An Openshift Logging 5.1.4 bug fix and security update has been released.

RHSA-2021:4628-03: Low: Openshift Logging 5.1.4 bug fix and security update

=====================================================================
Red Hat Security Advisory

Synopsis: Low: Openshift Logging 5.1.4 bug fix and security update
Advisory ID: RHSA-2021:4628-01
Product: Red Hat OpenShift Enterprise
Advisory URL:   https://access.redhat.com/errata/RHSA-2021:4628
Issue date: 2021-11-17
CVE Names: CVE-2020-36385 CVE-2021-0512 CVE-2021-3656
CVE-2021-3733 CVE-2021-22946 CVE-2021-22947
CVE-2021-23369 CVE-2021-23383 CVE-2021-33928
CVE-2021-33929 CVE-2021-33930 CVE-2021-33938
=====================================================================

1. Summary:

An update is now available for OpenShift Logging 5.1.4.

Red Hat Product Security has rated this update as having a security impact
of Low. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Openshift Logging Bug Fix Release (5.1.4)

Security Fix(es):

* nodejs-handlebars: Remote code execution when compiling untrusted compile
templates with strict:true option (CVE-2021-23369)

* nodejs-handlebars: Remote code execution when compiling untrusted compile
templates with compat:true option (CVE-2021-23383)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

For OpenShift Container Platform 4.8 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this errata update:

  https://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html

For Red Hat OpenShift Logging 5.1, see the following instructions to apply
this update:

  https://docs.openshift.com/container-platform/4.8/logging/cluster-logging-upgrading.html

4. Bugs fixed (  https://bugzilla.redhat.com/):

1948761 - CVE-2021-23369 nodejs-handlebars: Remote code execution when compiling untrusted compile templates with strict:true option
1956688 - CVE-2021-23383 nodejs-handlebars: Remote code execution when compiling untrusted compile templates with compat:true option

5. JIRA issues fixed (  https://issues.jboss.org/):

LOG-1858 - OpenShift Alerting Rules Style-Guide Compliance
LOG-1917 - [release-5.1] Fluentd logs emit transaction failed: error_class=NoMethodError while forwarding to external syslog server

6. References:

  https://access.redhat.com/security/cve/CVE-2020-36385
  https://access.redhat.com/security/cve/CVE-2021-0512
  https://access.redhat.com/security/cve/CVE-2021-3656
  https://access.redhat.com/security/cve/CVE-2021-3733
  https://access.redhat.com/security/cve/CVE-2021-22946
  https://access.redhat.com/security/cve/CVE-2021-22947
  https://access.redhat.com/security/cve/CVE-2021-23369
  https://access.redhat.com/security/cve/CVE-2021-23383
  https://access.redhat.com/security/cve/CVE-2021-33928
  https://access.redhat.com/security/cve/CVE-2021-33929
  https://access.redhat.com/security/cve/CVE-2021-33930
  https://access.redhat.com/security/cve/CVE-2021-33938
  https://access.redhat.com/security/updates/classification/#low

7. Contact:

The Red Hat security contact is . More contact
details at   https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.