Headline
RHSA-2022:0044: Red Hat Security Advisory: Red Hat OpenShift Enterprise Logging bug fix and security update (5.3.2)
An update is now available for OpenShift Logging (5.3.2) Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
Related CVEs:
- CVE-2020-36327: rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source
- CVE-2021-45105: log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern
Skip to navigation Skip to main content
Utilities
- Subscriptions
- Downloads
- Containers
- Support Cases
Infrastructure and Management
- Red Hat Enterprise Linux
- Red Hat Virtualization
- Red Hat Identity Management
- Red Hat Directory Server
- Red Hat Certificate System
- Red Hat Satellite
- Red Hat Subscription Management
- Red Hat Update Infrastructure
- Red Hat Insights
- Red Hat Ansible Automation Platform
Cloud Computing
- Red Hat OpenShift
- Red Hat CloudForms
- Red Hat OpenStack Platform
- Red Hat OpenShift Container Platform
- Red Hat OpenShift Data Science
- Red Hat OpenShift Online
- Red Hat OpenShift Dedicated
- Red Hat Advanced Cluster Security for Kubernetes
- Red Hat Advanced Cluster Management for Kubernetes
- Red Hat Quay
- Red Hat CodeReady Workspaces
- Red Hat OpenShift Service on AWS
Storage
- Red Hat Gluster Storage
- Red Hat Hyperconverged Infrastructure
- Red Hat Ceph Storage
- Red Hat OpenShift Data Foundation
Runtimes
- Red Hat Runtimes
- Red Hat JBoss Enterprise Application Platform
- Red Hat Data Grid
- Red Hat JBoss Web Server
- Red Hat Single Sign On
- Red Hat support for Spring Boot
- Red Hat build of Node.js
- Red Hat build of Thorntail
- Red Hat build of Eclipse Vert.x
- Red Hat build of OpenJDK
- Red Hat build of Quarkus
- Red Hat CodeReady Studio
Integration and Automation
- Red Hat Process Automation
- Red Hat Process Automation Manager
- Red Hat Decision Manager
All Products
Issued:
2022-01-10
Updated:
2022-01-10
RHSA-2022:0044 - Security Advisory
- Overview
- Updated Packages
Synopsis
Important: Red Hat OpenShift Enterprise Logging bug fix and security update (5.3.2)
Type/Severity
Security Advisory: Important
Topic
An update is now available for OpenShift Logging (5.3.2)
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Description
OpenShift Logging Bug Fix Release (5.3.2)
Security Fix(es):
- rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source (CVE-2020-36327)
- log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern (CVE-2021-45105)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Products
- Red Hat OpenShift Container Platform 4.8 for RHEL 8 x86_64
Fixes
- BZ - 1958999 - CVE-2020-36327 rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source
- BZ - 2034067 - CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern
- LOG-2074 - The elasticsearch-im-xxx job failed when trying to start index management process for a non-existent(empty-named) index [openshift-logging-5.3]
- LOG-2051 - [release-5.3] Log collected dashboard displays wrong namespace
- LOG-2046 - [release-5.3] Wrong certificates used by fluentd when log forwarding to external Elasticsearch and defined structuredTypeKey
- LOG-1975 - [release-5.3] After Upgrading to Cluster logging 5.3.0-55 receiving alerts Target Down `cluster-logging-operator`
- LOG-2088 - resourceVersion is overflowing type Integer causing ES rejection [openshift-logging 5.3]
- LOG-2110 - [release-5.3] EO Self-generated certificates issue with Kibana when “logging.openshift.io/elasticsearch-cert-management: true” annotation is used
CVEs
- CVE-2020-36327
- CVE-2021-3712
- CVE-2021-20321
- CVE-2021-42574
- CVE-2021-45105
Red Hat OpenShift Container Platform 4.8 for RHEL 8
SRPM
x86_64
The Red Hat security contact is [email protected]. More contact details at https://access.redhat.com/security/team/contact/.