what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Red Hat Security Advisory 2021-5128-06

Red Hat Security Advisory 2021-5128-06
Posted Dec 15, 2021
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2021-5128-06 - Openshift Logging Security and Bug Fix Release. Issues addressed include a code execution vulnerability.

tags | advisory, code execution
systems | linux, redhat
advisories | CVE-2018-20673, CVE-2018-25009, CVE-2018-25010, CVE-2018-25012, CVE-2018-25013, CVE-2018-25014, CVE-2019-13750, CVE-2019-13751, CVE-2019-17594, CVE-2019-17595, CVE-2019-18218, CVE-2019-19603, CVE-2019-20838, CVE-2019-5827, CVE-2020-12762, CVE-2020-13435, CVE-2020-14145, CVE-2020-14155, CVE-2020-16135, CVE-2020-17541, CVE-2020-24370, CVE-2020-35521, CVE-2020-35522, CVE-2020-35523, CVE-2020-35524, CVE-2020-36330
SHA-256 | 44e06a5434f14a4d37594b811db7932de84ae206a506770768a3ce7c107b84a6

Red Hat Security Advisory 2021-5128-06

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================
Red Hat Security Advisory

Synopsis: Moderate: Openshift Logging security and bug update (5.1.5)
Advisory ID: RHSA-2021:5128-01
Product: Red Hat OpenShift Enterprise
Advisory URL: https://access.redhat.com/errata/RHSA-2021:5128
Issue date: 2021-12-14
CVE Names: CVE-2018-20673 CVE-2018-25009 CVE-2018-25010
CVE-2018-25012 CVE-2018-25013 CVE-2018-25014
CVE-2019-5827 CVE-2019-13750 CVE-2019-13751
CVE-2019-17594 CVE-2019-17595 CVE-2019-18218
CVE-2019-19603 CVE-2019-20838 CVE-2020-12762
CVE-2020-13435 CVE-2020-14145 CVE-2020-14155
CVE-2020-16135 CVE-2020-17541 CVE-2020-24370
CVE-2020-35521 CVE-2020-35522 CVE-2020-35523
CVE-2020-35524 CVE-2020-36330 CVE-2020-36331
CVE-2020-36332 CVE-2021-3200 CVE-2021-3426
CVE-2021-3445 CVE-2021-3481 CVE-2021-3572
CVE-2021-3580 CVE-2021-3712 CVE-2021-3778
CVE-2021-3796 CVE-2021-3800 CVE-2021-20231
CVE-2021-20232 CVE-2021-20266 CVE-2021-21409
CVE-2021-22876 CVE-2021-22898 CVE-2021-22925
CVE-2021-23840 CVE-2021-23841 CVE-2021-27645
CVE-2021-28153 CVE-2021-31535 CVE-2021-33560
CVE-2021-33574 CVE-2021-35942 CVE-2021-36084
CVE-2021-36085 CVE-2021-36086 CVE-2021-36087
CVE-2021-37136 CVE-2021-37137 CVE-2021-42574
CVE-2021-43527 CVE-2021-44228
====================================================================
1. Summary:

An update is now available for OpenShift Logging 5.1.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Openshift Logging Security and Bug Fix Release (5.1.5)

Security Fix(es):

* log4j-core: Remote code execution in Log4j 2.x when logs contain an
attacker-controlled string value (CVE-2021-44228)

* netty: Request smuggling via content-length header (CVE-2021-21409)

* netty-codec: Bzip2Decoder doesn't allow setting size restrictions for
decompressed data (CVE-2021-37136)

* netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may
buffer skippable chunks in an unnecessary way (CVE-2021-37137)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

For OpenShift Container Platform 4.8 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this errata update:

https://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html

For Red Hat OpenShift Logging 5.1, see the following instructions to apply
this update:

https://docs.openshift.com/container-platform/4.8/logging/cluster-logging-upgrading.html

4. Bugs fixed (https://bugzilla.redhat.com/):

1944888 - CVE-2021-21409 netty: Request smuggling via content-length header
2004133 - CVE-2021-37136 netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data
2004135 - CVE-2021-37137 netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way
2030932 - CVE-2021-44228 log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value

5. JIRA issues fixed (https://issues.jboss.org/):

LOG-1971 - Applying cluster state is causing elasticsearch to hit an issue and become unusable

6. References:

https://access.redhat.com/security/cve/CVE-2018-20673
https://access.redhat.com/security/cve/CVE-2018-25009
https://access.redhat.com/security/cve/CVE-2018-25010
https://access.redhat.com/security/cve/CVE-2018-25012
https://access.redhat.com/security/cve/CVE-2018-25013
https://access.redhat.com/security/cve/CVE-2018-25014
https://access.redhat.com/security/cve/CVE-2019-5827
https://access.redhat.com/security/cve/CVE-2019-13750
https://access.redhat.com/security/cve/CVE-2019-13751
https://access.redhat.com/security/cve/CVE-2019-17594
https://access.redhat.com/security/cve/CVE-2019-17595
https://access.redhat.com/security/cve/CVE-2019-18218
https://access.redhat.com/security/cve/CVE-2019-19603
https://access.redhat.com/security/cve/CVE-2019-20838
https://access.redhat.com/security/cve/CVE-2020-12762
https://access.redhat.com/security/cve/CVE-2020-13435
https://access.redhat.com/security/cve/CVE-2020-14145
https://access.redhat.com/security/cve/CVE-2020-14155
https://access.redhat.com/security/cve/CVE-2020-16135
https://access.redhat.com/security/cve/CVE-2020-17541
https://access.redhat.com/security/cve/CVE-2020-24370
https://access.redhat.com/security/cve/CVE-2020-35521
https://access.redhat.com/security/cve/CVE-2020-35522
https://access.redhat.com/security/cve/CVE-2020-35523
https://access.redhat.com/security/cve/CVE-2020-35524
https://access.redhat.com/security/cve/CVE-2020-36330
https://access.redhat.com/security/cve/CVE-2020-36331
https://access.redhat.com/security/cve/CVE-2020-36332
https://access.redhat.com/security/cve/CVE-2021-3200
https://access.redhat.com/security/cve/CVE-2021-3426
https://access.redhat.com/security/cve/CVE-2021-3445
https://access.redhat.com/security/cve/CVE-2021-3481
https://access.redhat.com/security/cve/CVE-2021-3572
https://access.redhat.com/security/cve/CVE-2021-3580
https://access.redhat.com/security/cve/CVE-2021-3712
https://access.redhat.com/security/cve/CVE-2021-3778
https://access.redhat.com/security/cve/CVE-2021-3796
https://access.redhat.com/security/cve/CVE-2021-3800
https://access.redhat.com/security/cve/CVE-2021-20231
https://access.redhat.com/security/cve/CVE-2021-20232
https://access.redhat.com/security/cve/CVE-2021-20266
https://access.redhat.com/security/cve/CVE-2021-21409
https://access.redhat.com/security/cve/CVE-2021-22876
https://access.redhat.com/security/cve/CVE-2021-22898
https://access.redhat.com/security/cve/CVE-2021-22925
https://access.redhat.com/security/cve/CVE-2021-23840
https://access.redhat.com/security/cve/CVE-2021-23841
https://access.redhat.com/security/cve/CVE-2021-27645
https://access.redhat.com/security/cve/CVE-2021-28153
https://access.redhat.com/security/cve/CVE-2021-31535
https://access.redhat.com/security/cve/CVE-2021-33560
https://access.redhat.com/security/cve/CVE-2021-33574
https://access.redhat.com/security/cve/CVE-2021-35942
https://access.redhat.com/security/cve/CVE-2021-36084
https://access.redhat.com/security/cve/CVE-2021-36085
https://access.redhat.com/security/cve/CVE-2021-36086
https://access.redhat.com/security/cve/CVE-2021-36087
https://access.redhat.com/security/cve/CVE-2021-37136
https://access.redhat.com/security/cve/CVE-2021-37137
https://access.redhat.com/security/cve/CVE-2021-42574
https://access.redhat.com/security/cve/CVE-2021-43527
https://access.redhat.com/security/cve/CVE-2021-44228
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/security/vulnerabilities/RHSB-2021-009

7. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYbj01NzjgjWX9erEAQhG9w/+JmAEO9aC4JzQ/e7WfCnnAAAWMxNJWGbc
vrmGp8NYuD2CBM1XixK6vTw+NagMU7NJChPAjaGuzE4MGEF3ptQnOniZn10lnzS2
tOm+Gltaj/JVuntVeXLvKk7zxboXzazVtyEOGwBcZG9CraxTmZSyc77vvVG3Jram
KGNWz6cmM14hwEhtLg1npmX9vNfquce46EmKRoyiXSg3JvLWDii1ez8v5A6OzF/I
cdd/ohFooOJtUT9PSccmrKIQ2Z7R/kZzksw41z5ZFAi/x35ajVbJq8cL5fGE0/gs
BtuEs6+MXRS/dpoobEDfVIAnzb97UJT/jZ1GhaBPNLuyT3uL2dvxOu3NpLkEHDQJ
HVlj/a8SBLFnITak7Hu5AKbDa0N0SOjbIjxKVZ3L73uHbNQPlaGLcA2C692CG7Qe
8Hvagfqhtgy9dQ46rYmr7lq81QXeZHlwCzUknPcdDZoR8GF42rTJaN/S3b0kRBJ7
+QRxRM5PbkRiBjkG157qSHnYORTD004hffZ09QSOHa+OTiyPlAYeGWgU6rJ/LsyZ
a6MuFKBumQJFFG3+O5yRceXtS3g8rTZGSjWqGr6z2z5kTMmf/rarANdPwcGU0snu
XxMpuGRE4iLy/6VcuzP8+WfMmXbwY5/mCHnSSqpfAdGHYoMem1Lyc4akt7fdNt0G
1dLkzUQ4qIQôwZ
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Login or Register to add favorites

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    30 Files
  • 16
    Apr 16th
    10 Files
  • 17
    Apr 17th
    22 Files
  • 18
    Apr 18th
    45 Files
  • 19
    Apr 19th
    8 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    11 Files
  • 23
    Apr 23rd
    68 Files
  • 24
    Apr 24th
    23 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close