RHSA-2023:7720 - Security Advisory

Topic

An update is now available for RHOL-5.8-RHEL-9.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Logging Subsystem 5.8.1- Red Hat OpenShift

Security Fix(es):

• rubygem-activesupport: File Disclosure of Locally Encrypted Files (CVE-2023-38037)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Logging Subsystem for Red Hat OpenShift for ARM 64 5 for RHEL 9 aarch64
• Logging Subsystem for Red Hat OpenShift 5 for RHEL 9 x86_64
• Logging Subsystem for Red Hat OpenShift for IBM Power, little endian 5 for RHEL 9 ppc64le
• Logging Subsystem for Red Hat OpenShift for IBM Z and LinuxONE 5 for RHEL 9 s390x

Fixes

• BZ - 2236261 - CVE-2023-38037 rubygem-activesupport: File Disclosure of Locally Encrypted Files
• LOG-4452 - Index management cronjobs are rolling over indices when parsing JSON is enabled and not expected
• LOG-4480 - Vector Incorrectly Assigns Some Logs with a Level of "default"
• LOG-4655 - No error in CLF when the filterRefs refers to a non-existing filter.
• LOG-4683 - Sometimes the normal users can not create index pattern before the first app index roll over
• LOG-4706 - Fluentd CrashLoopBackOff on IPv6 single stack and dual stack clusters
• LOG-4741 - cluster-logging-operator reconciling dozens of times with each ClusterLogForwarder change
• LOG-4768 - Logging 5.8.0 vector pods going into the CrashlLoopBackOff state on IBM Power
• LOG-4791 - Fluentd collector Pods no longer picks up the log collector SAs Secret as a fallback
• LOG-4811 - Fluentd is unable to forward logs to external ipv6 elasticsearch instance
• LOG-4815 - HttpReceiver requires Audit Permissions to be used
• LOG-4836 - [release-5.8] logging-loki-ruler pods are not injected with custom CA certificate defined in LokiStack CR
• LOG-4612 - Service/secret is not deleted when the inputs.receiver.http is removed
• LOG-4780 - Consume Cloudwatch web identity token that is not found at the well known SA path
• LOG-4821 - Bad output status formating
• LOG-4828 - [release-5.8] Operator - Add request duration metrics to the TSDB shipper implementation
• LOG-4841 - [release-5.8] Queries from Observe Logs containing ~= are mutated when modifying the time range
• LOG-4852 - Vector collector Pods no longer picks up the log collector SAs Secret as a fallback

CVEs

• CVE-2007-4559
• CVE-2021-3468
• CVE-2021-3502
• CVE-2021-3826
• CVE-2021-43618
• CVE-2022-3523
• CVE-2022-3565
• CVE-2022-3594
• CVE-2022-4285
• CVE-2022-38457
• CVE-2022-40133
• CVE-2022-40982
• CVE-2022-41862
• CVE-2022-42895
• CVE-2023-0597
• CVE-2023-1073
• CVE-2023-1074
• CVE-2023-1075
• CVE-2023-1076
• CVE-2023-1079
• CVE-2023-1206
• CVE-2023-1249
• CVE-2023-1252
• CVE-2023-1652
• CVE-2023-1855
• CVE-2023-1981
• CVE-2023-1989
• CVE-2023-2731
• CVE-2023-3138
• CVE-2023-3141
• CVE-2023-3161
• CVE-2023-3212
• CVE-2023-3268
• CVE-2023-3316
• CVE-2023-3358
• CVE-2023-3576
• CVE-2023-3609
• CVE-2023-3772
• CVE-2023-3773
• CVE-2023-4016
• CVE-2023-4128
• CVE-2023-4155
• CVE-2023-4194
• CVE-2023-4206
• CVE-2023-4207
• CVE-2023-4208
• CVE-2023-4273
• CVE-2023-4641
• CVE-2023-22745
• CVE-2023-26545
• CVE-2023-26965
• CVE-2023-26966
• CVE-2023-27522
• CVE-2023-29491
• CVE-2023-29499
• CVE-2023-30456
• CVE-2023-31486
• CVE-2023-32324
• CVE-2023-32573
• CVE-2023-32611
• CVE-2023-32665
• CVE-2023-33203
• CVE-2023-33285
• CVE-2023-33951
• CVE-2023-33952
• CVE-2023-34241
• CVE-2023-34410
• CVE-2023-35825
• CVE-2023-36054
• CVE-2023-37369
• CVE-2023-38037
• CVE-2023-38197
• CVE-2023-38545
• CVE-2023-38546
• CVE-2023-39191
• CVE-2023-39975
• CVE-2023-44487

References

• https://access.redhat.com/security/updates/classification/#low