RedHat: RHSA-2022-6183:01 Moderate: Logging Subsystem 5.4.5 Securit...

Advisories

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: Logging Subsystem 5.4.5 Security and Bug Fix Update
Advisory ID:       RHSA-2022:6183-01
Product:           RHOL
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:6183
Issue date:        2022-09-06
CVE Names:         CVE-2022-1292 CVE-2022-1586 CVE-2022-1705 
                   CVE-2022-1785 CVE-2022-1897 CVE-2022-1927 
                   CVE-2022-2068 CVE-2022-2097 CVE-2022-2526 
                   CVE-2022-29154 CVE-2022-30631 CVE-2022-32148 
                   CVE-2022-32206 CVE-2022-32208 
=====================================================================

1. Summary:

Logging Subsystem 5.4.5 - Red Hat OpenShift

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Logging Subsystem 5.4.5 - Red Hat OpenShift

Security Fix(es):

* golang: net/https: improper sanitization of Transfer-Encoding header
(CVE-2022-1705)

* golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

* golang: net/http/httputil: NewSingleHostReverseProxy - omit
X-Forwarded-For not working (CVE-2022-32148)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

For OpenShift Container Platform 4.10 see the following documentation,
which will be updated shortly, for detailed release notes:

https://docs.openshift.com/container-platform/4.10/logging/cluster-logging-release-notes.html

For Red Hat OpenShift Logging 5.4, see the following instructions to apply
this update:

https://docs.openshift.com/container-platform/4.10/logging/cluster-logging-upgrading.html

4. Bugs fixed (https://bugzilla.redhat.com/):

2107342 - CVE-2022-30631 golang: compress/gzip: stack exhaustion in Reader.Read
2107374 - CVE-2022-1705 golang: net/https: improper sanitization of Transfer-Encoding header
2107383 - CVE-2022-32148 golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working

5. JIRA issues fixed (https://issues.jboss.org/):

LOG-2946 - After upgrade all logs are stored in app indices
LOG-2963 - OpenSearch can no longer be used as an Elasticsearch output for forwarding
LOG-2972 - ElasticsearchError error="400 - Rejected by Elasticsearch" when adding some labels in application namespaces 
LOG-3009 - Elasticsearch operator repeatedly prints error message when checking indices

6. References:

https://access.redhat.com/security/cve/CVE-2022-1292
https://access.redhat.com/security/cve/CVE-2022-1586
https://access.redhat.com/security/cve/CVE-2022-1705
https://access.redhat.com/security/cve/CVE-2022-1785
https://access.redhat.com/security/cve/CVE-2022-1897
https://access.redhat.com/security/cve/CVE-2022-1927
https://access.redhat.com/security/cve/CVE-2022-2068
https://access.redhat.com/security/cve/CVE-2022-2097
https://access.redhat.com/security/cve/CVE-2022-2526
https://access.redhat.com/security/cve/CVE-2022-29154
https://access.redhat.com/security/cve/CVE-2022-30631
https://access.redhat.com/security/cve/CVE-2022-32148
https://access.redhat.com/security/cve/CVE-2022-32206
https://access.redhat.com/security/cve/CVE-2022-32208
https://access.redhat.com/security/updates/classification/#moderate
null

7. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYxd1QdzjgjWX9erEAQhsxw//diDp4a2B1BVl24Y0uptpG5iQSwUjGlWZ
FAz8lSK01xYx9/pJfEouH5NtcIshpXU1KKn71qPPjMRRav+wr+dwfWISsUWI3rL+
DmW4Q3ncCWtN2jI1swlRRrKVKGAJHLsyPcYzxsuL841LrdMeVSsuHLxeL0wJ3NcA
hz5C7DphgBIfZv87A1C58wbQEBxBuiIXAeGG8Q2zEHVRq7AUk0orj6UnXu1zdp3G
BfREsiigIko2XzRp9DcU2wCqAo003pilRWJMaapjLfHajtRhFUANCCXILkmEJtlm
UqDtzpe/ebW//qH91mzy/zoPBmNxo2qM+vPpiCJqlEQA7D2iO/7VCDPVoQUT2qoi
0R55N/WkUveYwaRYJieFRcEiSzQgg9zOiRM+szxf75T6KpkJC7i2uVEI5GTMPN6j
t3hplpEjFA9r3d5vFq9iG+w/nIp+JTTgMAPwzGx/YT0x/FpY+jIuF4NwVja73AeB
LxP5T8YllQhwMiOgfzJxjgBIvh5rCBXN74jgO1VDGmX6kTKCRt2CqX4uxs7S2sT4
5hNBZRIvbRT95Uwz1WTuBwjQwxODEqtov8MbtleELrFU/92XWITTpO7PD9QDBSAh
hO3TBPVOh67yh/Y0BPb/uJ/Bsfp4Sl2fAfBrX07mtPGkpaUX6CkVMkooLRwRvsyD
6lBvgYMODTo=
=hqRi
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2022-6183:01 Moderate: Logging Subsystem 5.4.5 Security and

Logging Subsystem 5.4.5 - Red Hat OpenShift Red Hat Product Security has rated this update as having a security impact of Moderate

Summary

Logging Subsystem 5.4.5 - Red Hat OpenShift
Security Fix(es):
* golang: net/https: improper sanitization of Transfer-Encoding header (CVE-2022-1705)
* golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
* golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For OpenShift Container Platform 4.10 see the following documentation,which will be updated shortly, for detailed release notes:https://docs.openshift.com/container-platform/4.10/logging/cluster-logging-release-notes.htmlFor Red Hat OpenShift Logging 5.4, see the following instructions to applythis update:https://docs.openshift.com/container-platform/4.10/logging/cluster-logging-upgrading.html

References

https://access.redhat.com/security/cve/CVE-2022-1292 https://access.redhat.com/security/cve/CVE-2022-1586 https://access.redhat.com/security/cve/CVE-2022-1705 https://access.redhat.com/security/cve/CVE-2022-1785 https://access.redhat.com/security/cve/CVE-2022-1897 https://access.redhat.com/security/cve/CVE-2022-1927 https://access.redhat.com/security/cve/CVE-2022-2068 https://access.redhat.com/security/cve/CVE-2022-2097 https://access.redhat.com/security/cve/CVE-2022-2526 https://access.redhat.com/security/cve/CVE-2022-29154 https://access.redhat.com/security/cve/CVE-2022-30631 https://access.redhat.com/security/cve/CVE-2022-32148 https://access.redhat.com/security/cve/CVE-2022-32206 https://access.redhat.com/security/cve/CVE-2022-32208 https://access.redhat.com/security/updates/classification/#moderate null

Package List

Severity
Advisory ID: RHSA-2022:6183-01
Product: RHOL
Advisory URL: https://access.redhat.com/errata/RHSA-2022:6183
Issued Date: : 2022-09-06
CVE Names: CVE-2022-1292 CVE-2022-1586 CVE-2022-1705 CVE-2022-1785 CVE-2022-1897 CVE-2022-1927 CVE-2022-2068 CVE-2022-2097 CVE-2022-2526 CVE-2022-29154 CVE-2022-30631 CVE-2022-32148 CVE-2022-32206 CVE-2022-32208

Topic

Logging Subsystem 5.4.5 - Red Hat OpenShiftRed Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Relevant Releases Architectures

Bugs Fixed

2107342 - CVE-2022-30631 golang: compress/gzip: stack exhaustion in Reader.Read

2107374 - CVE-2022-1705 golang: net/https: improper sanitization of Transfer-Encoding header

2107383 - CVE-2022-32148 golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working

5. JIRA issues fixed (https://issues.jboss.org/):

LOG-2946 - After upgrade all logs are stored in app indices

LOG-2963 - OpenSearch can no longer be used as an Elasticsearch output for forwarding

LOG-2972 - ElasticsearchError error="400 - Rejected by Elasticsearch" when adding some labels in application namespaces

LOG-3009 - Elasticsearch operator repeatedly prints error message when checking indices

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.