-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   
Red Hat Security Advisory

Synopsis:          Moderate: Openshift Logging Security Release (5.0.10)
Advisory ID:       RHSA-2021:5137-01
Product:           Red Hat OpenShift Enterprise
Advisory URL:      https://access.redhat.com/errata/RHSA-2021:5137
Issue date:        2021-12-14
CVE Names:         CVE-2018-20673 CVE-2018-25009 CVE-2018-25010
                   CVE-2018-25012 CVE-2018-25013 CVE-2018-25014
                   CVE-2019-5827 CVE-2019-13750 CVE-2019-13751
                   CVE-2019-14615 CVE-2019-17594 CVE-2019-17595
                   CVE-2019-18218 CVE-2019-19603 CVE-2019-20838
                   CVE-2020-0427 CVE-2020-10001 CVE-2020-12762
                   CVE-2020-13435 CVE-2020-14145 CVE-2020-14155
                   CVE-2020-16135 CVE-2020-17541 CVE-2020-24370
                   CVE-2020-24502 CVE-2020-24503 CVE-2020-24504
                   CVE-2020-24586 CVE-2020-24587 CVE-2020-24588
                   CVE-2020-26139 CVE-2020-26140 CVE-2020-26141
                   CVE-2020-26143 CVE-2020-26144 CVE-2020-26145
                   CVE-2020-26146 CVE-2020-26147 CVE-2020-27777
                   CVE-2020-29368 CVE-2020-29660 CVE-2020-35448
                   CVE-2020-35521 CVE-2020-35522 CVE-2020-35523
                   CVE-2020-35524 CVE-2020-36158 CVE-2020-36312
                   CVE-2020-36330 CVE-2020-36331 CVE-2020-36332
                   CVE-2020-36386 CVE-2021-0129 CVE-2021-3200
                   CVE-2021-3348 CVE-2021-3426 CVE-2021-3445
                   CVE-2021-3481 CVE-2021-3487 CVE-2021-3489
                   CVE-2021-3564 CVE-2021-3572 CVE-2021-3573
                   CVE-2021-3580 CVE-2021-3600 CVE-2021-3635
                   CVE-2021-3659 CVE-2021-3679 CVE-2021-3712
                   CVE-2021-3732 CVE-2021-3778 CVE-2021-3796
                   CVE-2021-3800 CVE-2021-20194 CVE-2021-20197
                   CVE-2021-20231 CVE-2021-20232 CVE-2021-20239
                   CVE-2021-20266 CVE-2021-20284 CVE-2021-22876
                   CVE-2021-22898 CVE-2021-22925 CVE-2021-23133
                   CVE-2021-23840 CVE-2021-23841 CVE-2021-27645
                   CVE-2021-28153 CVE-2021-28950 CVE-2021-28971
                   CVE-2021-29155 CVE-2021-29646 CVE-2021-29650
                   CVE-2021-31440 CVE-2021-31535 CVE-2021-31829
                   CVE-2021-31916 CVE-2021-33033 CVE-2021-33200
                   CVE-2021-33560 CVE-2021-33574 CVE-2021-35942
                   CVE-2021-36084 CVE-2021-36085 CVE-2021-36086
                   CVE-2021-36087 CVE-2021-42574 CVE-2021-43527
                   CVE-2021-44228
====================================================================
1. Summary:

Openshift Logging Security Release (5.0.10)

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Openshift Logging Bug Fix Release (5.0.10)

Security Fix(es):

* log4j-core: Remote code execution in Log4j 2.x when logs contain an
attacker-controlled string value (CVE-2021-44228)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

For OpenShift Container Platform 4.7 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this errata update:

https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html

For Red Hat OpenShift Logging 5.0, see the following instructions to apply
this update:

https://docs.openshift.com/container-platform/4.7/logging/cluster-logging-upgrading.html

4. Bugs fixed (https://bugzilla.redhat.com/):

2030932 - CVE-2021-44228 log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value

5. References:

https://access.redhat.com/security/cve/CVE-2018-20673
https://access.redhat.com/security/cve/CVE-2018-25009
https://access.redhat.com/security/cve/CVE-2018-25010
https://access.redhat.com/security/cve/CVE-2018-25012
https://access.redhat.com/security/cve/CVE-2018-25013
https://access.redhat.com/security/cve/CVE-2018-25014
https://access.redhat.com/security/cve/CVE-2019-5827
https://access.redhat.com/security/cve/CVE-2019-13750
https://access.redhat.com/security/cve/CVE-2019-13751
https://access.redhat.com/security/cve/CVE-2019-14615
https://access.redhat.com/security/cve/CVE-2019-17594
https://access.redhat.com/security/cve/CVE-2019-17595
https://access.redhat.com/security/cve/CVE-2019-18218
https://access.redhat.com/security/cve/CVE-2019-19603
https://access.redhat.com/security/cve/CVE-2019-20838
https://access.redhat.com/security/cve/CVE-2020-0427
https://access.redhat.com/security/cve/CVE-2020-10001
https://access.redhat.com/security/cve/CVE-2020-12762
https://access.redhat.com/security/cve/CVE-2020-13435
https://access.redhat.com/security/cve/CVE-2020-14145
https://access.redhat.com/security/cve/CVE-2020-14155
https://access.redhat.com/security/cve/CVE-2020-16135
https://access.redhat.com/security/cve/CVE-2020-17541
https://access.redhat.com/security/cve/CVE-2020-24370
https://access.redhat.com/security/cve/CVE-2020-24502
https://access.redhat.com/security/cve/CVE-2020-24503
https://access.redhat.com/security/cve/CVE-2020-24504
https://access.redhat.com/security/cve/CVE-2020-24586
https://access.redhat.com/security/cve/CVE-2020-24587
https://access.redhat.com/security/cve/CVE-2020-24588
https://access.redhat.com/security/cve/CVE-2020-26139
https://access.redhat.com/security/cve/CVE-2020-26140
https://access.redhat.com/security/cve/CVE-2020-26141
https://access.redhat.com/security/cve/CVE-2020-26143
https://access.redhat.com/security/cve/CVE-2020-26144
https://access.redhat.com/security/cve/CVE-2020-26145
https://access.redhat.com/security/cve/CVE-2020-26146
https://access.redhat.com/security/cve/CVE-2020-26147
https://access.redhat.com/security/cve/CVE-2020-27777
https://access.redhat.com/security/cve/CVE-2020-29368
https://access.redhat.com/security/cve/CVE-2020-29660
https://access.redhat.com/security/cve/CVE-2020-35448
https://access.redhat.com/security/cve/CVE-2020-35521
https://access.redhat.com/security/cve/CVE-2020-35522
https://access.redhat.com/security/cve/CVE-2020-35523
https://access.redhat.com/security/cve/CVE-2020-35524
https://access.redhat.com/security/cve/CVE-2020-36158
https://access.redhat.com/security/cve/CVE-2020-36312
https://access.redhat.com/security/cve/CVE-2020-36330
https://access.redhat.com/security/cve/CVE-2020-36331
https://access.redhat.com/security/cve/CVE-2020-36332
https://access.redhat.com/security/cve/CVE-2020-36386
https://access.redhat.com/security/cve/CVE-2021-0129
https://access.redhat.com/security/cve/CVE-2021-3200
https://access.redhat.com/security/cve/CVE-2021-3348
https://access.redhat.com/security/cve/CVE-2021-3426
https://access.redhat.com/security/cve/CVE-2021-3445
https://access.redhat.com/security/cve/CVE-2021-3481
https://access.redhat.com/security/cve/CVE-2021-3487
https://access.redhat.com/security/cve/CVE-2021-3489
https://access.redhat.com/security/cve/CVE-2021-3564
https://access.redhat.com/security/cve/CVE-2021-3572
https://access.redhat.com/security/cve/CVE-2021-3573
https://access.redhat.com/security/cve/CVE-2021-3580
https://access.redhat.com/security/cve/CVE-2021-3600
https://access.redhat.com/security/cve/CVE-2021-3635
https://access.redhat.com/security/cve/CVE-2021-3659
https://access.redhat.com/security/cve/CVE-2021-3679
https://access.redhat.com/security/cve/CVE-2021-3712
https://access.redhat.com/security/cve/CVE-2021-3732
https://access.redhat.com/security/cve/CVE-2021-3778
https://access.redhat.com/security/cve/CVE-2021-3796
https://access.redhat.com/security/cve/CVE-2021-3800
https://access.redhat.com/security/cve/CVE-2021-20194
https://access.redhat.com/security/cve/CVE-2021-20197
https://access.redhat.com/security/cve/CVE-2021-20231
https://access.redhat.com/security/cve/CVE-2021-20232
https://access.redhat.com/security/cve/CVE-2021-20239
https://access.redhat.com/security/cve/CVE-2021-20266
https://access.redhat.com/security/cve/CVE-2021-20284
https://access.redhat.com/security/cve/CVE-2021-22876
https://access.redhat.com/security/cve/CVE-2021-22898
https://access.redhat.com/security/cve/CVE-2021-22925
https://access.redhat.com/security/cve/CVE-2021-23133
https://access.redhat.com/security/cve/CVE-2021-23840
https://access.redhat.com/security/cve/CVE-2021-23841
https://access.redhat.com/security/cve/CVE-2021-27645
https://access.redhat.com/security/cve/CVE-2021-28153
https://access.redhat.com/security/cve/CVE-2021-28950
https://access.redhat.com/security/cve/CVE-2021-28971
https://access.redhat.com/security/cve/CVE-2021-29155
https://access.redhat.com/security/cve/CVE-2021-29646
https://access.redhat.com/security/cve/CVE-2021-29650
https://access.redhat.com/security/cve/CVE-2021-31440
https://access.redhat.com/security/cve/CVE-2021-31535
https://access.redhat.com/security/cve/CVE-2021-31829
https://access.redhat.com/security/cve/CVE-2021-31916
https://access.redhat.com/security/cve/CVE-2021-33033
https://access.redhat.com/security/cve/CVE-2021-33200
https://access.redhat.com/security/cve/CVE-2021-33560
https://access.redhat.com/security/cve/CVE-2021-33574
https://access.redhat.com/security/cve/CVE-2021-35942
https://access.redhat.com/security/cve/CVE-2021-36084
https://access.redhat.com/security/cve/CVE-2021-36085
https://access.redhat.com/security/cve/CVE-2021-36086
https://access.redhat.com/security/cve/CVE-2021-36087
https://access.redhat.com/security/cve/CVE-2021-42574
https://access.redhat.com/security/cve/CVE-2021-43527
https://access.redhat.com/security/cve/CVE-2021-44228
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/security/vulnerabilities/RHSB-2021-009

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYblJCtzjgjWX9erEAQh6fQ/+KcGXg9BZNi8DLq8vkmNl+2bNGhNurPgd
H51g3gapqOBgTQvcQ14/S70cPgXZFxBTARxGzBJMr16eEaDsuYFieGkjofh00ixi
RPNnjWZ2Stm6KEE0+a+/LpDfe+mID1F+Hi/px5zj5duRcMNNbrSZiOkGEpOoem8L
LGvbRwFVTTM90euRUf4GfNctHHhtlk21u8xIJ9wBle4LXe7Px4S7pe89qp5KOTRc
hau3qqWRDexLO6JPCOpp71APsNxy+S+OxeHid0CyoXtXjCzkAYcQ1FVhjvmF2QzR
LFu79nur4VG06eDbQd5fZAf3K3lzVIbjj1pPV1yTY20hSpwM+X9rOLOJH5O5yPh3
dNDhTudFRTQ3hBQgc4M8bh4nsq5fTl+OWMdmortAvBPViPacI/DopRjcGaFXAyNq
cYCdYoiEL4fXwWjt7KI4VCJuGiIa7aKNq4kaJjAboGKRrT6t4aLv/5Kpmco200kq
IANqA5gkrb9FKjMNzG9/ktbLgwiaz17xM7X0E71FM3hsl50BJvY/+jCbeRP5QdSO
RqkGUotZ/kxlUSZR9hx7wy0foDH0U8vpa6/VEppCCCBOIE1m0vbhkGuzesgu9yM0
GhZMfw0UsOJzTBejKXJ8fxhgioZIHe6gisBAewy15FNKvWGZqJ0OlR80Tnruc/h/
pGz6uNWwB3s=IMvs
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce