RHSA-2022:0047LowCVSS 5.9

Red Hat Security Advisory: Red Hat OpenShift Enterprise Logging security and bug fix update (5.0.11)

Published
January 10, 2022
Last Modified
August 4, 2026

🔗 CVE IDs covered (1)

CVE-2021-45105 →

📋 Description

CVE-2021-45105 — log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

🎯 Affected products27

  • OpenShift Logging 5.0
  • openshift-logging/cluster-logging-operator-bundle@sha256:23c8329638c773b8945e1fb9c234e09a2897de4cb7e3a65f4fe5017e0a1ecf17_amd64 as a component of OpenShift Logging 5.0
  • openshift-logging/cluster-logging-rhel8-operator@sha256:77bc9ef6736b8cf62924bdb8c1e4a197376cb02a085d3f57d16d31253b621802_amd64 as a component of OpenShift Logging 5.0
  • openshift-logging/cluster-logging-rhel8-operator@sha256:b916970dea6c843a2de7cb0988a01798c7822620d2a6bad7fd7b1267779097fd_s390x as a component of OpenShift Logging 5.0
  • openshift-logging/cluster-logging-rhel8-operator@sha256:df770b43f7828f8b9b106a3fcd271af13952ef009e044be96f0d27381cd58d98_ppc64le as a component of OpenShift Logging 5.0
  • openshift-logging/elasticsearch-operator-bundle@sha256:ab6ac87c2c83ddf8a6a681ecfa79b545eea5e8a733a7876a6ee597fffda85c01_amd64 as a component of OpenShift Logging 5.0
  • openshift-logging/elasticsearch-proxy-rhel8@sha256:4dcdfdb34ef7eea805d4a56e2bade62c1b66de9872155c9db08cbb5337294814_s390x as a component of OpenShift Logging 5.0
  • openshift-logging/elasticsearch-proxy-rhel8@sha256:780b25802496f4725473193b92bc22d2c11b7a165607f5ca38379c871767c4dc_amd64 as a component of OpenShift Logging 5.0
  • openshift-logging/elasticsearch-proxy-rhel8@sha256:e95dc630de08eb883625fd2e2b9bc1cc719651e63bee301884876416dde3661a_ppc64le as a component of OpenShift Logging 5.0
  • openshift-logging/elasticsearch-rhel8-operator@sha256:3df31930134ff0f9ec3f9f42b304f2c9cd92afdd7525159f4f21c3b84c00dab3_amd64 as a component of OpenShift Logging 5.0
  • openshift-logging/elasticsearch-rhel8-operator@sha256:92c60ffc66d3a573468508d6af77fe0db8fdeb22e7af16337bf90d6e02d873b3_ppc64le as a component of OpenShift Logging 5.0
  • openshift-logging/elasticsearch-rhel8-operator@sha256:ff9d037857d189dbdf52ec325156873fa041205c62808574a36702c643676076_s390x as a component of OpenShift Logging 5.0
  • openshift-logging/elasticsearch6-rhel8@sha256:000b9988602eae29b14b0dfe62b5da73ded51fcd2dd634c6436b23bceb3e4bb5_amd64 as a component of OpenShift Logging 5.0
  • openshift-logging/elasticsearch6-rhel8@sha256:339b7a228a8cd1e15498a6081332ec0af20913f488afa521e5134bf78f6eb6f3_s390x as a component of OpenShift Logging 5.0
  • openshift-logging/elasticsearch6-rhel8@sha256:7aca3211b51bcddcfb1e821fa45db1f05ef466e225ccc9b56ae5ebc9ab10ad8d_ppc64le as a component of OpenShift Logging 5.0
  • openshift-logging/eventrouter-rhel8@sha256:1836cf2b97a94f13fcb141e3087139774f225aca0cefea5d8e467bbf4d5d5ccc_ppc64le as a component of OpenShift Logging 5.0
  • openshift-logging/eventrouter-rhel8@sha256:6728124547e2017d7422a878c088aaeae249b5de184131ef3ffbeaf908cb5ee3_s390x as a component of OpenShift Logging 5.0
  • openshift-logging/eventrouter-rhel8@sha256:d4012ebb0bc75b8e0fa77344305dc8220226a9be2d4ca2dec31027e29dda3b42_amd64 as a component of OpenShift Logging 5.0
  • openshift-logging/fluentd-rhel8@sha256:2ecc31383fe12b21cb9d0796e730349c742f2b319c0228e2dee0e10db48f898f_s390x as a component of OpenShift Logging 5.0
  • openshift-logging/fluentd-rhel8@sha256:9fd4d382bcf72196d206ccb1f08b03a7867345570e9d2586d6fe6930576db2db_ppc64le as a component of OpenShift Logging 5.0
  • openshift-logging/fluentd-rhel8@sha256:c7d7cf86426c0941b770d68dbbd16f2b86abf2d2c16a00230325488d088408fc_amd64 as a component of OpenShift Logging 5.0
  • openshift-logging/kibana6-rhel8@sha256:3f708d73d392064783cf79a19e7cdbf77cf8cbebd237b3e518603fdaa58623d9_ppc64le as a component of OpenShift Logging 5.0
  • openshift-logging/kibana6-rhel8@sha256:5e50138469b203f601eea4d6722f3bf96ed2078a368ebb827549d8ee70b72c39_amd64 as a component of OpenShift Logging 5.0
  • openshift-logging/kibana6-rhel8@sha256:faca27d01c6a8302605d4c9e47837961aba161dbf957b29becb5e72d17b1dfdc_s390x as a component of OpenShift Logging 5.0
  • openshift-logging/logging-curator5-rhel8@sha256:66b3dad7c0c3ce105321dbe919fc7c73a5230f7093fb21b309011c343984a081_s390x as a component of OpenShift Logging 5.0
  • openshift-logging/logging-curator5-rhel8@sha256:832fc72eb239f042e68efb088d4e3e866f8a8dd7c219f3fcb8a679324b953886_amd64 as a component of OpenShift Logging 5.0
  • openshift-logging/logging-curator5-rhel8@sha256:d95b8e5716afb53d25711900d2b840eb50f5603a91742f4d227e624c1e1d7b3d_ppc64le as a component of OpenShift Logging 5.0

✅ Remediation

For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html For Red Hat OpenShift Logging 5.0, see the following instructions to apply this update: https://docs.openshift.com/container-platform/4.7/logging/cluster-logging-upgrading.html Workaround: For Log4j 2 versions up to and including 2.16.0, this flaw can be mitigated by: - In PatternLayout in the Log4j logging configuration, replace Context Lookups like ${ctx:loginId} or $${ctx:loginId} with Thread Context Map patterns (%X, %mdc, or %MDC) like %X{loginId}. - Otherwise, in the Log4j logging configuration, remove references to Context Lookups like ${ctx:loginId} or $${ctx:loginId} where they originate from sources external to the application such as HTTP headers or user input.

🔗 References (5)