exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Red Hat Security Advisory 2023-0930-01

Red Hat Security Advisory 2023-0930-01
Posted Mar 9, 2023
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2023-0930-01 - Update information for Logging Subsystem 5.5.8 in Red Hat OpenShift. Red Hat Product Security has rated this update as having a security impact of Moderate.

tags | advisory
systems | linux, redhat
advisories | CVE-2020-10735, CVE-2021-28861, CVE-2022-24999, CVE-2022-2873, CVE-2022-40897, CVE-2022-41222, CVE-2022-41717, CVE-2022-43945, CVE-2022-4415, CVE-2022-45061, CVE-2022-48303
SHA-256 | 658ffa57cf97948f0f07e630b296ef00eae93213218b2c60f486f12cd075e147

Red Hat Security Advisory 2023-0930-01

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: Logging Subsystem 5.5.8 - Red Hat OpenShift
Advisory ID: RHSA-2023:0930-01
Product: Logging Subsystem for Red Hat OpenShift
Advisory URL: https://access.redhat.com/errata/RHSA-2023:0930
Issue date: 2023-03-08
CVE Names: CVE-2020-10735 CVE-2021-28861 CVE-2022-2873
CVE-2022-4415 CVE-2022-24999 CVE-2022-40897
CVE-2022-41222 CVE-2022-41717 CVE-2022-43945
CVE-2022-45061 CVE-2022-48303
=====================================================================

1. Summary:

Logging Subsystem 5.5.8 - Red Hat OpenShift

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Logging Subsystem 5.5.8 - Red Hat OpenShift

Security Fix(es):

* express: "qs" prototype poisoning causes the hang of the node process
(CVE-2022-24999)

* golang: net/http: An attacker can cause excessive memory growth in a Go
server accepting HTTP/2 requests (CVE-2022-41717)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

For OpenShift Container Platform 4.11 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this errata update:

https://docs.openshift.com/container-platform/4.11/release_notes/ocp-4-11-release-notes.html

For Red Hat OpenShift Logging 5.5, see the following instructions to apply
this update:

https://docs.openshift.com/container-platform/4.11/logging/cluster-logging-upgrading.html

4. Bugs fixed (https://bugzilla.redhat.com/):

2150323 - CVE-2022-24999 express: "qs" prototype poisoning causes the hang of the node process
2161274 - CVE-2022-41717 golang: net/http: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests

5. JIRA issues fixed (https://issues.jboss.org/):

LOG-3630 - [release-5.5] Inconsistencies in vector normalization of systemd logs.

6. References:

https://access.redhat.com/security/cve/CVE-2020-10735
https://access.redhat.com/security/cve/CVE-2021-28861
https://access.redhat.com/security/cve/CVE-2022-2873
https://access.redhat.com/security/cve/CVE-2022-4415
https://access.redhat.com/security/cve/CVE-2022-24999
https://access.redhat.com/security/cve/CVE-2022-40897
https://access.redhat.com/security/cve/CVE-2022-41222
https://access.redhat.com/security/cve/CVE-2022-41717
https://access.redhat.com/security/cve/CVE-2022-43945
https://access.redhat.com/security/cve/CVE-2022-45061
https://access.redhat.com/security/cve/CVE-2022-48303
https://access.redhat.com/security/updates/classification/#moderate

7. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBZAkjvtzjgjWX9erEAQi6tg//cJalZDsvnICf9o4Rs1uZjds+wIMe9Ood
26/ZK0dz+sr2c1zUrPZyRNSARa23TVNA4yN/rbO3qaTBUZg/3aYJrSMqCsNg+/FY
O5gv4hlWNLkvS7/yiNvdOKTKVHpy9j0Kb4NEsI1X2pYZ/QOFd/U1lK4i9gUlIGIL
DjDajvfMCQvzMwap+Y157aoWern+TwOhfr9xuMzGm4rFDRTG/AH4mORWwTnPln8C
lzHpXCK95hDmHsgOBmTnqbbAZOjLDSydj4FaInLHBRK02cUZhskfFSFtuyUJ+2ee
+4v/KbUQauqhJtQpj8aB9ERL/REafEqsxbEx6pBIBiHAtYFTksDumdMB8JWf7IwU
DcDpOXZIYL9OkdjQNxZsRY9dmAf5J14DMhrEkPjwrcoqj2OGgaCVmUsZ7JE/dplT
VwoUY8Nw9GlHgIDytG1/ddQv2pnvy91yl+MqeZzPID4aMjAreeZz4ESmGhuKdkNN
0epd2nXVTZMi6JdUcRqJYhePEtnS8psEmaty+ofbEMdJ8dQX12bvcmPLzQkduN3+
HsorF1V3PXaba/X1V6FHwu5UIxaHYqS37+RYMnZuvECJdJl8w6o1HrQSB9O+9ih8
xkYncnuY+9xSksCpbPnQ+CFiv1PF4d+eH8MSN3AnHFGpFUujJRV8BR0QzhFPilDV
Wi6FY+546Ow=
=Ziq6
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Login or Register to add favorites

File Archive:

June 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    0 Files
  • 2
    Jun 2nd
    0 Files
  • 3
    Jun 3rd
    18 Files
  • 4
    Jun 4th
    21 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    57 Files
  • 7
    Jun 7th
    6 Files
  • 8
    Jun 8th
    0 Files
  • 9
    Jun 9th
    0 Files
  • 10
    Jun 10th
    12 Files
  • 11
    Jun 11th
    27 Files
  • 12
    Jun 12th
    38 Files
  • 13
    Jun 13th
    16 Files
  • 14
    Jun 14th
    14 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    16 Files
  • 18
    Jun 18th
    26 Files
  • 19
    Jun 19th
    15 Files
  • 20
    Jun 20th
    18 Files
  • 21
    Jun 21st
    8 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close