(RHSA-2021:5128) Moderate: Openshift Logging security and bug update (5.1.5)

Openshift Logging Security and Bug Fix Release (5.1.5)

Security Fix(es):

• log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value (CVE-2021-44228)

• netty: Request smuggling via content-length header (CVE-2021-21409)

• netty-codec: Bzip2Decoder doesn’t allow setting size restrictions for decompressed data (CVE-2021-37136)

• netty-codec: SnappyFrameDecoder doesn’t restrict chunk length and may buffer skippable chunks in an unnecessary way (CVE-2021-37137)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.