Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2021.3905
Openshift Logging 5.3.0 bug fix and security update
16 November 2021
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Openshift Logging
Publisher: Red Hat
Operating System: Red Hat
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Root Compromise -- Existing Account
Increased Privileges -- Existing Account
Denial of Service -- Remote/Unauthenticated
Provide Misleading Information -- Remote/Unauthenticated
Access Confidential Data -- Remote/Unauthenticated
Reduced Security -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2021-42574 CVE-2021-36087 CVE-2021-36086
CVE-2021-36085 CVE-2021-36084 CVE-2021-35942
CVE-2021-33574 CVE-2021-33560 CVE-2021-33200
CVE-2021-33194 CVE-2021-33033 CVE-2021-31916
CVE-2021-31829 CVE-2021-31535 CVE-2021-31440
CVE-2021-29650 CVE-2021-29646 CVE-2021-29155
CVE-2021-28971 CVE-2021-28950 CVE-2021-28153
CVE-2021-27645 CVE-2021-23841 CVE-2021-23840
CVE-2021-23133 CVE-2021-22925 CVE-2021-22898
CVE-2021-22876 CVE-2021-20284 CVE-2021-20266
CVE-2021-20239 CVE-2021-20232 CVE-2021-20231
CVE-2021-20197 CVE-2021-20194 CVE-2021-3800
CVE-2021-3796 CVE-2021-3778 CVE-2021-3732
CVE-2021-3679 CVE-2021-3659 CVE-2021-3635
CVE-2021-3600 CVE-2021-3580 CVE-2021-3573
CVE-2021-3572 CVE-2021-3564 CVE-2021-3489
CVE-2021-3487 CVE-2021-3481 CVE-2021-3445
CVE-2021-3426 CVE-2021-3348 CVE-2021-3200
CVE-2021-0129 CVE-2020-36386 CVE-2020-36332
CVE-2020-36331 CVE-2020-36330 CVE-2020-36312
CVE-2020-36158 CVE-2020-35524 CVE-2020-35523
CVE-2020-35522 CVE-2020-35521 CVE-2020-35448
CVE-2020-29660 CVE-2020-29368 CVE-2020-27777
CVE-2020-26147 CVE-2020-26146 CVE-2020-26145
CVE-2020-26144 CVE-2020-26143 CVE-2020-26141
CVE-2020-26140 CVE-2020-26139 CVE-2020-24588
CVE-2020-24587 CVE-2020-24586 CVE-2020-24504
CVE-2020-24503 CVE-2020-24502 CVE-2020-24370
CVE-2020-17541 CVE-2020-16135 CVE-2020-14155
CVE-2020-14145 CVE-2020-13435 CVE-2020-12762
CVE-2020-10001 CVE-2020-0427 CVE-2019-20838
CVE-2019-19603 CVE-2019-18218 CVE-2019-17595
CVE-2019-17594 CVE-2019-14615 CVE-2019-13751
CVE-2019-13750 CVE-2019-5827 CVE-2018-25014
CVE-2018-25013 CVE-2018-25012 CVE-2018-25010
CVE-2018-25009 CVE-2018-20673
Reference: ASB-2020.0010
ESB-2021.3846
ESB-2021.3825
ESB-2021.3796
Original Bulletin:
https://access.redhat.com/errata/RHSA-2021:4627
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: Openshift Logging 5.3.0 bug fix and security update
Advisory ID: RHSA-2021:4627-01
Product: Red Hat OpenShift Enterprise
Advisory URL: https://access.redhat.com/errata/RHSA-2021:4627
Issue date: 2021-11-15
CVE Names: CVE-2018-20673 CVE-2018-25009 CVE-2018-25010
CVE-2018-25012 CVE-2018-25013 CVE-2018-25014
CVE-2019-5827 CVE-2019-13750 CVE-2019-13751
CVE-2019-14615 CVE-2019-17594 CVE-2019-17595
CVE-2019-18218 CVE-2019-19603 CVE-2019-20838
CVE-2020-0427 CVE-2020-10001 CVE-2020-12762
CVE-2020-13435 CVE-2020-14145 CVE-2020-14155
CVE-2020-16135 CVE-2020-17541 CVE-2020-24370
CVE-2020-24502 CVE-2020-24503 CVE-2020-24504
CVE-2020-24586 CVE-2020-24587 CVE-2020-24588
CVE-2020-26139 CVE-2020-26140 CVE-2020-26141
CVE-2020-26143 CVE-2020-26144 CVE-2020-26145
CVE-2020-26146 CVE-2020-26147 CVE-2020-27777
CVE-2020-29368 CVE-2020-29660 CVE-2020-35448
CVE-2020-35521 CVE-2020-35522 CVE-2020-35523
CVE-2020-35524 CVE-2020-36158 CVE-2020-36312
CVE-2020-36330 CVE-2020-36331 CVE-2020-36332
CVE-2020-36386 CVE-2021-0129 CVE-2021-3200
CVE-2021-3348 CVE-2021-3426 CVE-2021-3445
CVE-2021-3481 CVE-2021-3487 CVE-2021-3489
CVE-2021-3564 CVE-2021-3572 CVE-2021-3573
CVE-2021-3580 CVE-2021-3600 CVE-2021-3635
CVE-2021-3659 CVE-2021-3679 CVE-2021-3732
CVE-2021-3778 CVE-2021-3796 CVE-2021-3800
CVE-2021-20194 CVE-2021-20197 CVE-2021-20231
CVE-2021-20232 CVE-2021-20239 CVE-2021-20266
CVE-2021-20284 CVE-2021-22876 CVE-2021-22898
CVE-2021-22925 CVE-2021-23133 CVE-2021-23840
CVE-2021-23841 CVE-2021-27645 CVE-2021-28153
CVE-2021-28950 CVE-2021-28971 CVE-2021-29155
CVE-2021-29646 CVE-2021-29650 CVE-2021-31440
CVE-2021-31535 CVE-2021-31829 CVE-2021-31916
CVE-2021-33033 CVE-2021-33194 CVE-2021-33200
CVE-2021-33560 CVE-2021-33574 CVE-2021-35942
CVE-2021-36084 CVE-2021-36085 CVE-2021-36086
CVE-2021-36087 CVE-2021-42574
=====================================================================
1. Summary:
An update is now available for OpenShift Logging 5.3.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Description:
Openshift Logging Bug Fix Release (5.3.0)
Security Fix(es):
* golang: x/net/html: infinite loop in ParseFragment (CVE-2021-33194)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
3. Solution:
For OpenShift Container Platform 4.9 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this errata update:
https://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html
For Red Hat OpenShift Logging 5.3, see the following instructions to apply
this update:
https://docs.openshift.com/container-platform/4.7/logging/cluster-logging-upgrading.html
4. Bugs fixed (https://bugzilla.redhat.com/):
1963232 - CVE-2021-33194 golang: x/net/html: infinite loop in ParseFragment
5. JIRA issues fixed (https://issues.jboss.org/):
LOG-1168 - Disable hostname verification in syslog TLS settings
LOG-1235 - Using HTTPS without a secret does not translate into the correct 'scheme' value in Fluentd
LOG-1375 - ssl_ca_cert should be optional
LOG-1378 - CLO should support sasl_plaintext(Password over http)
LOG-1392 - In fluentd config, flush_interval can't be set with flush_mode=immediate
LOG-1494 - Syslog output is serializing json incorrectly
LOG-1555 - Fluentd logs emit transaction failed: error_class=NoMethodError while forwarding to external syslog server
LOG-1575 - Rejected by Elasticsearch and unexpected json-parsing
LOG-1735 - Regression introducing flush_at_shutdown
LOG-1774 - The collector logs should be excluded in fluent.conf
LOG-1776 - fluentd total_limit_size sets value beyond available space
LOG-1822 - OpenShift Alerting Rules Style-Guide Compliance
LOG-1859 - CLO Should not error and exit early on missing ca-bundle when cluster wide proxy is not enabled
LOG-1862 - Unsupported kafka parameters when enabled Kafka SASL
LOG-1903 - Fix the Display of ClusterLogging type in OLM
LOG-1911 - CLF API changes to Opt-in to multiline error detection
LOG-1918 - Alert `FluentdNodeDown` always firing
LOG-1939 - Opt-in multiline detection breaks cloudwatch forwarding
6. References:
https://access.redhat.com/security/cve/CVE-2018-20673
https://access.redhat.com/security/cve/CVE-2018-25009
https://access.redhat.com/security/cve/CVE-2018-25010
https://access.redhat.com/security/cve/CVE-2018-25012
https://access.redhat.com/security/cve/CVE-2018-25013
https://access.redhat.com/security/cve/CVE-2018-25014
https://access.redhat.com/security/cve/CVE-2019-5827
https://access.redhat.com/security/cve/CVE-2019-13750
https://access.redhat.com/security/cve/CVE-2019-13751
https://access.redhat.com/security/cve/CVE-2019-14615
https://access.redhat.com/security/cve/CVE-2019-17594
https://access.redhat.com/security/cve/CVE-2019-17595
https://access.redhat.com/security/cve/CVE-2019-18218
https://access.redhat.com/security/cve/CVE-2019-19603
https://access.redhat.com/security/cve/CVE-2019-20838
https://access.redhat.com/security/cve/CVE-2020-0427
https://access.redhat.com/security/cve/CVE-2020-10001
https://access.redhat.com/security/cve/CVE-2020-12762
https://access.redhat.com/security/cve/CVE-2020-13435
https://access.redhat.com/security/cve/CVE-2020-14145
https://access.redhat.com/security/cve/CVE-2020-14155
https://access.redhat.com/security/cve/CVE-2020-16135
https://access.redhat.com/security/cve/CVE-2020-17541
https://access.redhat.com/security/cve/CVE-2020-24370
https://access.redhat.com/security/cve/CVE-2020-24502
https://access.redhat.com/security/cve/CVE-2020-24503
https://access.redhat.com/security/cve/CVE-2020-24504
https://access.redhat.com/security/cve/CVE-2020-24586
https://access.redhat.com/security/cve/CVE-2020-24587
https://access.redhat.com/security/cve/CVE-2020-24588
https://access.redhat.com/security/cve/CVE-2020-26139
https://access.redhat.com/security/cve/CVE-2020-26140
https://access.redhat.com/security/cve/CVE-2020-26141
https://access.redhat.com/security/cve/CVE-2020-26143
https://access.redhat.com/security/cve/CVE-2020-26144
https://access.redhat.com/security/cve/CVE-2020-26145
https://access.redhat.com/security/cve/CVE-2020-26146
https://access.redhat.com/security/cve/CVE-2020-26147
https://access.redhat.com/security/cve/CVE-2020-27777
https://access.redhat.com/security/cve/CVE-2020-29368
https://access.redhat.com/security/cve/CVE-2020-29660
https://access.redhat.com/security/cve/CVE-2020-35448
https://access.redhat.com/security/cve/CVE-2020-35521
https://access.redhat.com/security/cve/CVE-2020-35522
https://access.redhat.com/security/cve/CVE-2020-35523
https://access.redhat.com/security/cve/CVE-2020-35524
https://access.redhat.com/security/cve/CVE-2020-36158
https://access.redhat.com/security/cve/CVE-2020-36312
https://access.redhat.com/security/cve/CVE-2020-36330
https://access.redhat.com/security/cve/CVE-2020-36331
https://access.redhat.com/security/cve/CVE-2020-36332
https://access.redhat.com/security/cve/CVE-2020-36386
https://access.redhat.com/security/cve/CVE-2021-0129
https://access.redhat.com/security/cve/CVE-2021-3200
https://access.redhat.com/security/cve/CVE-2021-3348
https://access.redhat.com/security/cve/CVE-2021-3426
https://access.redhat.com/security/cve/CVE-2021-3445
https://access.redhat.com/security/cve/CVE-2021-3481
https://access.redhat.com/security/cve/CVE-2021-3487
https://access.redhat.com/security/cve/CVE-2021-3489
https://access.redhat.com/security/cve/CVE-2021-3564
https://access.redhat.com/security/cve/CVE-2021-3572
https://access.redhat.com/security/cve/CVE-2021-3573
https://access.redhat.com/security/cve/CVE-2021-3580
https://access.redhat.com/security/cve/CVE-2021-3600
https://access.redhat.com/security/cve/CVE-2021-3635
https://access.redhat.com/security/cve/CVE-2021-3659
https://access.redhat.com/security/cve/CVE-2021-3679
https://access.redhat.com/security/cve/CVE-2021-3732
https://access.redhat.com/security/cve/CVE-2021-3778
https://access.redhat.com/security/cve/CVE-2021-3796
https://access.redhat.com/security/cve/CVE-2021-3800
https://access.redhat.com/security/cve/CVE-2021-20194
https://access.redhat.com/security/cve/CVE-2021-20197
https://access.redhat.com/security/cve/CVE-2021-20231
https://access.redhat.com/security/cve/CVE-2021-20232
https://access.redhat.com/security/cve/CVE-2021-20239
https://access.redhat.com/security/cve/CVE-2021-20266
https://access.redhat.com/security/cve/CVE-2021-20284
https://access.redhat.com/security/cve/CVE-2021-22876
https://access.redhat.com/security/cve/CVE-2021-22898
https://access.redhat.com/security/cve/CVE-2021-22925
https://access.redhat.com/security/cve/CVE-2021-23133
https://access.redhat.com/security/cve/CVE-2021-23840
https://access.redhat.com/security/cve/CVE-2021-23841
https://access.redhat.com/security/cve/CVE-2021-27645
https://access.redhat.com/security/cve/CVE-2021-28153
https://access.redhat.com/security/cve/CVE-2021-28950
https://access.redhat.com/security/cve/CVE-2021-28971
https://access.redhat.com/security/cve/CVE-2021-29155
https://access.redhat.com/security/cve/CVE-2021-29646
https://access.redhat.com/security/cve/CVE-2021-29650
https://access.redhat.com/security/cve/CVE-2021-31440
https://access.redhat.com/security/cve/CVE-2021-31535
https://access.redhat.com/security/cve/CVE-2021-31829
https://access.redhat.com/security/cve/CVE-2021-31916
https://access.redhat.com/security/cve/CVE-2021-33033
https://access.redhat.com/security/cve/CVE-2021-33194
https://access.redhat.com/security/cve/CVE-2021-33200
https://access.redhat.com/security/cve/CVE-2021-33560
https://access.redhat.com/security/cve/CVE-2021-33574
https://access.redhat.com/security/cve/CVE-2021-35942
https://access.redhat.com/security/cve/CVE-2021-36084
https://access.redhat.com/security/cve/CVE-2021-36085
https://access.redhat.com/security/cve/CVE-2021-36086
https://access.redhat.com/security/cve/CVE-2021-36087
https://access.redhat.com/security/cve/CVE-2021-42574
https://access.redhat.com/security/updates/classification/#moderate
7. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2021 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBYZJxoNzjgjWX9erEAQji2Q//bv8hVZq0D8Dz0Do5vdoPzpjDhM6wJr7U
3CqAqcxniXvHVbBiPHPsY3p3M62FSO5lg4oZnVfokEtrZmLe9ULZWLlNxVilAUCT
0urKKWCAIXF+QJcW9/KCuIfaMh8Mmvh2baq52azauCHCJ3UK9ontiGWqyUz/aq9F
TM4P/eehnUU1WXAz9x4ycHP7fHZBuADkI8WOUZ5M/QpcoEvo7rLFdyat5MpMkeJx
j7gGieb2ITvblxEML3LRdPljQxe56w7p2jC/EoXJnssjABozlWB936Ub/QSulGuz
+HQS+RnAGxRRpNcs1wNQzpIkCFJN2S0jlEj5VLB8xLbZTYtILWhIx4rlwaFy6NJn
/z7hpEfSAgmhPTejshI/2Gfu/sc+KStEJk2IasWO1wqQWRqYGVeLwgHxBt2wpX+I
XJUjhkAdhAWyDfEhPXzpbN4dhmDk0QiGfL3KWZ8nO54IFQgZHT1P1YArnI1hMWC7
JhTyj1DtFOKJl8X28wf6RNui+ifD12hmIAuQRuJTPjZbTnywwpMy+Sq9mrfeHztb
gPt2AqOPF5ksNB6OsjVKlMScLlLJzzlkBVgmurXaly0z2qLjy0Rl70oWeMOW4xUD
4Ravk3PLEMqSIHv0ECr4ku5ejMV1Rd46USrgVX2R0CALXIxPkk1IEN8hHmzIGz2D
HHJuAvrlroc=
=di1X
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYZNAeuNLKJtyKPYoAQhP2g//T6zwfRlRrLoCKilRd+eMJnhuVhWl+ziR
cVAPtBIRM7q237SFesyyc8VHGdsFTZQe0Qb+oUBtaX6jnJ/pBv3ydWNYbht8Rj7l
F7tFW8mgLFQo28EFz5cNo8RR39HbmT5gkKAXJ8mVj6e2noxydv9DLv0IgTopNZLQ
m7cOrdqO1Hq1bJPXfx1x9Mqzbx4AX5xC2ii9cKfziamzZACO8lIyQVN1d9zImihI
84PW2sHHFKgFjIhaoAzsxN3qpmE/CJ053R0xGMnZBk/XbgHIakEjt0Y7qAj+7zMj
OzptfA2xEKtpl7qJWeKsP2nqGJGB4Zz7jybrOCi2GkoOTixh9a0cmmV3nIEm065P
kkE3lKDE6xHwZQPBXl/rKLRAVdJ/UeG30tK4WmQqIYSPzLYAQQmdkqhfgvdfBC1O
lxxB2ISmEaV2loPdpR9PU41oEWp8KdkWBD6zTDVCacufChzx1eMGTHnj7O5nTEx5
lQeVeXEIutYK4SscAkWXiBP6GXU48hH5K5E8F8mOH6FZraE1I8rOu0hOtDTi+lhw
QDGGUXPkTA9s2DQFE37UVgIFhxzDHTJ4oGw05gIejl7rxAimHR7Zud+BMkFQV2y6
Sf5mIa2s1W1kTuy15EiHwCUVHx3kq8S9BN2fsWGA+2fvLcIYWBKyzHdr979nLerK
EYP4eVhrJ1Q=
=q34/
-----END PGP SIGNATURE-----