RHSA-2023:3998 - Security Advisory

Topic

An update is now available for Red Hat OpenShift Logging Subsystem 5.7.3

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Logging Subsystem 5.7.3 - Red Hat OpenShift

Security Fix(es):

• word-wrap: ReDoS (CVE-2023-26115)
• tough-cookie: prototype pollution in cookie memstore (CVE-2023-26136)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Logging Subsystem for Red Hat OpenShift for ARM 64 5 for RHEL 8 aarch64
• Logging Subsystem for Red Hat OpenShift 5 for RHEL 8 x86_64
• Logging Subsystem for Red Hat OpenShift for IBM Power, little endian 5 for RHEL 8 ppc64le
• Logging Subsystem for Red Hat OpenShift for IBM Z and LinuxONE 5 for RHEL 8 s390x

Fixes

• BZ - 2216827 - CVE-2023-26115 word-wrap: ReDoS
• BZ - 2219310 - CVE-2023-26136 tough-cookie: prototype pollution in cookie memstore
• LOG-4100 - [release-5.7] Browser keeps plugin files cached after upgrade
• LOG-4156 - [release-5.7] Degraded condition on LokiStack is reset even when it should persist
• LOG-4161 - [release-5.7] Ruler does not restart after updates to RulerConfig CR.
• LOG-4176 - [release-5.7 ]Vector in CrashLoopBackOff when using matchLabel containing special character /
• LOG-4198 - [release-5.7] Controller crashes when only per tenant limits are defined in LokiStack CR
• LOG-4258 - Fluentd fails when configured passphase sending to Elasticsearch
• LOG-4277 - [release-5.7] HTTP request header again too big, causing interaction with elasticsearch to fail
• LOG-4264 - [release-5.7] Update ose-kube-rbac-proxy to v4.10+
• LOG-4095 - loki labelKeys with slashes break in 5.7
• LOG-4177 - CLO pod crash if CLF is updated when CL in Unmanagment status
• LOG-4271 - [release-5.7] Fix kibana packaging in order for it to be properly scanned by prod sec
• LOG-4108 - [release-5.7] Custom time range is not getting updated on Aggregated Logs page
• LOG-3498 - Loki returning timed out after 30000ms

CVEs

• CVE-2020-24736
• CVE-2022-48281
• CVE-2023-1667
• CVE-2023-2283
• CVE-2023-24329
• CVE-2023-26115
• CVE-2023-26136
• CVE-2023-26604
• CVE-2023-28466

References

• https://access.redhat.com/security/updates/classification/#moderate