RHSA-2021:1515HighCVSS 9.8

Red Hat Security Advisory: Openshift Logging Bug Fix Release (5.0.3)

Published
May 6, 2021
Last Modified
August 4, 2026

🔗 CVE IDs covered (26)

CVE-2018-19362 →CVE-2020-36188 →CVE-2018-14718 →CVE-2020-15586 →CVE-2020-24750 →CVE-2020-35491 →CVE-2020-36182 →CVE-2020-36184 →CVE-2020-36185 →CVE-2019-14379 →CVE-2020-16845 →CVE-2020-35490 →CVE-2020-36183 →CVE-2020-36186 →CVE-2020-36187 →CVE-2018-14720 →CVE-2020-36179 →CVE-2020-36180 →CVE-2020-36181 →CVE-2020-36189 →CVE-2021-20190 →CVE-2020-35728 →CVE-2018-14719 →CVE-2018-14721 →CVE-2018-19360 →CVE-2018-19361 →

📋 Description

CVE-2018-14718 — jackson-databind: arbitrary code execution in slf4j-ext class CVE-2018-14719 — jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes CVE-2018-14720 — jackson-databind: exfiltration/XXE in some JDK classes CVE-2018-14721 — jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class CVE-2018-19360 — jackson-databind: improper polymorphic deserialization in axis2-transport-jms class CVE-2018-19361 — jackson-databind: improper polymorphic deserialization in openjpa class CVE-2018-19362 — jackson-databind: improper polymorphic deserialization in jboss-common-core class CVE-2019-14379 — jackson-databind: default typing mishandling leading to remote code execution CVE-2020-15586 — golang: data race in certain net/http servers including ReverseProxy can lead to DoS CVE-2020-16845 — golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs CVE-2020-24750 — jackson-databind: Serialization gadgets in com.pastdev.httpcomponents.configuration.JndiConfiguration CVE-2020-35490 — jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource CVE-2020-35491 — jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource CVE-2020-35728 — jackson-databind: mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool CVE-2020-36179 — jackson-databind: mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS CVE-2020-36180 — jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS CVE-2020-36181 — jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS CVE-2020-36182 — jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS CVE-2020-36183 — jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool CVE-2020-36184 — jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource CVE-2020-36185 — jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource CVE-2020-36186 — jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource CVE-2020-36187 — jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource CVE-2020-36188 — jackson-databind: mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource CVE-2020-36189 — jackson-databind: mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource CVE-2021-20190 — jackson-databind: mishandles the interaction between serialization gadgets and typing, related to javax.swing

🎯 Affected products27

  • OpenShift Logging 5.0
  • openshift-logging/cluster-logging-operator-bundle@sha256:523e689589595cff9ee11393506309c00d23bf8fb945e1475aeeffea3d517897_amd64 as a component of OpenShift Logging 5.0
  • openshift-logging/cluster-logging-rhel8-operator@sha256:0b3edcd073a1f331c011ebcd4aaa8371f9114b78a48e590df450e1e9006404c3_ppc64le as a component of OpenShift Logging 5.0
  • openshift-logging/cluster-logging-rhel8-operator@sha256:c143f6d1ec4d3d9a917a99c65815752e24e93a5be212c8d41a7f945ffffa67cf_amd64 as a component of OpenShift Logging 5.0
  • openshift-logging/cluster-logging-rhel8-operator@sha256:f42594e7760bf45ccba9d0494391b07b355d147a8ccfae3db602bceb74d8e35f_s390x as a component of OpenShift Logging 5.0
  • openshift-logging/elasticsearch-operator-bundle@sha256:1a88af8ae614593144ab405214444d954aa97ba13baa6ccf3b3498b424f983df_amd64 as a component of OpenShift Logging 5.0
  • openshift-logging/elasticsearch-proxy-rhel8@sha256:667a65330c7ed33805c30896ff9fa979c1aeed8883eb31750af9802f6feb7034_s390x as a component of OpenShift Logging 5.0
  • openshift-logging/elasticsearch-proxy-rhel8@sha256:a78c13c0c3f17432dee6d22756d6656afffe33081a1db5fad0ab68798fb92580_amd64 as a component of OpenShift Logging 5.0
  • openshift-logging/elasticsearch-proxy-rhel8@sha256:b2359332ffb463d8af90bcc6871b0a5ff4e79ce82243ba89ace96e18e05964fa_ppc64le as a component of OpenShift Logging 5.0
  • openshift-logging/elasticsearch-rhel8-operator@sha256:0264dd99af5af4a7a30c2b5830e52980fc59d050cc940f191b32e09df284292a_ppc64le as a component of OpenShift Logging 5.0
  • openshift-logging/elasticsearch-rhel8-operator@sha256:0dc6a56baad15c9fa6d0669f6f59ba1c6b444ef75e5d2893fa4bdd970bdfe88b_s390x as a component of OpenShift Logging 5.0
  • openshift-logging/elasticsearch-rhel8-operator@sha256:af5c18868820a4d139ad9c7d6a1d0a78396d96deb455b00a918c7eaf2ffbaa8b_amd64 as a component of OpenShift Logging 5.0
  • openshift-logging/elasticsearch6-rhel8@sha256:30491b87e69ba242c3eacb607c71c13a9957962c0ae75d63fbb1f7aff12e268b_ppc64le as a component of OpenShift Logging 5.0
  • openshift-logging/elasticsearch6-rhel8@sha256:614d1860d95c7e9a84ee68bb507f9970d0af63a7df3e744bd5e5a08a2a617914_amd64 as a component of OpenShift Logging 5.0
  • openshift-logging/elasticsearch6-rhel8@sha256:9dbe9316331f9b7725f39d00dc2bc8433482750c8178066b002682894f92ed87_s390x as a component of OpenShift Logging 5.0
  • openshift-logging/eventrouter-rhel8@sha256:3b08518f62a113a06a16ca3bcccbc128703f34815d66162426daabfd9740b2c4_ppc64le as a component of OpenShift Logging 5.0
  • openshift-logging/eventrouter-rhel8@sha256:4e8a4d0bf152d8f50114d13ce51868506570825123b8df4eed426f524c01bde3_s390x as a component of OpenShift Logging 5.0
  • openshift-logging/eventrouter-rhel8@sha256:7a17b1b04fd0d9ae66ad0dfaacbf9bebe44f77449763cd82bd172551c8dd5906_amd64 as a component of OpenShift Logging 5.0
  • openshift-logging/fluentd-rhel8@sha256:508186184b17d924659ad9dcaa468cd4086bbe958b4dac1a6297e7cd4f88a418_amd64 as a component of OpenShift Logging 5.0
  • openshift-logging/fluentd-rhel8@sha256:c9d56d0bfd800bd72c990829b81676a261c288f783ab44788feffdaa00bd069c_s390x as a component of OpenShift Logging 5.0
  • openshift-logging/fluentd-rhel8@sha256:ea0fb56298089dfd6ea04c4933e6e15668fe422b60b521cf1388783797ac7852_ppc64le as a component of OpenShift Logging 5.0
  • openshift-logging/kibana6-rhel8@sha256:06f31605e19bd7f702e403b815b961f125d92466e208428547069b3712c7a20e_s390x as a component of OpenShift Logging 5.0
  • openshift-logging/kibana6-rhel8@sha256:6348d3a07a76aa6eb90d1689cdf67a45559e752aec70d06261596f09d7ebca4f_amd64 as a component of OpenShift Logging 5.0
  • openshift-logging/kibana6-rhel8@sha256:c140c1da34f8cb38864f92201ac8c9aa6981318d1bd4ebf87cea698fdb80a6d7_ppc64le as a component of OpenShift Logging 5.0
  • openshift-logging/logging-curator5-rhel8@sha256:7904a53e3117acf2baeae3911c6d1cdfb78964080bf5ff3ff5bff531ca6ef366_ppc64le as a component of OpenShift Logging 5.0
  • openshift-logging/logging-curator5-rhel8@sha256:adbab231c9403261c85b6e4ff2c81c0d19e206106df60fd1551c9e30cb2d83f7_s390x as a component of OpenShift Logging 5.0
  • openshift-logging/logging-curator5-rhel8@sha256:bb16d7f7ef2310afacf12a11808c3b792ed1f30929ef9a62ff9b094d3d8512cc_amd64 as a component of OpenShift Logging 5.0

✅ Remediation

For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html For Red Hat OpenShift Logging 5.0, see the following instructions to apply this update: https://docs.openshift.com/container-platform/4.7/logging/cluster-logging-upgrading.html Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS` Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS` Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible: * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS` * avoid com.pastdev.httpcomponents in the classpath Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible: * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS` * avoid org.apache.commons.dbcp2.datasources.PerUserPoolDataSource and org.apache.commons.dbcp2.datasources.SharedPoolDataSource in the classpath Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible: * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS` * avoid com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool in the classpath Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible: * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS` * avoid: oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS, org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS, org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS, org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS, org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool, org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource, org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource, org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource, org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource, com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource, com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource in the classpath Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible: * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS` * avoid javax.swing in the classpath

🔗 References (7)