An Openshift Logging security and bug update (5.2.4) has been released.

RHSA-2021:5127-05: Moderate: Openshift Logging security and bug update (5.2.4)

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: Openshift Logging security and bug update (5.2.4)
Advisory ID: RHSA-2021:5127-01
Product: Red Hat OpenShift Enterprise
Advisory URL:   https://access.redhat.com/errata/RHSA-2021:5127
Issue date: 2021-12-14
CVE Names: CVE-2018-25009 CVE-2018-25010 CVE-2018-25012
CVE-2018-25013 CVE-2018-25014 CVE-2019-5827
CVE-2019-13750 CVE-2019-13751 CVE-2019-17594
CVE-2019-17595 CVE-2019-18218 CVE-2019-19603
CVE-2019-20838 CVE-2020-12762 CVE-2020-13435
CVE-2020-14145 CVE-2020-14155 CVE-2020-16135
CVE-2020-17541 CVE-2020-24370 CVE-2020-35521
CVE-2020-35522 CVE-2020-35523 CVE-2020-35524
CVE-2020-36330 CVE-2020-36331 CVE-2020-36332
CVE-2021-3200 CVE-2021-3426 CVE-2021-3445
CVE-2021-3481 CVE-2021-3572 CVE-2021-3580
CVE-2021-3712 CVE-2021-3800 CVE-2021-20231
CVE-2021-20232 CVE-2021-20266 CVE-2021-20317
CVE-2021-21409 CVE-2021-22876 CVE-2021-22898
CVE-2021-22925 CVE-2021-27645 CVE-2021-28153
CVE-2021-31535 CVE-2021-33560 CVE-2021-33574
CVE-2021-35942 CVE-2021-36084 CVE-2021-36085
CVE-2021-36086 CVE-2021-36087 CVE-2021-37136
CVE-2021-37137 CVE-2021-42574 CVE-2021-43267
CVE-2021-43527 CVE-2021-44228
=====================================================================

1. Summary:

An update is now available for OpenShift Logging 5.2.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Openshift Logging Security and Bug Fix Release (5.2.4)

Security Fix(es):

* log4j-core: Remote code execution in Log4j 2.x when logs contain an
attacker-controlled string value (CVE-2021-44228)

* netty: Request smuggling via content-length header (CVE-2021-21409)

* netty-codec: Bzip2Decoder doesn't allow setting size restrictions for
decompressed data (CVE-2021-37136)

* netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may
buffer skippable chunks in an unnecessary way (CVE-2021-37137)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

For OpenShift Container Platform 4.8 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this errata update:

  https://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html

For Red Hat OpenShift Logging 5.2, see the following instructions to apply
this update:

  https://docs.openshift.com/container-platform/4.7/logging/cluster-logging-upgrading.html

4. Bugs fixed (  https://bugzilla.redhat.com/):

1944888 - CVE-2021-21409 netty: Request smuggling via content-length header
2004133 - CVE-2021-37136 netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data
2004135 - CVE-2021-37137 netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way
2030932 - CVE-2021-44228 log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value

5. JIRA issues fixed (  https://issues.jboss.org/):

LOG-1775 - [release-5.2] Syslog output is serializing json incorrectly
LOG-1824 - [release-5.2] Rejected by Elasticsearch and unexpected json-parsing
LOG-1963 - [release-5.2] CLO panic: runtime error: slice bounds out of range [:-1]
LOG-1970 - Applying cluster state is causing elasticsearch to hit an issue and become unusable

6. References:

  https://access.redhat.com/security/cve/CVE-2018-25009
  https://access.redhat.com/security/cve/CVE-2018-25010
  https://access.redhat.com/security/cve/CVE-2018-25012
  https://access.redhat.com/security/cve/CVE-2018-25013
  https://access.redhat.com/security/cve/CVE-2018-25014
  https://access.redhat.com/security/cve/CVE-2019-5827
  https://access.redhat.com/security/cve/CVE-2019-13750
  https://access.redhat.com/security/cve/CVE-2019-13751
  https://access.redhat.com/security/cve/CVE-2019-17594
  https://access.redhat.com/security/cve/CVE-2019-17595
  https://access.redhat.com/security/cve/CVE-2019-18218
  https://access.redhat.com/security/cve/CVE-2019-19603
  https://access.redhat.com/security/cve/CVE-2019-20838
  https://access.redhat.com/security/cve/CVE-2020-12762
  https://access.redhat.com/security/cve/CVE-2020-13435
  https://access.redhat.com/security/cve/CVE-2020-14145
  https://access.redhat.com/security/cve/CVE-2020-14155
  https://access.redhat.com/security/cve/CVE-2020-16135
  https://access.redhat.com/security/cve/CVE-2020-17541
  https://access.redhat.com/security/cve/CVE-2020-24370
  https://access.redhat.com/security/cve/CVE-2020-35521
  https://access.redhat.com/security/cve/CVE-2020-35522
  https://access.redhat.com/security/cve/CVE-2020-35523
  https://access.redhat.com/security/cve/CVE-2020-35524
  https://access.redhat.com/security/cve/CVE-2020-36330
  https://access.redhat.com/security/cve/CVE-2020-36331
  https://access.redhat.com/security/cve/CVE-2020-36332
  https://access.redhat.com/security/cve/CVE-2021-3200
  https://access.redhat.com/security/cve/CVE-2021-3426
  https://access.redhat.com/security/cve/CVE-2021-3445
  https://access.redhat.com/security/cve/CVE-2021-3481
  https://access.redhat.com/security/cve/CVE-2021-3572
  https://access.redhat.com/security/cve/CVE-2021-3580
  https://access.redhat.com/security/cve/CVE-2021-3712
  https://access.redhat.com/security/cve/CVE-2021-3800
  https://access.redhat.com/security/cve/CVE-2021-20231
  https://access.redhat.com/security/cve/CVE-2021-20232
  https://access.redhat.com/security/cve/CVE-2021-20266
  https://access.redhat.com/security/cve/CVE-2021-20317
  https://access.redhat.com/security/cve/CVE-2021-21409
  https://access.redhat.com/security/cve/CVE-2021-22876
  https://access.redhat.com/security/cve/CVE-2021-22898
  https://access.redhat.com/security/cve/CVE-2021-22925
  https://access.redhat.com/security/cve/CVE-2021-27645
  https://access.redhat.com/security/cve/CVE-2021-28153
  https://access.redhat.com/security/cve/CVE-2021-31535
  https://access.redhat.com/security/cve/CVE-2021-33560
  https://access.redhat.com/security/cve/CVE-2021-33574
  https://access.redhat.com/security/cve/CVE-2021-35942
  https://access.redhat.com/security/cve/CVE-2021-36084
  https://access.redhat.com/security/cve/CVE-2021-36085
  https://access.redhat.com/security/cve/CVE-2021-36086
  https://access.redhat.com/security/cve/CVE-2021-36087
  https://access.redhat.com/security/cve/CVE-2021-37136
  https://access.redhat.com/security/cve/CVE-2021-37137
  https://access.redhat.com/security/cve/CVE-2021-42574
  https://access.redhat.com/security/cve/CVE-2021-43267
  https://access.redhat.com/security/cve/CVE-2021-43527
  https://access.redhat.com/security/cve/CVE-2021-44228
  https://access.redhat.com/security/updates/classification/#moderate
  https://access.redhat.com/security/vulnerabilities/RHSB-2021-009

7. Contact:

The Red Hat security contact is . More contact
details at   https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.