimeout is set to a short duration
 The CSI plugin panics on nil pointer when `csiSnapshotTimeout` is set to a short duration. Sometimes it succeeds to complete the snapshot within a short duration, but often it panics with the backup `PartiallyFailed` with the following error: `plugin panicked: runtime error: invalid memory address or nil pointer dereference`. link:https://issues.redhat.com/browse/OADP-3069[OADP-3069]
 
+.Backup is marked as PartiallyFailed when volumeSnapshotContent CR has an error
+If any of the `VolumeSnapshotContent` CR has an error related to removing `VolumeSnapshotBeingCreated` annotation it moves backup to `WaitingForPluginOperationsPartiallyFailed` phase. link:https://issues.redhat.com/browse/OADP-2871[OADP-2871]
+
+.Performance issues when restoring 30k resources for the first time
+When restoring for the first time, without an existing-resource-policy, it takes twice as long as when restoring the second and third time, with an existing-resource-policy. link:https://issues.redhat.com/browse/OADP-3071[OADP-3071]
+
+.Post Restore Hooks might start running before Datadownload operation has released the related PV
+Due to the Asynchronous nature of the Data Mover operation a post-hook might be attempted before the related pods PV's are released by the Data Mover PVC.
+link:https://issues.redhat.com/browse/OADP-3067[OADP-3067]
+
 For a complete list of all known issues in this release, see the list of link:https://issues.redhat.com/browse/OADP-2688?filter=12422838[OADP 1.3.0 known issues] in Jira.
 
 [id="upgrade-notes-1-3-0_{context}"]