-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: OpenShift Logging bug fix and security update
 (5.1.9)
Advisory ID:       RHSA-2022:0727-01
Product:           Red Hat OpenShift Enterprise
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:0727
Issue date:        2022-03-01
CVE Names:         CVE-2020-28491 CVE-2022-0552 
=====================================================================

1. Summary:

OpenShift Logging bug fix and security update (5.1.9)

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

OpenShift Logging bug fix and security update (5.1.9)

Security Fix(es):

* jackson-dataformat-cbor:  Unchecked allocation of byte buffer can cause a
java.lang.OutOfMemoryError exception (CVE-2020-28491)

* origin-aggregated-logging/elasticsearch: Incomplete fix for
netty-codec-http CVE-2021-21409 (CVE-2022-0552)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

For OpenShift Container Platform 4.8 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this errata update:

https://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html

For Red Hat OpenShift Logging 5.1, see the following instructions to apply
this update:

https://docs.openshift.com/container-platform/4.8/logging/cluster-logging-upgrading.html

4. Bugs fixed (https://bugzilla.redhat.com/):

1930423 - CVE-2020-28491 jackson-dataformat-cbor:  Unchecked allocation of byte
 buffer can cause a java.lang.OutOfMemoryError exception
2052539 - CVE-2022-0552 origin-aggregated-logging/elasticsearch: Incomplete fix
 for netty-codec-http CVE-2021-21409

5. JIRA issues fixed (https://issues.jboss.org/):

LOG-2181 - Logging link is not removed when CLO is uninstalled or its instance
 is removed

6. References:

https://access.redhat.com/security/cve/CVE-2020-28491
https://access.redhat.com/security/cve/CVE-2022-0552
https://access.redhat.com/security/updates/classification/#moderate

7. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYh6altzjgjWX9erEAQjRPg//WbHeVQWkkSJt0czQiJI8BFyLoUagVw9k
paxGAnWrxKiwDCvhVqdjXMqnFH/7ToUO3cWPI4P9Bhw0XVp+yVZc6SWR1yvJq9zn
6kg8121gIhmvwZdUIOoOPOIx7rUB156zTr7Pl0G6bMDxsI9E3UwxSzKsA95OeK4A
H5VQ1NZ0E6azAqtJ6DxGcyhil/ySO8AumpSo3CqZ2DSMAp5qjTXm10llpWaCn7wh
xjteiyDYLklxNuJcdzFugYcdBjKEJQ9gf0LjsJ4ezyBv5aFuj8XOTdndP/5irMgf
MP5F+eYhVk0CJzjFFVpWsCk2mOAJFW4kVs5DZP+vkxJG8ZOdMpkghDmLsggWUCFz
dGHDxhO47S8Bv0WZOPqrTFfEdUUfanECpJ8gS0iclaUCxLtckLmqAoEN+98vQXqu
uxpSku+TWAO830yjhOz+gHTq9VzkVIu9LrJ6BnP+xVaA6/HYLdelVVmN9E5g6alB
ALwnec6+onMRE5YEGl9b+HgSf/OhBMEMmI6Kz7OoQFi2c2OJjJRw6JKVKKqBZXg6
y1sfu5S5AFgiJdTiOn5TR6ruHSeyNyYa8FeXK323QJgJj2ErRLrarEPksPT1Ps7k
Xv1L0YAicN4zwk1uo2A5naWeRJFmrXDyajm5u+DE8/nW7mnG24Cx4CRuN8N1wFJF
PdgA4tAMu2o=
=XHw6
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce