Stay Secure with the Latest Linux Advisories

security advisoryRed Hatcritical

Red Hat OpenShift 4.7 Critical Advisory: Remote Code Execution Risks

Red Hat OpenShift Container Platform release 4.7.40 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Critical: OpenShift Container Platform 4.7.40 security update Advisory ID: RHSA-2021:5107-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2021:5107 Issue date: 2021-12-16 CVE Names: CVE-2021-4104 CVE-2021-43527 CVE-2021-44228 CVE-2021-45046 ==================================================================== 1. Summary: Red Hat OpenShift Container Platform release 4.7.40 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. Security Fix(es): * log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value (CVE-2021-44228) * log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender (CVE-2021-4104) * log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228) (CVE-2021-45046) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer tothe CVE page(s) listed in the References section. 3. Solution: For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.7/html/release_notes/ocp-4-7-release-notes Details on how to access this content are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.7/html/updating_clusters/updating-cluster-cli 4. Bugs fixed (https://bugzilla.redhat.com/): 2030932 - CVE-2021-44228 log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value 2031667 - CVE-2021-4104 log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender 2032580 - CVE-2021-45046 log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228) 5. References: https://access.redhat.com/security/cve/CVE-2021-4104 https://access.redhat.com/security/cve/CVE-2021-43527 https://access.redhat.com/security/cve/CVE-2021-44228 https://access.redhat.com/security/cve/CVE-2021-45046 https://access.redhat.com/security/updates/classification/#critical https://access.redhat.com/security/vulnerabilities/RHSB-2021-009 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBYbuXndzjgjWX9erEAQjR3xAAiHfUdtwi38UJTKZ6D5SGZ5mGBWRMcYty pXjPoJs9sHf04OB9F7b88iQEKudLq6r4z0o7pqRxXRorzfPTJOWvmD+ayupPHIhu yr19SHYt32fpFXG0tVTWo+VjvZn/ZwZ8EdZX1jq+PC7aoQ4Yh58y+9rJGlqn9Wfd RZPpRbEQWaR/wIS1m7jqW/mSrHNlPuimgOJlrKsEDm3aI9YPJNIxS9WQ7TNZ1AO/ /U6RLLk0EAibdw3kw/RSzcEKZ5urJjsktz2hXOM1FnvricOsCclxQ78sUUhZp/m3 S8RDOZ+1NIpbSPNr6nSaKG0DnLw0i/AGesi5AtQfIazcNKvsfWYkcS5AcTuAOwkR +pHQmtC1IaEmalUscCLlvfcyubSUkQApFUrSrXC3zcxhn7f/d8DI01rpfhbRYpPQ 1TweQxVJ/S9Nt/hhMRjhB5v6YoXuHjb9rZ9FilPktpzZ6sUEu9Vr4anvP6g3kbtc 18QAjFpxKHgH22oShrVvQXGU+paxO2WcqP6DCYjal01L7SUnFFxfhK0tI7UHRuFb Wm31FVQhs/0FDr9gE7J1XQzSMaAQe5hk0ueR7l9ntc43zWnvBL0CuNZE25vInRSx CNrn3Ayy1qT62pGC06Pi0aWNTiOaiG482q7P9xxAetGaxpnppsRByoTL8on6KZJ1 E9Raq4qenFM=n09f -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . Delve into essential security enhancements for Red Hat OpenShift Container Platform version 4.7.40, featuring remedies for vulnerabilities that could lead to remote code execution risks.. OpenShift Container Platform, Red Hat updates, Critical security advisory. . Severity: Critical. LinuxSecurity.com Team

Dec 16, 2021 •Critical Red Hat