-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: OpenShift Container Platform 3.11.z security update
Advisory ID:       RHSA-2021:5094-01
Product:           Red Hat OpenShift Enterprise
Advisory URL:      https://access.redhat.com/errata/RHSA-2021:5094
Issue date:        2021-12-14
CVE Names:         CVE-2021-44228 
=====================================================================

1. Summary:

Red Hat OpenShift Container Platform release 3.11.z is now available with
updates to packages and images that fix several bugs and add enhancements.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

Security Fix(es):

* log4j-core: Remote code execution in Log4j 2.x when logs contain an
attacker-controlled string value (CVE-2021-44228)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s)
listed in the References section.

3. Solution:

See the following documentation, which will be updated shortly for release
3.11.z, for important instructions on how to upgrade your cluster and fully
apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258.

4. Bugs fixed (https://bugzilla.redhat.com/):

2030932 - CVE-2021-44228 log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value

5. References:

https://access.redhat.com/security/cve/CVE-2021-44228
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/security/vulnerabilities/RHSB-2021-009

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYbhLlNzjgjWX9erEAQjrlxAAj770a1W36/Z4tU0kuWsNKPln/JrIgHh3
HpAIie07f44TvOlbFZS9hPyKiCj218NFZJ/gK6mf7JSPdAoa1/Q8j8mDCqcgf5Dv
DZx1MBpO5DTdZI32GMUSmCE6iMHVdeSKWV0uQUZATiM43ximiyu4ypdrKP0DYHP5
AMSCXwTzh6OnnMVyvGcO0+DHFj+Nw01oXPMp5a/aHM9FrJiWxl18Qmr87DuVXYij
mr7U6eEL7feOSfJX7fbTJMqDvv86O7b+AmONf+1DSx/SSYjRkpxSSKXrMXPt0vzp
2rG6Mp6hktKtxInOKQ0jHz/7P/yn7UKQeXdkKbAwy4OI5qKPsrxwJntDKXzrXQQx
AD63JddKt57Frvh4scseWorQGYrRPyXqiJli/RIsrrzWsH0sTrmgdOcgc5eLZUjQ
VeuSCJY5yAsgkGtWPTVVeH42jimg6exK//hTkpov62baKR6l9emEOKEQJo7YTBLd
k4irq3ScdJJdYKR3pO1qQV4Fur9nWDxdl6zmQVY7bwRbca8OZFgwmoczbbSncCkq
8wzG4WLQrwsQKu+BUfTK1w7/xtpBOiOyyyQ0NzxhuqiFVt7kIFIJkXPf6gZGJTWM
a1OY1jbKqfiDdGTmrhR6Mh2hjhXFvnnkjPCRkfTJxBnI6KyfOstS5TzqxlGFpfX5
wBOlSXQ0hjw=
=yn9v
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce