RedHat: RHSA-2022-6344:01 Moderate: Logging Subsystem 5.5.1 Securit...

Advisories

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: Logging Subsystem 5.5.1 Security and Bug Fix Update
Advisory ID:       RHSA-2022:6344-01
Product:           RHOL
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:6344
Issue date:        2022-09-06
CVE Names:         CVE-2022-1705 CVE-2022-2526 CVE-2022-29154 
                   CVE-2022-30631 CVE-2022-32148 CVE-2022-32206 
                   CVE-2022-32208 
=====================================================================

1. Summary:

Logging Subsystem 5.5.1 - Red Hat OpenShift

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Logging Subsystem 5.5.1 - Red Hat OpenShift

Security Fix(es):

* golang: net/https: improper sanitization of Transfer-Encoding header
(CVE-2022-1705)

* golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

* golang: net/http/httputil: NewSingleHostReverseProxy - omit
X-Forwarded-For not working (CVE-2022-32148)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

For OpenShift Container Platform 4.11 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this errata update:

https://docs.openshift.com/container-platform/4.11/release_notes/ocp-4-11-release-notes.html

For Red Hat OpenShift Logging 5.5, see the following instructions to apply
this update:

https://docs.openshift.com/container-platform/4.11/logging/cluster-logging-upgrading.html

4. Bugs fixed (https://bugzilla.redhat.com/):

2107342 - CVE-2022-30631 golang: compress/gzip: stack exhaustion in Reader.Read
2107374 - CVE-2022-1705 golang: net/https: improper sanitization of Transfer-Encoding header
2107383 - CVE-2022-32148 golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working

5. JIRA issues fixed (https://issues.jboss.org/):

LOG-2647 - Add link to log console from pod views
LOG-2801 - After upgrade all logs are stored in app indices
LOG-2917 - Changing refresh interval throws error when the 'Query' field is empty

6. References:

https://access.redhat.com/security/cve/CVE-2022-1705
https://access.redhat.com/security/cve/CVE-2022-2526
https://access.redhat.com/security/cve/CVE-2022-29154
https://access.redhat.com/security/cve/CVE-2022-30631
https://access.redhat.com/security/cve/CVE-2022-32148
https://access.redhat.com/security/cve/CVE-2022-32206
https://access.redhat.com/security/cve/CVE-2022-32208
https://access.redhat.com/security/updates/classification/#moderate
null

7. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYxfJZ9zjgjWX9erEAQhOWw//TnQkU21eDM3HZ1Zf/81opIdO5ogEJTth
Q8EsV91z5LJBID9fhOJurU7Vjy0SPpoagYC8xGlgq8jsiL18iYur8fI8HGQmgot0
YPSQe2FNXlU0Z63dxrtIIPz30JyRHxzM907it2+WsnyXCHtcWso5tLNTX2RVT9xI
hVRrlTIafPCfx9XdzeVd0WloQan4aWGY+AhFQVNS1Tqoow3cvN/hMrZ1IlyN86be
zAfaRhBZp6XOZ6kzuqrKvhCEMy/bNdgR2yi5f4BK6HLZ9geJKLIwsvOoy31EBg7A
k5ncvyJ4ZcyCfw1Zhub5ajDajoGf8g9NLpkjdihRTa46/Ueae7tiOshA/Rqv5T7k
LsbMTeLEOQcAhWchE+SX1GkwhfgDtswWFTF4c03a2VX8ZgkwaibJSwFgFU4Ut/t2
a2zUiPj6xxufZwTvjItXmYsSDvxyyCnF762iQJEAeyQIxws3w5Z8NQW79ibzXGso
0A3aRYOwJU2aYefdIfw3GW0U08RNSzLx+NU4Ue129CWmTqfNLLAw9HoAWHcWVmqh
3PUUWuciXiZ0HYfw8gRSa8fHH74OvjwvDZP5un1AGtTeTs1tILDxaH1gwxacM7Zj
oxtXQ7APttwct9PePyDzQGBKD1KlxkZGfY/CrWwIQH0YWdY9TYNrqorZ2DBWwG4Y
qlVCuKI/hvc=
=0W5U
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2022-6344:01 Moderate: Logging Subsystem 5.5.1 Security and

Logging Subsystem 5.5.1 - Red Hat OpenShift Red Hat Product Security has rated this update as having a security impact of Moderate

Summary

Logging Subsystem 5.5.1 - Red Hat OpenShift
Security Fix(es):
* golang: net/https: improper sanitization of Transfer-Encoding header (CVE-2022-1705)
* golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
* golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For OpenShift Container Platform 4.11 see the following documentation,which will be updated shortly for this release, for important instructionson how to upgrade your cluster and fully apply this errata update:https://docs.openshift.com/container-platform/4.11/release_notes/ocp-4-11-release-notes.htmlFor Red Hat OpenShift Logging 5.5, see the following instructions to applythis update:https://docs.openshift.com/container-platform/4.11/logging/cluster-logging-upgrading.html

References

https://access.redhat.com/security/cve/CVE-2022-1705 https://access.redhat.com/security/cve/CVE-2022-2526 https://access.redhat.com/security/cve/CVE-2022-29154 https://access.redhat.com/security/cve/CVE-2022-30631 https://access.redhat.com/security/cve/CVE-2022-32148 https://access.redhat.com/security/cve/CVE-2022-32206 https://access.redhat.com/security/cve/CVE-2022-32208 https://access.redhat.com/security/updates/classification/#moderate null

Package List

Severity
Advisory ID: RHSA-2022:6344-01
Product: RHOL
Advisory URL: https://access.redhat.com/errata/RHSA-2022:6344
Issued Date: : 2022-09-06
CVE Names: CVE-2022-1705 CVE-2022-2526 CVE-2022-29154 CVE-2022-30631 CVE-2022-32148 CVE-2022-32206 CVE-2022-32208

Topic

Logging Subsystem 5.5.1 - Red Hat OpenShiftRed Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Relevant Releases Architectures

Bugs Fixed

2107342 - CVE-2022-30631 golang: compress/gzip: stack exhaustion in Reader.Read

2107374 - CVE-2022-1705 golang: net/https: improper sanitization of Transfer-Encoding header

2107383 - CVE-2022-32148 golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working

5. JIRA issues fixed (https://issues.jboss.org/):

LOG-2647 - Add link to log console from pod views

LOG-2801 - After upgrade all logs are stored in app indices

LOG-2917 - Changing refresh interval throws error when the 'Query' field is empty

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.