A Logging Subsystem 5.5.1 security and bug fix update has been released.

RHSA-2022:6344-01: Moderate: Logging Subsystem 5.5.1 Security and Bug Fix Update

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: Logging Subsystem 5.5.1 Security and Bug Fix Update
Advisory ID: RHSA-2022:6344-01
Product: RHOL
Advisory URL:   https://access.redhat.com/errata/RHSA-2022:6344
Issue date: 2022-09-06
CVE Names: CVE-2022-1705 CVE-2022-2526 CVE-2022-29154
CVE-2022-30631 CVE-2022-32148 CVE-2022-32206
CVE-2022-32208
=====================================================================

1. Summary:

Logging Subsystem 5.5.1 - Red Hat OpenShift

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Logging Subsystem 5.5.1 - Red Hat OpenShift

Security Fix(es):

* golang: net/http: improper sanitization of Transfer-Encoding header
(CVE-2022-1705)

* golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

* golang: net/http/httputil: NewSingleHostReverseProxy - omit
X-Forwarded-For not working (CVE-2022-32148)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

For OpenShift Container Platform 4.11 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this errata update:

  https://docs.openshift.com/container-platform/4.11/release_notes/ocp-4-11-release-notes.html

For Red Hat OpenShift Logging 5.5, see the following instructions to apply
this update:

  https://docs.openshift.com/container-platform/4.11/logging/cluster-logging-upgrading.html

4. Bugs fixed (  https://bugzilla.redhat.com/):

2107342 - CVE-2022-30631 golang: compress/gzip: stack exhaustion in Reader.Read
2107374 - CVE-2022-1705 golang: net/http: improper sanitization of Transfer-Encoding header
2107383 - CVE-2022-32148 golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working

5. JIRA issues fixed (  https://issues.jboss.org/):

LOG-2647 - Add link to log console from pod views
LOG-2801 - After upgrade all logs are stored in app indices
LOG-2917 - Changing refresh interval throws error when the 'Query' field is empty

6. References:

  https://access.redhat.com/security/cve/CVE-2022-1705
  https://access.redhat.com/security/cve/CVE-2022-2526
  https://access.redhat.com/security/cve/CVE-2022-29154
  https://access.redhat.com/security/cve/CVE-2022-30631
  https://access.redhat.com/security/cve/CVE-2022-32148
  https://access.redhat.com/security/cve/CVE-2022-32206
  https://access.redhat.com/security/cve/CVE-2022-32208
  https://access.redhat.com/security/updates/classification/#moderate
null

7. Contact:

The Red Hat security contact is . More contact
details at   https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.