-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Openshift Logging 5.3.13 security and bug fix release Advisory ID: RHSA-2022:6882-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2022:6882 Issue date: 2022-11-09 CVE Names: CVE-2020-35525 CVE-2020-35527 CVE-2022-0494 CVE-2022-1353 CVE-2022-2509 CVE-2022-2588 CVE-2022-3515 CVE-2022-21618 CVE-2022-21619 CVE-2022-21624 CVE-2022-21626 CVE-2022-21628 CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901 CVE-2022-32149 CVE-2022-37434 CVE-2022-39399 CVE-2022-40674 ==================================================================== 1. Summary: An update is now available for OpenShift Logging 5.3. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Openshift Logging 5.3.13 security and bug fix release Security Fix(es): * golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags (CVE-2022-32149) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly, for detailed release notes: https://docs.openshift.com/container-platform/4.9/logging/cluster-logging-release-notes.html For Red Hat OpenShift Logging 5.3, see the following instructions to apply this update: https://docs.openshift.com/container-platform/4.9/logging/cluster-logging-upgrading.html 4. Bugs fixed (https://bugzilla.redhat.com/): 2134010 - CVE-2022-32149 golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags 5. References: https://access.redhat.com/security/cve/CVE-2020-35525 https://access.redhat.com/security/cve/CVE-2020-35527 https://access.redhat.com/security/cve/CVE-2022-0494 https://access.redhat.com/security/cve/CVE-2022-1353 https://access.redhat.com/security/cve/CVE-2022-2509 https://access.redhat.com/security/cve/CVE-2022-2588 https://access.redhat.com/security/cve/CVE-2022-3515 https://access.redhat.com/security/cve/CVE-2022-21618 https://access.redhat.com/security/cve/CVE-2022-21619 https://access.redhat.com/security/cve/CVE-2022-21624 https://access.redhat.com/security/cve/CVE-2022-21626 https://access.redhat.com/security/cve/CVE-2022-21628 https://access.redhat.com/security/cve/CVE-2022-23816 https://access.redhat.com/security/cve/CVE-2022-23825 https://access.redhat.com/security/cve/CVE-2022-29900 https://access.redhat.com/security/cve/CVE-2022-29901 https://access.redhat.com/security/cve/CVE-2022-32149 https://access.redhat.com/security/cve/CVE-2022-37434 https://access.redhat.com/security/cve/CVE-2022-39399 https://access.redhat.com/security/cve/CVE-2022-40674 https://access.redhat.com/security/updates/classification/#moderate 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBY2v3pdzjgjWX9erEAQieXA//RS5LPNCMBmQuk2BFdWb8ac7zWMDMh6ia qMmQdkJurPEKzihaFAHCTv8cAjQhydghH48dATJobRXe545sGP2BpLOUrlQj52/u tY80fOTre7ocZqtQPznax7CFeigk3f959PjWzjPztSznxblj/2i52DrPFNg9uvj+ 5BI/kp+tztKTXLFmjUXC+SilR5Q1KLNsEhscIJ6frqz3wIB4acVj2YMNHbFLC3Zu aTH64AFFvfac1IhBFtD51KgS+0p6ReAetCt3KssdEFgv+ajLwvnitzfrBOCnp4y7 rvc/AdhKeQDWYvvFPsjYdD8qRHplMMBSDolshDLq4/Qhxwha80wTJ4282NTpZilY 8zdweut+1H+Wg8o6RYKmoWPbuncdhk3JVoqNFmmYsOdFRyH2Dezeqpe1P3eiT4vY iM8zOfJM8XyCSis3rm1A9hUed2yBl7A1mNMVRke24xmayBfe5cVUHdguKhUQTDyh 4lVvkFY91S6izDLyiVTU5QoPmMHSef6w+uRkumOHDuGCxFctlmBMFHzBiUTYdkmk moPMpZWf4YKzFSMLZuC562uQ2Y7lP/GBkPuVxa0aa04PMXdMb0fLuYyaUzsks8kW r37lN9gtMLVrLaX5tTa4UyHjWy2P2kkH+8ZeHs7RqrDHawISEGoo0NsD8D4LG7FC 2eYvDFN/BO4=lzPS -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce