Lucene search

RedHatRHSA-2022:2218

HistoryMay 11, 2022 - 7:47 p.m.

(RHSA-2022:2218) Moderate: Openshift Logging Security and Bug update Release (5.2.10)

2022-05-1119:47:56

access.redhat.com

openshift

logging

bug fix

security

update

cve-2022-0759

cve-2021-37136

cve-2021-37137

cve-2021-43797

cve-2022-21698

mitm attacks

bzip2decoder

snappyframedecoder

http request smuggling

denial of service.

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.015

Percentile

87.3%

JSON

Openshift Logging Bug Fix Release (5.2.10)

Security Fix(es):

kubeclient: kubeconfig parsing error can lead to MITM attacks (CVE-2022-0759)
netty-codec: Bzip2Decoder doesn’t allow setting size restrictions for decompressed data (CVE-2021-37136)
netty-codec: SnappyFrameDecoder doesn’t restrict chunk length and may buffer skippable chunks in an unnecessary way (CVE-2021-37137)
netty: control chars in header names may lead to HTTP request smuggling (CVE-2021-43797)
prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.