Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 5 articles for you...
89
security advisoryfedoraupdateFedora 44 log4cxx 1.7.0 Update Bug Fixes and Enhancements
Update to log4cxx 1.7.0. New features: fallback-ref appender attribute, Qt CMake find_package component, TelnetAppender NonBlocking option. Bug fixes: non-ASCII JSON encoding, invalid XML 1.0 characters in XML output, crash on recursive XML config references, possible UB during. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-43767b6007 2026-07-12 01:10:38.798594+00:00 -------------------------------------------------------------------------------- Name : log4cxx Product : Fedora 44 Version : 1.7.0 Release : 2.fc44 URL : http://logging.apache.org/log4cxx/index.html Summary : A port to C++ of the Log4j project Description : Log4cxx is a popular logging package written in C++. One of its distinctive features is the notion of inheritance in loggers. Using a logger hierarchy it is possible to control which log statements are output at arbitrary granularity. This helps reduce the volume of logged output and minimize the cost of logging. -------------------------------------------------------------------------------- Update Information: Update to log4cxx 1.7.0. New features: fallback-ref appender attribute, Qt CMake find_package component, TelnetAppender NonBlocking option. Bug fixes: non-ASCII JSON encoding, invalid XML 1.0 characters in XML output, crash on recursive XML config references, possible UB during configuration changes, message loss during recursive logging, ODBCAppender prepared-statement buffer lifetimes. No ABI-relevant changes; liblog4cxx SONAME (%{sover}) is unchanged. -------------------------------------------------------------------------------- ChangeLog: * Fri Jul 3 2026 Till Hofmann - 1.7.0-2 - Skip 2GB-message test on 32-bit architectures * Fri Jul 3 2026 Till Hofmann - 1.7.0-1 - Update to 1.7.0 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2455029 - log4cxx-1.7.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2455029 [ 2 ] Bug #2457923 - CVE-2026-40023 log4cxx: Apache Log4cxx: Log processing impairment due to unsanitized XML characters [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2457923 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-43767b6007' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Jul 11, 2026
Fedora
197
security advisorydebianremote accessUbuntu 20.04: Django Security Patch DLA-3341-2 CVE-2024-12345
Multiple security issues were discovered in the Rails web framework which could result in command injection or logging of unescaped ANSI sequences. For Debian 11 bullseye, these problems have been fixed in version 2:6.0.3.7+dfsg-2+deb11u4.. Debian LTS Advisory DLA-4416-1
Dec 26, 2025
•Critical
Debian LTS
172
security advisoryimportantubuntuUbuntu 25.04 USN-7555-2 important: python-django log injection
Django could be made to log injection if received specially crafted input.. ========================================================================== Ubuntu Security Notice USN-7555-2 June 16, 2025 python-django vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.04 - Ubuntu 24.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS Summary: Django could be made to log injection if received specially crafted input. Software Description: - python-django: High-level Python web development framework Details: USN-7555-1 fixed vulnerabilities in Django. The fix was incomplete. This update applies an additional patch to fix it properly. Original advisory details: It was discovered that Django incorrectly handled certain unescaped request paths. An attacker could possibly use this issue to perform a log injection. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 25.04 python3-django 3:4.2.18-1ubuntu1.3 Ubuntu 24.10 python3-django 3:4.2.15-1ubuntu1.6 Ubuntu 24.04 LTS python3-django 3:4.2.11-1ubuntu1.9 Ubuntu 22.04 LTS python3-django 2:3.2.12-2ubuntu1.20 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7555-2 https://ubuntu.com/security/notices/USN-7555-1 https://bugs.launchpad.net/ubuntu/+source/python-django/+bug/2113924 Package Information: https://launchpad.net/ubuntu/+source/python-django/3:4.2.18-1ubuntu1.3 https://launchpad.net/ubuntu/+source/python-django/3:4.2.15-1ubuntu1.6 https://launchpad.net/ubuntu/+source/python-django/3:4.2.11-1ubuntu1.9 https://launchpad.net/ubuntu/+source/python-django/2:3.2.12-2ubuntu1.20 . Addressing the log injection vulnerability in Django on Ubuntu: urgent measures required for robust web security. Upgrade immediately!.python-django, log injection, ubuntu security. . Severity: Important. LinuxSecurity.com Team
Jun 16, 2025
•Important
Ubuntu
172
security advisoryweb applicationinput validationUbuntu 25.04-20.04 LTS: USN-7555-1 moderate: Django log injection
Django could be made to log injection if received specially crafted input.. ========================================================================== Ubuntu Security Notice USN-7555-1 June 04, 2025 python-django vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.04 - Ubuntu 24.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS Summary: Django could be made to log injection if received specially crafted input. Software Description: - python-django: High-level Python web development framework Details: It was discovered that Django incorrectly handled certain unescaped request paths. An attacker could possibly use this issue to perform a log injection. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 25.04 python3-django 3:4.2.18-1ubuntu1.2 Ubuntu 24.10 python3-django 3:4.2.15-1ubuntu1.5 Ubuntu 24.04 LTS python3-django 3:4.2.11-1ubuntu1.8 Ubuntu 22.04 LTS python3-django 2:3.2.12-2ubuntu1.19 Ubuntu 20.04 LTS python3-django 2:2.2.12-1ubuntu0.29+esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7555-1 CVE-2025-48432 Package Information: https://launchpad.net/ubuntu/+source/python-django/3:4.2.18-1ubuntu1.2 https://launchpad.net/ubuntu/+source/python-django/3:4.2.15-1ubuntu1.5 https://launchpad.net/ubuntu/+source/python-django/3:4.2.11-1ubuntu1.8 https://launchpad.net/ubuntu/+source/python-django/2:3.2.12-2ubuntu1.19 . A Django logging vulnerability impacts several Ubuntu distributions. Upgrade your installation to mitigate risks of log exploitation.. python django, log injection, Ubuntu update, web framework, security notice. . Severity: Important.LinuxSecurity.com Team
Jun 04, 2025
•Important
Ubuntu
98
security advisorymoderatedenial of serviceRed Hat OpenShift 5.3.14 RHSA-2022-8889-01 Moderate: Logging Issues
Openshift Logging Bug Fix Release (5.3.14) Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Openshift Logging 5.3.14 bug fix release and security update Advisory ID: RHSA-2022:8889-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2022:8889 Issue date: 2022-12-08 CVE Names: CVE-2016-3709 CVE-2020-35525 CVE-2020-35527 CVE-2020-36516 CVE-2020-36518 CVE-2020-36558 CVE-2021-3640 CVE-2021-30002 CVE-2022-0168 CVE-2022-0561 CVE-2022-0562 CVE-2022-0617 CVE-2022-0854 CVE-2022-0865 CVE-2022-0891 CVE-2022-0908 CVE-2022-0909 CVE-2022-0924 CVE-2022-1016 CVE-2022-1048 CVE-2022-1055 CVE-2022-1184 CVE-2022-1292 CVE-2022-1304 CVE-2022-1355 CVE-2022-1586 CVE-2022-1785 CVE-2022-1852 CVE-2022-1897 CVE-2022-1927 CVE-2022-2068 CVE-2022-2078 CVE-2022-2097 CVE-2022-2509 CVE-2022-2586 CVE-2022-2639 CVE-2022-2938 CVE-2022-3515 CVE-2022-20368 CVE-2022-21499 CVE-2022-21618 CVE-2022-21619 CVE-2022-21624 CVE-2022-21626 CVE-2022-21628 CVE-2022-22624 CVE-2022-22628 CVE-2022-22629 CVE-2022-22662 CVE-2022-22844 CVE-2022-23960 CVE-2022-24448 CVE-2022-25255 CVE-2022-26373 CVE-2022-26700 CVE-2022-26709 CVE-2022-26710 CVE-2022-26716 CVE-2022-26717 CVE-2022-26719 CVE-2022-27404 CVE-2022-27405 CVE-2022-27406 CVE-2022-27950 CVE-2022-28390 CVE-2022-28893 CVE-2022-29581 CVE-2022-30293 CVE-2022-34903 CVE-2022-36946 CVE-2022-37434 CVE-2022-39399 CVE-2022-42003 CVE-2022-42004 CVE-2022-42898 ==================================================================== 1. Summary: Openshift Logging Bug Fix Release (5.3.14) Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Openshift Logging Bug Fix Release (5.3.14) Security Fixe(s): * jackson-databind: denial of service via a large depth of nested objects (CVE-2020-36518) * jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003) * jackson-databind: use of deeply nested arrays (CVE-2022-42004) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly, for detailed release notes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.9/html/logging/release-notes For Red Hat OpenShift Logging 5.3, see the following instructions to apply this update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.9/html/logging/cluster-logging-upgrading 4. Bugs fixed (https://bugzilla.redhat.com/): 2064698 - CVE-2020-36518 jackson-databind: denial of service via a large depth of nested objects 2135244 - CVE-2022-42003 jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS 2135247 - CVE-2022-42004 jackson-databind: use of deeply nested arrays 5. JIRA issues fixed ( LOG-3293 - log-file-metric-exporter container has not limits exhausting theresources of the node 6.References: https://access.redhat.com/security/cve/CVE-2016-3709 https://access.redhat.com/security/cve/CVE-2020-35525 https://access.redhat.com/security/cve/CVE-2020-35527 https://access.redhat.com/security/cve/CVE-2020-36516 https://access.redhat.com/security/cve/CVE-2020-36518 https://access.redhat.com/security/cve/CVE-2020-36558 https://access.redhat.com/security/cve/CVE-2021-3640 https://access.redhat.com/security/cve/CVE-2021-30002 https://access.redhat.com/security/cve/CVE-2022-0168 https://access.redhat.com/security/cve/CVE-2022-0561 https://access.redhat.com/security/cve/CVE-2022-0562 https://access.redhat.com/security/cve/CVE-2022-0617 https://access.redhat.com/security/cve/CVE-2022-0854 https://access.redhat.com/security/cve/CVE-2022-0865 https://access.redhat.com/security/cve/CVE-2022-0891 https://access.redhat.com/security/cve/CVE-2022-0908 https://access.redhat.com/security/cve/CVE-2022-0909 https://access.redhat.com/security/cve/CVE-2022-0924 https://access.redhat.com/security/cve/CVE-2022-1016 https://access.redhat.com/security/cve/CVE-2022-1048 https://access.redhat.com/security/cve/CVE-2022-1055 https://access.redhat.com/security/cve/CVE-2022-1184 https://access.redhat.com/security/cve/CVE-2022-1292 https://access.redhat.com/security/cve/CVE-2022-1304 https://access.redhat.com/security/cve/CVE-2022-1355 https://access.redhat.com/security/cve/CVE-2022-1586 https://access.redhat.com/security/cve/CVE-2022-1785 https://access.redhat.com/security/cve/CVE-2022-1852 https://access.redhat.com/security/cve/CVE-2022-1897 https://access.redhat.com/security/cve/CVE-2022-1927 https://access.redhat.com/security/cve/CVE-2022-2068 https://access.redhat.com/security/cve/CVE-2022-2078 https://access.redhat.com/security/cve/CVE-2022-2097 https://access.redhat.com/security/cve/CVE-2022-2509 https://access.redhat.com/security/cve/CVE-2022-2586 https://access.redhat.com/security/cve/CVE-2022-2639 https://access.redhat.com/security/cve/CVE-2022-2938 https://access.redhat.com/security/cve/CVE-2022-3515 https://access.redhat.com/security/cve/CVE-2022-20368 https://access.redhat.com/security/cve/CVE-2022-21499 https://access.redhat.com/security/cve/CVE-2022-21618 https://access.redhat.com/security/cve/CVE-2022-21619 https://access.redhat.com/security/cve/CVE-2022-21624 https://access.redhat.com/security/cve/CVE-2022-21626 https://access.redhat.com/security/cve/CVE-2022-21628 https://access.redhat.com/security/cve/CVE-2022-22624 https://access.redhat.com/security/cve/CVE-2022-22628 https://access.redhat.com/security/cve/CVE-2022-22629 https://access.redhat.com/security/cve/CVE-2022-22662 https://access.redhat.com/security/cve/CVE-2022-22844 https://access.redhat.com/security/cve/CVE-2022-23960 https://access.redhat.com/security/cve/CVE-2022-24448 https://access.redhat.com/security/cve/CVE-2022-25255 https://access.redhat.com/security/cve/CVE-2022-26373 https://access.redhat.com/security/cve/CVE-2022-26700 https://access.redhat.com/security/cve/CVE-2022-26709 https://access.redhat.com/security/cve/CVE-2022-26710 https://access.redhat.com/security/cve/CVE-2022-26716 https://access.redhat.com/security/cve/CVE-2022-26717 https://access.redhat.com/security/cve/CVE-2022-26719 https://access.redhat.com/security/cve/CVE-2022-27404 https://access.redhat.com/security/cve/CVE-2022-27405 https://access.redhat.com/security/cve/CVE-2022-27406 https://access.redhat.com/security/cve/CVE-2022-27950 https://access.redhat.com/security/cve/CVE-2022-28390 https://access.redhat.com/security/cve/CVE-2022-28893 https://access.redhat.com/security/cve/CVE-2022-29581 https://access.redhat.com/security/cve/CVE-2022-30293 https://access.redhat.com/security/cve/CVE-2022-34903 https://access.redhat.com/security/cve/CVE-2022-36946 https://access.redhat.com/security/cve/CVE-2022-37434 https://access.redhat.com/security/cve/CVE-2022-39399 https://access.redhat.com/security/cve/CVE-2022-42003 https://access.redhat.com/security/cve/CVE-2022-42004 https://access.redhat.com/security/cve/CVE-2022-42898 https://access.redhat.com/security/updates/classification/#moderate 7. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBY5Jma9zjgjWX9erEAQh83xAAj1mTs7t69xXYjstib3b10ZSQFlaK8ZHu U1CEqRryyTwdLZJUBNnXcFV7S+tGPIthAzg3RCn0Tun45Kj/v296A2AF8DoKPRmu LZUUi6c5K0vFLTG2zbO0Gxy0rOcxwHmq9QLsQii3AylhXH9BOlJC+VeeaLdJXmd3 7Zwg2Y2opzSYPph1yc/9yf24ln6thgSmFU7lsY60EiPN9GGPXTFKnTbWDNrfRCvy LJTOYISYm8miRC3TsQ/Nt31an3uSE5e6x4aVEXM12TvZTRL4GCcxbBWK3VSScbg8 T7C98yEWNEwouXMNoQr9MGxPwgmUZ8WsgmzYMWOdKABPk5wcQPqC9pfLtamI+AOM TZQUy3TfdTxo79Tkhd5QVOnM0WD/3VWtv/OXTcObhacyifzk3kdr5W8D9PqwMp67 4OiyX+bZlZAXKkLuD2IAeNsqP6wafFGPw79IGRSd5ggNRFIj9gJECxxHc+tvQR7F m6zIWSkjacYUfI8KEI8729qGxwGhqPHHcBS2nAm5pnxXt/3/07BkagQl+5cYW8rS 3rTwx93v6U6F1e7H3FzpucrVDNHK406j3qhKBKHHDr12IPL8Q47dJuTFK9LxhKD8 dGEbNbW23wEkGFjh9BKnac10mPx7uBhQBVmfIrpkgBQhUA6lY7+elso2pVt/FLYw ouxkTmp3LIQ=PYNA -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Dec 08, 2022
Red Hat
98
security advisorymoderateRed HatRed Hat OpenShift 5.2.13: RHSA-2022-5909-01 Moderate Logging Bug Fix
Openshift Logging Bug Fix Release (5.2.13) Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Openshift Logging Bug Fix and security update Release (5.2.13) Advisory ID: RHSA-2022:5909-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2022:5909 Issue date: 2022-08-04 CVE Names: CVE-2021-38561 CVE-2021-40528 CVE-2022-1271 CVE-2022-1621 CVE-2022-1629 CVE-2022-21540 CVE-2022-21541 CVE-2022-22576 CVE-2022-25313 CVE-2022-25314 CVE-2022-27774 CVE-2022-27776 CVE-2022-27782 CVE-2022-29824 CVE-2022-34169 ==================================================================== 1. Summary: Openshift Logging Bug Fix Release (5.2.13) Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Openshift Logging Bug Fix Release (5.2.13) Security Fix(es): * golang: out-of-bounds read in golang.org/x/text/language leads to DoS (CVE-2021-38561) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: For OpenShift Container Platform 4.8 see the following documentation, which will be updated shortly, for detailed release notes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.8/html/logging/release-notes For Red HatOpenShift Logging 5.2, see the following instructions to apply this update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.8/html/logging/cluster-logging-upgrading 4. Bugs fixed (https://bugzilla.redhat.com/): 2100495 - CVE-2021-38561 golang: out-of-bounds read in golang.org/x/text/language leads to DoS 5. References: https://access.redhat.com/security/cve/CVE-2021-38561 https://access.redhat.com/security/cve/CVE-2021-40528 https://access.redhat.com/security/cve/CVE-2022-1271 https://access.redhat.com/security/cve/CVE-2022-1621 https://access.redhat.com/security/cve/CVE-2022-1629 https://access.redhat.com/security/cve/CVE-2022-21540 https://access.redhat.com/security/cve/CVE-2022-21541 https://access.redhat.com/security/cve/CVE-2022-22576 https://access.redhat.com/security/cve/CVE-2022-25313 https://access.redhat.com/security/cve/CVE-2022-25314 https://access.redhat.com/security/cve/CVE-2022-27774 https://access.redhat.com/security/cve/CVE-2022-27776 https://access.redhat.com/security/cve/CVE-2022-27782 https://access.redhat.com/security/cve/CVE-2022-29824 https://access.redhat.com/security/cve/CVE-2022-34169 https://access.redhat.com/security/updates/classification#moderate 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBYuwKbdzjgjWX9erEAQge4Q/5AdmLXbzcYNVlB4a3k8ZYk+851l46Xy/G A/jatHrT93JzqaMDPUFMuxVJ+wdVoTrYJVCyNFKQe9bvfmkjZV+ppY0LMnt9BZKF 6GrgIT/tr0EQeF+KTYSjbfVVd/zCC6OEuA0P3ENYQoxVlKOqBUKLP0ag/LgU+OwB QFIdiUUoxYkum6/xc6qfflAowRAY5ZpxNW4z2MkzabaIPJbN316yA+rnM/kt5G4G tx6utcuO83jok1678sDL3XL3j2xM6L2rFwuVRg+kzJObCxjjPOnM2O3Id4le2LkB YgJw8EnjWXqtFwJNJnTDOBKjQrv7yD9GQVCb5QzzrERIwMiD/UUQ7NOpAESy/+zv s3hcdE5atZtZOip//P9LkvIk9tGhMiqkhR9WF1iX8pnnCTGxeyyfzKv67lV89NEC 7LUpuV9tdlGEwnJo7IzwC6d+XHTIc6DFZ7IDv3+YF0olND5PIHlnoQPz3kRStYIJ zoRMzXjBihSEgjqEVdw1bcJyXTGM80fgdsTTm4hGr+MXGT4JgrNAcYasd3AMT25I xaH7Y6XDdDY3k7g/pQVFckVWsrzn9a4QlPJaPAmFHBS4tq6TxC23AEAoVv4J2abg xvyZu27oVZSwie36Y1Pm1VioABBiL9md3zGUCQVHVnSPUwgOu7XUrW56VUEDEs36 Pndy5EfKK9c=quG0 -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Aug 04, 2022
Red Hat
98
security advisorymoderatesecurity updateRed Hat OpenShift 5.3.7 Advisory RHSA-2022-2217 Moderate Security Update
Openshift Logging Bug Fix Release (5.3.7) Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat OpenShift Logging Security and Bug update Release 5.3.7 Advisory ID: RHSA-2022:2217-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2022:2217 Issue date: 2022-05-11 CVE Names: CVE-2018-25032 CVE-2021-4028 CVE-2021-37136 CVE-2021-37137 CVE-2021-43797 CVE-2022-0759 CVE-2022-0778 CVE-2022-1154 CVE-2022-1271 CVE-2022-21426 CVE-2022-21434 CVE-2022-21443 CVE-2022-21476 CVE-2022-21496 CVE-2022-21698 CVE-2022-25636 ==================================================================== 1. Summary: Openshift Logging Bug Fix Release (5.3.7) Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Openshift Logging Bug Fix Release (5.3.7) Security Fix(es): * kubeclient: kubeconfig parsing error can lead to MITM attacks (CVE-2022-0759) * netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data (CVE-2021-37136) * netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way (CVE-2021-37137) * netty: control chars in header names may lead to HTTP request smuggling (CVE-2021-43797) * prometheus/client_golang: Denial of service using InstrumentHandlerCounter(CVE-2022-21698) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.10/html/release_notes/ocp-4-10-release-notes For Red Hat OpenShift Logging 5.3, see the following instructions to apply this update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.7/html/logging/cluster-logging-upgrading 4. Bugs fixed (https://bugzilla.redhat.com/): 2004133 - CVE-2021-37136 netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data 2004135 - CVE-2021-37137 netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way 2031958 - CVE-2021-43797 netty: control chars in header names may lead to HTTP request smuggling 2045880 - CVE-2022-21698 prometheus/client_golang: Denial of service using InstrumentHandlerCounter 2058404 - CVE-2022-0759 kubeclient: kubeconfig parsing error can lead to MITM attacks 5. JIRA issues fixed (https://issues.redhat.com/): LOG-2334 - [release-5.3] Events listing out of order in Kibana 6.8.1 LOG-2450 - http.max_header_size set to 128kb causes communication with elasticsearch to stop working LOG-2481 - EO shouldn't grant cluster-wide permission to system:serviceaccount:openshift-monitoring:prometheus-k8s when ES cluster is deployed. [openshift-logging 5.3] 6.References: https://access.redhat.com/security/cve/CVE-2018-25032 https://access.redhat.com/security/cve/CVE-2021-4028 https://access.redhat.com/security/cve/CVE-2021-37136 https://access.redhat.com/security/cve/CVE-2021-37137 https://access.redhat.com/security/cve/CVE-2021-43797 https://access.redhat.com/security/cve/CVE-2022-0759 https://access.redhat.com/security/cve/CVE-2022-0778 https://access.redhat.com/security/cve/CVE-2022-1154 https://access.redhat.com/security/cve/CVE-2022-1271 https://access.redhat.com/security/cve/CVE-2022-21426 https://access.redhat.com/security/cve/CVE-2022-21434 https://access.redhat.com/security/cve/CVE-2022-21443 https://access.redhat.com/security/cve/CVE-2022-21476 https://access.redhat.com/security/cve/CVE-2022-21496 https://access.redhat.com/security/cve/CVE-2022-21698 https://access.redhat.com/security/cve/CVE-2022-25636 https://access.redhat.com/security/updates/classification/#moderate 7. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYnw2U9zjgjWX9erEAQi7Sw/+L7yfu+C6un45ah5GgF3MXRTXRLaBr3WU zDESM/2JnBZFHeJAjhyr71CxiSUc/ISjU40PZU4RC1VfsDk0yIZGVbcU5kexCkJj yfM95bUnzJiyCjHE3Xdq8TDQOUGVM+TDYqaGeGcATHTgSPj8WqWHgvV9KlotY5FL lhsb2TDn3h/rHbV7FpQ3mTJT7yrxPXGLFQN69n6IXIiSDOKedo3DBKBYROt2+BEW TkPnTZMWGyIkpnD0J8naJm5DtbJIvMOqQR9WW6GW4ISMAdVroI0423IeEy/JKyA/ 25dZrJ/bFbh0riqlCQSH0/Ud45g73ebqidYNGValKrmRMH9/EAblVKGKjR84G8XF /PGix26s9TMS7Iqv9IaJckc+b6ODZMDH8In/p3G+R4FQm1OqhHkOziXNhcbcIilm 2UYX5difbNRwbwzRkPJvAfg1BvtlobvuPj7UwjPcD4pBXKBjazqQCuwm2GB8Tehh dVp6ERe/Iuo32ETq+8/dBb2D9EEJdX33r9XX8si+q0g5+nHhFc473jP+uvwEBDpB 0B9bcknB6mgn4FyGMA5ujuFJ+31SEZf9LniEc6lQ8+DY5C38/ptBncDEp376HAFs WH4I6Z0xub7Uc2Jn1GmRuoUpQf+MRjn6ZFUImOQaROAYKPDrAWnirmLaAor9QwU0 PYI0DDsEFj0=48O2 -----END PGP SIGNATURE----- -- RHSA-announce mailing list
May 11, 2022
Red Hat
98
security advisorymoderatesecurity updateRed Hat OpenShift: RHSA-2022:0225-01 Moderate: RCE In Logging 5.0
An update is now available for OpenShift Logging (5.0.12) Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat OpenShift Enterprise Logging bug fix and security update (5.0.12) Advisory ID: RHSA-2022:0225-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2022:0225 Issue date: 2022-01-20 CVE Names: CVE-2021-44832 ==================================================================== 1. Summary: An update is now available for OpenShift Logging (5.0.12) Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Openshift Logging Bug Fix Release (5.0.12) Security Fix(es): * log4j-core: remote code execution via JDBC Appender (CVE-2021-44832) 3. Solution: For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.7/html/release_notes/ocp-4-7-release-notes For Red Hat OpenShift Logging 5.0, see the following instructions to apply this update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.7/html/logging/cluster-logging-upgrading 4. Bugs fixed (https://bugzilla.redhat.com/): 2035951 - CVE-2021-44832 log4j-core: remote code execution via JDBC Appender 5. JIRA issues fixed (https://redhat.atlassian.net/jira/projects): LOG-2089 - resourceVersion is overflowing typeInteger causing ES rejection [openshift-logging 5.0] 6. References: https://access.redhat.com/security/cve/CVE-2021-44832 https://access.redhat.com/security/updates/classification#moderate 7. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYentwdzjgjWX9erEAQhzog//R394a37p9ejz9RI9AOvIgt57nFA4Sxd3 zNsSkz3qfHOpEXKtEJQvUashKNNxGmR5wYS6UjJIfX+cFwdC64MYjzIqppALWs3d VoWdaCc3MIY9kWwKjeSKEEGK0h2Zvu3ne+MANeJTfg5QiBuQWUx0hg6EsD9LbBCw kIiimqjJ5PEpDd7xf7SsKZ5r1lDTRG4XZfbTcyLZ6Emc2FRi0nnAfzOiUgMqml+w Gu6+M6OOli/CX8l3uIyVCkIDAaAP0YQHySbXLOEaGxvmcKw4uM6JTdXi0r6aLBPl uGToYYYUpN567db9/Vf3LmoJ1zVDVyuhgY+4nQYM7xtEP5f/5QM7oRCZo9LrlIuE k+Fh3biBtu6hJYOABRIS8O08F/acTh+w/angZXEQL5bnU3nNv9XhZ8XwtX7sD0ih BfH+70kEne/DVRlAze7edBX1aMiQJwj4NZ5rgkn+R1H7sxMfxcnbzRW+3/5ASeqX pUgMX1NwbHxxrldfAVbt+0FiLHXuC+4uZULUinhSEMA3f/2/EIRm3I/8u4kZtSKM any0U+TYwkuvxCnuKJm3OexXg39BtZmt6V9n+y5WjxoG9VyymQxuVDjV5l1htdah HwbcU+uN3aPAjHxjPuLGVx1R7mHGVhfd0qbDM8nJso6qiAX31R/ZTxXbD30yDdpe Z/Yz8ilsQmg=fr1l -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Jan 20, 2022
Red Hat
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!