Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2021.1820 Openshift Logging security and bugs update (5.0.4) 27 May 2021 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Red Hat OpenShift Container Platform Publisher: Red Hat Operating System: Red Hat Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated Increased Privileges -- Existing Account Denial of Service -- Remote/Unauthenticated Provide Misleading Information -- Remote/Unauthenticated Access Confidential Data -- Remote/Unauthenticated Reduced Security -- Remote/Unauthenticated Resolution: Patch/Upgrade CVE Names: CVE-2021-23336 CVE-2021-20305 CVE-2021-3326 CVE-2021-3177 CVE-2021-3121 CVE-2021-0342 CVE-2020-36322 CVE-2020-35508 CVE-2020-29363 CVE-2020-29362 CVE-2020-29361 CVE-2020-28974 CVE-2020-28196 CVE-2020-27835 CVE-2020-27786 CVE-2020-27619 CVE-2020-27618 CVE-2020-26137 CVE-2020-26116 CVE-2020-25712 CVE-2020-25704 CVE-2020-25643 CVE-2020-25285 CVE-2020-25284 CVE-2020-25212 CVE-2020-24977 CVE-2020-24394 CVE-2020-15437 CVE-2020-15358 CVE-2020-14363 CVE-2020-14362 CVE-2020-14361 CVE-2020-14360 CVE-2020-14356 CVE-2020-14347 CVE-2020-14346 CVE-2020-14345 CVE-2020-14344 CVE-2020-14314 CVE-2020-13776 CVE-2020-13584 CVE-2020-13543 CVE-2020-13434 CVE-2020-12464 CVE-2020-12362 CVE-2020-12114 CVE-2020-11608 CVE-2020-10878 CVE-2020-10543 CVE-2020-9983 CVE-2020-9951 CVE-2020-9948 CVE-2020-8927 CVE-2020-8286 CVE-2020-8285 CVE-2020-8284 CVE-2020-8231 CVE-2020-0431 CVE-2019-25013 CVE-2019-19528 CVE-2019-19523 CVE-2019-18811 CVE-2019-13012 CVE-2019-9169 CVE-2019-3842 CVE-2019-2708 CVE-2016-10228 Reference: ESB-2021.1799 ESB-2021.1772 ESB-2021.1754 Original Bulletin: https://access.redhat.com/errata/RHSA-2021:2136 - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Openshift Logging security and bugs update (5.0.4) Advisory ID: RHSA-2021:2136-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2021:2136 Issue date: 2021-05-26 CVE Names: CVE-2016-10228 CVE-2019-2708 CVE-2019-3842 CVE-2019-9169 CVE-2019-13012 CVE-2019-18811 CVE-2019-19523 CVE-2019-19528 CVE-2019-25013 CVE-2020-0431 CVE-2020-8231 CVE-2020-8284 CVE-2020-8285 CVE-2020-8286 CVE-2020-8927 CVE-2020-9948 CVE-2020-9951 CVE-2020-9983 CVE-2020-10543 CVE-2020-10878 CVE-2020-11608 CVE-2020-12114 CVE-2020-12362 CVE-2020-12464 CVE-2020-13434 CVE-2020-13543 CVE-2020-13584 CVE-2020-13776 CVE-2020-14314 CVE-2020-14344 CVE-2020-14345 CVE-2020-14346 CVE-2020-14347 CVE-2020-14356 CVE-2020-14360 CVE-2020-14361 CVE-2020-14362 CVE-2020-14363 CVE-2020-15358 CVE-2020-15437 CVE-2020-24394 CVE-2020-24977 CVE-2020-25212 CVE-2020-25284 CVE-2020-25285 CVE-2020-25643 CVE-2020-25704 CVE-2020-25712 CVE-2020-26116 CVE-2020-26137 CVE-2020-27618 CVE-2020-27619 CVE-2020-27786 CVE-2020-27835 CVE-2020-28196 CVE-2020-28974 CVE-2020-29361 CVE-2020-29362 CVE-2020-29363 CVE-2020-35508 CVE-2020-36322 CVE-2021-0342 CVE-2021-3121 CVE-2021-3177 CVE-2021-3326 CVE-2021-20305 CVE-2021-23336 ===================================================================== 1. Summary: Openshift Logging Bug Fix Release (5.0.4) This release includes a security update. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Openshift Logging Bug Fix Release (5.0.4) Security Fix(es): * gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation (CVE-2021-3121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-rel ease-notes.html For Red Hat OpenShift Logging 5.0, see the following instructions to apply this update: https://docs.openshift.com/container-platform/4.7/logging/cluster-logging-u pgrading.html 4. Bugs fixed (https://bugzilla.redhat.com/): 1921650 - CVE-2021-3121 gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation 5. JIRA issues fixed (https://issues.jboss.org/): LOG-1328 - Port fix to 5.0.z for BZ-1945168 6. References: https://access.redhat.com/security/cve/CVE-2016-10228 https://access.redhat.com/security/cve/CVE-2019-2708 https://access.redhat.com/security/cve/CVE-2019-3842 https://access.redhat.com/security/cve/CVE-2019-9169 https://access.redhat.com/security/cve/CVE-2019-13012 https://access.redhat.com/security/cve/CVE-2019-18811 https://access.redhat.com/security/cve/CVE-2019-19523 https://access.redhat.com/security/cve/CVE-2019-19528 https://access.redhat.com/security/cve/CVE-2019-25013 https://access.redhat.com/security/cve/CVE-2020-0431 https://access.redhat.com/security/cve/CVE-2020-8231 https://access.redhat.com/security/cve/CVE-2020-8284 https://access.redhat.com/security/cve/CVE-2020-8285 https://access.redhat.com/security/cve/CVE-2020-8286 https://access.redhat.com/security/cve/CVE-2020-8927 https://access.redhat.com/security/cve/CVE-2020-9948 https://access.redhat.com/security/cve/CVE-2020-9951 https://access.redhat.com/security/cve/CVE-2020-9983 https://access.redhat.com/security/cve/CVE-2020-10543 https://access.redhat.com/security/cve/CVE-2020-10878 https://access.redhat.com/security/cve/CVE-2020-11608 https://access.redhat.com/security/cve/CVE-2020-12114 https://access.redhat.com/security/cve/CVE-2020-12362 https://access.redhat.com/security/cve/CVE-2020-12464 https://access.redhat.com/security/cve/CVE-2020-13434 https://access.redhat.com/security/cve/CVE-2020-13543 https://access.redhat.com/security/cve/CVE-2020-13584 https://access.redhat.com/security/cve/CVE-2020-13776 https://access.redhat.com/security/cve/CVE-2020-14314 https://access.redhat.com/security/cve/CVE-2020-14344 https://access.redhat.com/security/cve/CVE-2020-14345 https://access.redhat.com/security/cve/CVE-2020-14346 https://access.redhat.com/security/cve/CVE-2020-14347 https://access.redhat.com/security/cve/CVE-2020-14356 https://access.redhat.com/security/cve/CVE-2020-14360 https://access.redhat.com/security/cve/CVE-2020-14361 https://access.redhat.com/security/cve/CVE-2020-14362 https://access.redhat.com/security/cve/CVE-2020-14363 https://access.redhat.com/security/cve/CVE-2020-15358 https://access.redhat.com/security/cve/CVE-2020-15437 https://access.redhat.com/security/cve/CVE-2020-24394 https://access.redhat.com/security/cve/CVE-2020-24977 https://access.redhat.com/security/cve/CVE-2020-25212 https://access.redhat.com/security/cve/CVE-2020-25284 https://access.redhat.com/security/cve/CVE-2020-25285 https://access.redhat.com/security/cve/CVE-2020-25643 https://access.redhat.com/security/cve/CVE-2020-25704 https://access.redhat.com/security/cve/CVE-2020-25712 https://access.redhat.com/security/cve/CVE-2020-26116 https://access.redhat.com/security/cve/CVE-2020-26137 https://access.redhat.com/security/cve/CVE-2020-27618 https://access.redhat.com/security/cve/CVE-2020-27619 https://access.redhat.com/security/cve/CVE-2020-27786 https://access.redhat.com/security/cve/CVE-2020-27835 https://access.redhat.com/security/cve/CVE-2020-28196 https://access.redhat.com/security/cve/CVE-2020-28974 https://access.redhat.com/security/cve/CVE-2020-29361 https://access.redhat.com/security/cve/CVE-2020-29362 https://access.redhat.com/security/cve/CVE-2020-29363 https://access.redhat.com/security/cve/CVE-2020-35508 https://access.redhat.com/security/cve/CVE-2020-36322 https://access.redhat.com/security/cve/CVE-2021-0342 https://access.redhat.com/security/cve/CVE-2021-3121 https://access.redhat.com/security/cve/CVE-2021-3177 https://access.redhat.com/security/cve/CVE-2021-3326 https://access.redhat.com/security/cve/CVE-2021-20305 https://access.redhat.com/security/cve/CVE-2021-23336 https://access.redhat.com/security/updates/classification/#moderate 7. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYK6rZtzjgjWX9erEAQh88A//U4VO7WHsaIujHoWot5HwlJNEQgoQ93pl UHSdDxXmO/0FSiHKONYzEE/v7QkyGdwVCF8f/BvQMNqcez3mtwKPrtikcsFgRol+ nwyxdSvvExYs2xoGNHrwc+lzu3LE4nUUs7AX+otr9c41SYJsqmpBMt5CyzZyBY/M zS+GrHnnH6WE/vVV55eyhHDrBkKLzzjz2neSXNnj1Vk5XRUQ6sGUzmhJpMYjepHz oml7AFA6X3ipFEJ3J9aph1ATbd+9puPeumI1VpkeE5gQg6lka1o6hToe/c6s+SPv ts8KYwmv2u6GIWUpvN7jxyNGH3OcuAIxOlrHQX2FG1CRsMbXfsXK0R96CdXYmYhe pclGQO3iiGMrN5FnENGL8pK7WSs/O4YIYPFiRDKxbBlYa+nbtsiGALevKMRxU3WW MudQIzVq1rEdUBK2T854pGpmIIXVTNZM5Xae2L8mL+qIn7cQVQZiTU3VySlt7vNx HU5o5GkTZwzRh0gMxYshsQRCQWmwLiFpfkmD0hzQQWjWpBQ5Pt2WNnHi0pjeDd7E NefXoknNf7De0lLhEPskN1WNgDn9jdBm5Nu87zHO0mFHzzwL1aVZBQ0ruzENceZS FoIJzetl+rai+wLEyHNi2TIPCUIBu7TFv3mjW76WGwfU99cIm13NEbmR7mt12xjn KqyAcCXMbNg= =naHQ - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBYK8U3uNLKJtyKPYoAQhnbxAArO82WEOXyONrdK9CxmsnEOd4SZ9sK5dI E7dk8bwoC3G6mVQ22/FbpOdA6skwSE+kbxqHTcbZ/44U2rCMFKN16HI5tdM20lFU 8J2RnzY2eyYBT7nQP0BBXxOMpe0LvojNZRECfCwlW34mcAyIjK30s84GqTfOc9nL s+o/qhx2nBR10MYSaSk/0IrgoKOPEhELpnBxx5u9jSOBol24qcIPQUCIKOImVqtq s7TTJlWpZDCQUSRW/F5LukeuigSCdVLvACZmYe5o3MknkQx+4TQj0B4RkyRgbySZ onomHdCbFrZG8dSZmlEVB72hHDle+/f30WyFOcpxxRouQ52MQpOSxOPCP+nhb2RT sBmeg3I3h/vjMl92dMXf+y3nkU6WuWW5d2cN7/ofKLcPj4/X5sj1Maa9HYB2sv3w s65ep/eZ1Fdnd0Fz4roxa4yQEUhuDRo1NsHMvD0SeIx8urfovGFOcSvmXaqBJF4o NSt9JkPIOUTWW8unweIR3NvQMCjKU2BelUp8Fj8OCV/7BjCLg+W6g1jJ4ZwhwaEf jlkKN5uuqrowf9D/i9HN4L2g3V+nTRDFQ0FZZTCGiSEOgezd/DGd5pUv3gFNKW8k vSxf06R/Hbet9313irV3vSPzf/IWI4B5oGaT6ZJnFLGvaLoK7QE47NiGJ5Y/jvrq Truy68x/Xuk= =yrIN -----END PGP SIGNATURE-----