RHSA-2022:8781MediumCVSS 7.5

Red Hat Security Advisory: Logging Subsystem 5.5.5 - Red Hat OpenShift security update

Published
December 8, 2022
Last Modified
September 8, 2026

🔗 CVE IDs covered (9)

CVE-2020-36518 →CVE-2022-2879 →CVE-2022-37603 →CVE-2022-41715 →CVE-2022-42003 →CVE-2022-2880 →CVE-2022-27664 →CVE-2022-32189 →CVE-2022-42004 →

📋 Description

CVE-2020-36518 — jackson-databind: denial of service via a large depth of nested objects CVE-2022-2879 — golang: archive/tar: github.com/vbatts/tar-split: unbounded memory consumption when reading headers CVE-2022-2880 — golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters CVE-2022-27664 — golang: net/http: handle server errors after sending GOAWAY CVE-2022-32189 — golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service CVE-2022-37603 — loader-utils: Regular expression denial of service CVE-2022-41715 — golang: regexp/syntax: limit memory used by parsing regexps CVE-2022-42003 — jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS CVE-2022-42004 — jackson-databind: use of deeply nested arrays

🎯 Affected products64

  • RHOL 5.5 for RHEL 8
  • openshift-logging/cluster-logging-operator-bundle@sha256:4e6ada19c48d471db0513a1b5acba91ebecca42ce5127778b96a72d62af85289_amd64 as a component of RHOL 5.5 for RHEL 8
  • openshift-logging/cluster-logging-rhel8-operator@sha256:2ae6adcdc2e2a59937393d1dd5ed572d5e8952d9272090e640e86b6386e6f42d_amd64 as a component of RHOL 5.5 for RHEL 8
  • openshift-logging/cluster-logging-rhel8-operator@sha256:3fa3c169ba1dcf58b785c7962917980e8320f28821e1ae6887f69f8e2c44ff77_ppc64le as a component of RHOL 5.5 for RHEL 8
  • openshift-logging/cluster-logging-rhel8-operator@sha256:9bf3af645e3127501675b0403846d4d027c1a8158b764da91835c9d5d6e69c0e_s390x as a component of RHOL 5.5 for RHEL 8
  • openshift-logging/cluster-logging-rhel8-operator@sha256:f47b434af92096809a41f272b64f823cf8f18dca6f5f3dd19eb893803a333704_arm64 as a component of RHOL 5.5 for RHEL 8
  • openshift-logging/elasticsearch-operator-bundle@sha256:b0cd76c8a40808f7bd958f3eb4419d8b83bf7fc7268928df206d112201b8f02b_amd64 as a component of RHOL 5.5 for RHEL 8
  • openshift-logging/elasticsearch-proxy-rhel8@sha256:2ea3f735c85dbc5ff61b06b7ce153624b479d8e6e5db02e39313d077f30ba1a8_ppc64le as a component of RHOL 5.5 for RHEL 8
  • openshift-logging/elasticsearch-proxy-rhel8@sha256:607c9da7d689b47d2dd03450e76c4ba4ebfad0b40918aafdc292f3d88324478c_amd64 as a component of RHOL 5.5 for RHEL 8
  • openshift-logging/elasticsearch-proxy-rhel8@sha256:a675a1e5e41af683b4840bac10ddc25802120c9357deb63996b478883b522f36_s390x as a component of RHOL 5.5 for RHEL 8
  • openshift-logging/elasticsearch-proxy-rhel8@sha256:fbd0c9e9f950fe7a86fbca643fb2b445dad6e6af3f6acc703c183ff23ad1f7bd_arm64 as a component of RHOL 5.5 for RHEL 8
  • openshift-logging/elasticsearch-rhel8-operator@sha256:042fc4e4bfeba54937c3b18412bb0b63ae869d08d941ee489afee686e5cc5cab_arm64 as a component of RHOL 5.5 for RHEL 8
  • openshift-logging/elasticsearch-rhel8-operator@sha256:33468166442c5b2d1efe2ba95e45fd7c7be70a61ce47f600071dd2c94e0a5494_amd64 as a component of RHOL 5.5 for RHEL 8
  • openshift-logging/elasticsearch-rhel8-operator@sha256:acd5f97a99f44fbb171a49b39f18d5f3576256d1b499c2a45db97a3c7363fd22_ppc64le as a component of RHOL 5.5 for RHEL 8
  • openshift-logging/elasticsearch-rhel8-operator@sha256:efe8ac457c88dda976d3ff646fc9a22775aad65850b0461de23f59b4228c67fb_s390x as a component of RHOL 5.5 for RHEL 8
  • openshift-logging/elasticsearch6-rhel8@sha256:29386946cc140f739c2d0090636f23fdcc52842291e9d7afc6dabb22f96e18fa_amd64 as a component of RHOL 5.5 for RHEL 8
  • openshift-logging/elasticsearch6-rhel8@sha256:6533a980b85e6770fe1eaa0c01b066cd71e717f6b1693b0c6224d263302b8684_ppc64le as a component of RHOL 5.5 for RHEL 8
  • openshift-logging/elasticsearch6-rhel8@sha256:90eea1b6df3cd5eeaa5e7129ad301108be22595ef89d93c1360ba959ff887b61_arm64 as a component of RHOL 5.5 for RHEL 8
  • openshift-logging/elasticsearch6-rhel8@sha256:9a54c0ec2584201ac2b60e28a825f39d3e34ff0dff5a25dceec4c77181a11585_s390x as a component of RHOL 5.5 for RHEL 8
  • openshift-logging/eventrouter-rhel8@sha256:80e93cc593d29699e687c42e6ad7478b1edd9612394ac68717518896fbf3d59f_s390x as a component of RHOL 5.5 for RHEL 8
  • openshift-logging/eventrouter-rhel8@sha256:964653fa2debfd9d3182cfdc9d1c8e4e0af6b43ef17bce30461d6ad5550fabb8_amd64 as a component of RHOL 5.5 for RHEL 8
  • openshift-logging/eventrouter-rhel8@sha256:bdcf68cb4d7dbccfe2c7914f59b5dda2782c4f86d599be05b9b56d1be1a44c1c_ppc64le as a component of RHOL 5.5 for RHEL 8
  • openshift-logging/eventrouter-rhel8@sha256:ef7118853a0497269ee4886fc440f351d0874dd45e1736ef057a9e9c5c47b197_arm64 as a component of RHOL 5.5 for RHEL 8
  • openshift-logging/fluentd-rhel8@sha256:14d23de43f812da032cf4546429940537d3133e71655de62f062469b08953132_amd64 as a component of RHOL 5.5 for RHEL 8
  • openshift-logging/fluentd-rhel8@sha256:20d9d6c99a80454aaf3e57474057b23280c60a2cceeaf9797b62c771b2071f29_s390x as a component of RHOL 5.5 for RHEL 8
  • openshift-logging/fluentd-rhel8@sha256:850e19b4493a3c825cbe1237b5bb127ea6b9d3e9bdaa50aef85f89ddab7406b3_ppc64le as a component of RHOL 5.5 for RHEL 8
  • openshift-logging/fluentd-rhel8@sha256:dfd9d7724b966a5e985713432adb4637d385a271b35d0ef00c5551a73ec6da9a_arm64 as a component of RHOL 5.5 for RHEL 8
  • openshift-logging/kibana6-rhel8@sha256:d1d24e642ce99d02107657c75150182231ef199f23b8c2e378d430409932a4b0_s390x as a component of RHOL 5.5 for RHEL 8
  • openshift-logging/kibana6-rhel8@sha256:e0277f43b4f98df76de29e2c2e2777dcc4916fcad1623e16fe88efc9aa12359b_ppc64le as a component of RHOL 5.5 for RHEL 8
  • openshift-logging/kibana6-rhel8@sha256:f07eb3c5d5c022172251329bfe5c528c1400410117e4a5cfdc890a36bf1c0ef2_arm64 as a component of RHOL 5.5 for RHEL 8
  • +34 more not shown

✅ Remediation

For OpenShift Container Platform 4.11 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.openshift.com/container-platform/4.11/release_notes/ocp-4-11-release-notes.html For Red Hat OpenShift Logging 5.5, see the following instructions to apply this update: https://docs.openshift.com/container-platform/4.11/logging/cluster-logging-upgrading.html Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (22)