Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2023.0925
Red Hat OpenShift (Logging Subsystem) security update
16 February 2023
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Red Hat OpenShift (Logging Subsystem)
Publisher: Red Hat
Operating System: Red Hat
Resolution: Patch/Upgrade
CVE Names: CVE-2022-47629 CVE-2022-41903 CVE-2022-40304
CVE-2022-40303 CVE-2022-23521
Original Bulletin:
https://access.redhat.com/errata/RHSA-2023:0633
Comment: CVSS (Max): 9.8 CVE-2022-47629 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS Source: Red Hat
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: Red Hat OpenShift (Logging Subsystem) security update
Advisory ID: RHSA-2023:0633-01
Product: Logging Subsystem for Red Hat OpenShift
Advisory URL: https://access.redhat.com/errata/RHSA-2023:0633
Issue date: 2023-02-15
CVE Names: CVE-2022-23521 CVE-2022-40303 CVE-2022-40304
CVE-2022-41903 CVE-2022-47629
=====================================================================
1. Summary:
Logging Subsystem 5.5.7 - Red Hat OpenShift
2. Description:
Logging Subsystem 5.5.7 - Red Hat OpenShift
3. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
4. JIRA issues fixed (https://issues.jboss.org/):
LOG-3533 - tls.cert, tls.key and passphrase are not passed to the fluentd configuration when forwarding logs using syslog over TLS
LOG-3534 - [release-5.5] [Administrator Console] Seeing "parse error" while using Severity filter for cluster view user
5. References:
https://access.redhat.com/security/cve/CVE-2022-23521
https://access.redhat.com/security/cve/CVE-2022-40303
https://access.redhat.com/security/cve/CVE-2022-40304
https://access.redhat.com/security/cve/CVE-2022-41903
https://access.redhat.com/security/cve/CVE-2022-47629
https://access.redhat.com/security/updates/classification/#moderate
null
6. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2023 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBY+0kYtzjgjWX9erEAQh8tg/+OxUzZUKlGBAcVY2WQ/YrOzOAL73pf5Vs
X5yLUjjK9yBeXtTjnWQIuYst3tDiUtUAq41xC6QJ622opWMtBVH26IwS9o0jE/px
8xR7PaVY7UOxjdRA9JIt7NH1BhH8iv463xVWvXMvTVfHtjva6aaorFXofjGOLs/s
nLikw9Q/9TPDtg955NoXj8YT+aF9jXivWVu/2Z25o0bC9yitGOByvah1NTTYfkGw
86H+2PYkZ2jXyO0O6fES1HG5ATkvnFFUbk5hrE8Q58tBOMWv6vCyPjvrhFBlCIR2
NvsBQWwIj2Lzn/pFji8uTf2x+m3JNOqzGa/M0cHzRPdvwi0YcXYurF/9n5Vgb7sS
n1lrKg8dX2v1i6GAgYx8BFMrcFzw/D8az/q30LwCJauWy+i74/uyM3ukUKbXnvkO
sjl/bT3ztkuO2jlGfZCjirhFNdjShbL06f2elDe5p4A47D7S8oPrd++KuPrh432e
CRZ966edVDP1LLuR6Mz3y26hkF1pYgzNoB2qbgY5se0feyHrSsnh0njYBWQwv3Qu
68w3HXby+O9Rd/azAICbEjTX+Os/UDiAN1+gTkiALdRAYI4yyQPoIp8dB4AuHxmn
UARsqN6glH5GYdkDq6rfVC5fC9pn16OJb6HOTIbCQ5tHJUgjZCElmsRc9kxzZe+6
LGOMFBehEt8=
=Gx1+
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBY+2JrMkNZI30y1K9AQhHjw//ZkS0r1Cif6VqHAcDzF0kaiho0cYpYQJy
0tXnF4J2GJ61kgSs6jPK3G0KbpdYL3RDYL2PanLBILTq6goJdUvEfCkbh1Uo43VX
Vg7QEzQLtE4IJRI0eaS1zuVzwcqqVlRGqHouNr3uq5IjtvQnJS5U4uYJsEUi00Sj
SXhtfX+stE04cLhsKH2tsrPXAqeSi/eFgvdKB9m6sqZKcNuexbP8EWH6RhZxuV7M
1NiUg/nlUZ46CsSKCFxseY/agktKZptwF14wYnjnXz/1zFe2gwZdkcwJvYvRd9y7
c51YHsWGjEIdEdutXCCE5CX+waAPi+raWjNXmCtEfiDuz1C15jXLqlGnmzJf216F
hr6eDCy7CIP/S59CCP/1B/MqX6X6prvpyDr9Uq6CzekHNkOc/1ZONaEWoEX8iNe5
tsLx4BOEU2bOefieQnU/YwbAYcUhB2yqTf0HoJJ04PjgnuWajGxFjgfnOn3GIKMH
lyTz2Rb6zR3gy8UE0ERVEOCrIg9RtI+aTqJ70QyjORES5JwSgNnkBGaunGnWIpKr
E1yMLoTB9NXWhNIfUDZP3G+509zcKqy2v2nml4yQpm2shTEbgHoF7PnsymIPWb/F
NIEl2VW4V9YaqLJPkVIy2I5vi0eplX9R3ZT/lTpjbISG6Y6QVVNYXv9Zv2UCe7Gp
bXziiZRpMoE=
=3nXv
-----END PGP SIGNATURE-----