-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2021.3935
            Openshift Logging 5.2.3 bug fix and security update
                             18 November 2021

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Openshift Logging 5.2.3 bug fix and
Publisher:         Red Hat
Operating System:  Red Hat
Impact/Access:     Execute Arbitrary Code/Commands -- Remote/Unauthenticated
                   Denial of Service               -- Remote/Unauthenticated
                   Provide Misleading Information  -- Remote/Unauthenticated
                   Access Confidential Data        -- Remote/Unauthenticated
                   Reduced Security                -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2021-36087 CVE-2021-36086 CVE-2021-36085
                   CVE-2021-36084 CVE-2021-35942 CVE-2021-33574
                   CVE-2021-33560 CVE-2021-28153 CVE-2021-27645
                   CVE-2021-23841 CVE-2021-23840 CVE-2021-23383
                   CVE-2021-23369 CVE-2021-22925 CVE-2021-22898
                   CVE-2021-22876 CVE-2021-20266 CVE-2021-20232
                   CVE-2021-20231 CVE-2021-3800 CVE-2021-3796
                   CVE-2021-3778 CVE-2021-3580 CVE-2021-3572
                   CVE-2021-3445 CVE-2021-3426 CVE-2021-3200
                   CVE-2020-24370 CVE-2020-16135 CVE-2020-14155
                   CVE-2020-13435 CVE-2020-12762 CVE-2019-20838
                   CVE-2019-19603 CVE-2019-18218 CVE-2019-17595
                   CVE-2019-17594 CVE-2019-13751 CVE-2019-13750
                   CVE-2019-5827 CVE-2018-20673 

Reference:         ESB-2021.3933
                   ESB-2021.3905
                   ESB-2021.3864
                   ESB-2021.3846

Original Bulletin: 
   https://access.redhat.com/errata/RHSA-2021:4032

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Low: Openshift Logging 5.2.3 bug fix and security update
Advisory ID:       RHSA-2021:4032-01
Product:           Red Hat OpenShift Enterprise
Advisory URL:      https://access.redhat.com/errata/RHSA-2021:4032
Issue date:        2021-11-17
CVE Names:         CVE-2018-20673 CVE-2019-5827 CVE-2019-13750 
                   CVE-2019-13751 CVE-2019-17594 CVE-2019-17595 
                   CVE-2019-18218 CVE-2019-19603 CVE-2019-20838 
                   CVE-2020-12762 CVE-2020-13435 CVE-2020-14155 
                   CVE-2020-16135 CVE-2020-24370 CVE-2021-3200 
                   CVE-2021-3426 CVE-2021-3445 CVE-2021-3572 
                   CVE-2021-3580 CVE-2021-3778 CVE-2021-3796 
                   CVE-2021-3800 CVE-2021-20231 CVE-2021-20232 
                   CVE-2021-20266 CVE-2021-22876 CVE-2021-22898 
                   CVE-2021-22925 CVE-2021-23369 CVE-2021-23383 
                   CVE-2021-23840 CVE-2021-23841 CVE-2021-27645 
                   CVE-2021-28153 CVE-2021-33560 CVE-2021-33574 
                   CVE-2021-35942 CVE-2021-36084 CVE-2021-36085 
                   CVE-2021-36086 CVE-2021-36087 
=====================================================================

1. Summary:

An update is now available for OpenShift Logging 5.2.

Red Hat Product Security has rated this update as having a security impact
of Low. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Openshift Logging Bug Fix Release (5.2.3)

Security Fix(es):

* nodejs-handlebars: Remote code execution when compiling untrusted compile
templates with strict:true option (CVE-2021-23369)

* nodejs-handlebars: Remote code execution when compiling untrusted compile
templates with compat:true option (CVE-2021-23383)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

For OpenShift Container Platform 4.9 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this errata update:

https://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html

For Red Hat OpenShift Logging 5.2, see the following instructions to apply
this update:

https://docs.openshift.com/container-platform/4.9/logging/cluster-logging-upgrading.html

4. Bugs fixed (https://bugzilla.redhat.com/):

1948761 - CVE-2021-23369 nodejs-handlebars: Remote code execution when compiling untrusted compile templates with strict:true option
1956688 - CVE-2021-23383 nodejs-handlebars: Remote code execution when compiling untrusted compile templates with compat:true option

5. JIRA issues fixed (https://issues.jboss.org/):

LOG-1857 - OpenShift Alerting Rules Style-Guide Compliance
LOG-1904 - [release-5.2] Fix the Display of ClusterLogging type in OLM
LOG-1916 - [release-5.2] Fluentd logs emit transaction failed: error_class=NoMethodError while forwarding to external syslog server

6. References:

https://access.redhat.com/security/cve/CVE-2018-20673
https://access.redhat.com/security/cve/CVE-2019-5827
https://access.redhat.com/security/cve/CVE-2019-13750
https://access.redhat.com/security/cve/CVE-2019-13751
https://access.redhat.com/security/cve/CVE-2019-17594
https://access.redhat.com/security/cve/CVE-2019-17595
https://access.redhat.com/security/cve/CVE-2019-18218
https://access.redhat.com/security/cve/CVE-2019-19603
https://access.redhat.com/security/cve/CVE-2019-20838
https://access.redhat.com/security/cve/CVE-2020-12762
https://access.redhat.com/security/cve/CVE-2020-13435
https://access.redhat.com/security/cve/CVE-2020-14155
https://access.redhat.com/security/cve/CVE-2020-16135
https://access.redhat.com/security/cve/CVE-2020-24370
https://access.redhat.com/security/cve/CVE-2021-3200
https://access.redhat.com/security/cve/CVE-2021-3426
https://access.redhat.com/security/cve/CVE-2021-3445
https://access.redhat.com/security/cve/CVE-2021-3572
https://access.redhat.com/security/cve/CVE-2021-3580
https://access.redhat.com/security/cve/CVE-2021-3778
https://access.redhat.com/security/cve/CVE-2021-3796
https://access.redhat.com/security/cve/CVE-2021-3800
https://access.redhat.com/security/cve/CVE-2021-20231
https://access.redhat.com/security/cve/CVE-2021-20232
https://access.redhat.com/security/cve/CVE-2021-20266
https://access.redhat.com/security/cve/CVE-2021-22876
https://access.redhat.com/security/cve/CVE-2021-22898
https://access.redhat.com/security/cve/CVE-2021-22925
https://access.redhat.com/security/cve/CVE-2021-23369
https://access.redhat.com/security/cve/CVE-2021-23383
https://access.redhat.com/security/cve/CVE-2021-23840
https://access.redhat.com/security/cve/CVE-2021-23841
https://access.redhat.com/security/cve/CVE-2021-27645
https://access.redhat.com/security/cve/CVE-2021-28153
https://access.redhat.com/security/cve/CVE-2021-33560
https://access.redhat.com/security/cve/CVE-2021-33574
https://access.redhat.com/security/cve/CVE-2021-35942
https://access.redhat.com/security/cve/CVE-2021-36084
https://access.redhat.com/security/cve/CVE-2021-36085
https://access.redhat.com/security/cve/CVE-2021-36086
https://access.redhat.com/security/cve/CVE-2021-36087
https://access.redhat.com/security/updates/classification/#low

7. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYZTDyNzjgjWX9erEAQgQnA//b4dFtGy1GOXGRMJ9F7wmE9MRgo8X9jXd
iQyrWFv1d0/X/1rqplHl7Wc59W/n60YV5Bgfo1UnQgntmByhRjTEZwwLJmm3tBri
jlug7t6Kb0CCR926PYNpeCPC7OB8cEfA8GA6wwNr9tDWWxOWFjHM21wtsu2bWLZV
ar28GOj4dnnscvW9eyzHWcga3IKjsrYxRyfdTyTfsom6iEUip0iW0wEXbURJdNY9
gOWS0UH6D8d+RpUMmst3g6RHpcFMvTlYSN6NtbDYt2BzHYiSUY0Fp7ARqJNwKLPi
fNxBdbASf7CIxhDwEJJVdYNgygML3kG+SquMgPM0UJnDNRHn+Y8vA3Hup62h+xHg
OV4aA504J7kGQLycptPY/6qjH+5x9zzuPa08DInyUPlt3jFstbfy+GOTRKqpIaH/
JUh9T2XQcR5XYuGtol3LmqpneEUeHULKii+b5NmVfh2kMSthyVKNh7aOcCtKeqar
KERnF0w5DssiiySpjQOEga0r2vnLePIih3+BTGpHcFpUbWkXHKBfHSUMW3Ya2Odk
XZ6AjBNA8gBA3LmY1IVi7x0CtE/4QQ31zFXJUUZcP3gdWMCeCsshDC8PszLo1RXg
8Hnbalb4SJ+zugMcRABumyTuvP2FMnSpu6TssR+p7MFDgVeEhVy8b257wblm3nKD
0yOxNxL/6cQ=
=pXgY
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBYZWcSONLKJtyKPYoAQinWRAAhHbrKFqD5d2hxdD+D1Gsqp+ZC6bYvAc3
Vi0Wk4gh0cKdktjZQ1haRjY/9s42A05UTRgqKq2U5UAaMH2EQnj235f9BH2Hnxkx
vYEwtCnuOf0ycbVjUSsZvYHtsGxIt6qrMsTKObXQc+EXrrxUXHW7ZrUgMUkiagHN
tQcMXd3U8Bs9DskmNy85w8C+YjCiTglBoJ6lzBoX7IXlt/vI+Zpr6UsQadrucXcN
WOUaa2T/JGcwopNpUeFAOxTLmgjNPW6sr5NcOx7PO6rguNBXoPWrVIGZFoRmUDMH
DZ2Oplo4Kn5Vcx8ep6r3FndZwzgHMxgJX+BgLQDu/p+TLYoAx95gwDqzBYSqkMiS
K3dWSfrgFet+c5b7Piy1+49byH7EzZ3alf8OfM282Z4L5nh81KpyUOTMkwFpnU+U
sbqN2/Kyx3d3P7GzMU0glmJfAFXe9lR4MHEKePKfz/LSSi/fYZDeEfRM+WVx0ys3
TcoNSFv5IL7m/j071FhECE3JhGhFbh3OOqJ3uyPe8ipCLaJmHQblar+yTAzvEBny
OF/aPw1CsozMlUsjQ6rEFhKdirv7XLB3b+fytJBVA/cHcX/xiQCmTzIgRKaVyIe7
KkO7SXOKQrGPJmjBdRx2zcGHQqUZt6rSxJpp+ZCpiOmtDEotPNWoNU37AWhER3rd
M0SwQIBK52U=
=3Q02
-----END PGP SIGNATURE-----