RedHat: RHSA-2023-3495:01 Moderate: Logging Subsystem 5.7.2 - Red Hat
Summary
Logging Subsystem 5.7.2 - Red Hat OpenShift
Security Fix(es):
* net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK
decoding (CVE-2022-41723)
* rubygem-rack: denial of service in header parsing (CVE-2023-27539)
* rubygem-activesupport: Possible XSS in SafeBuffer#bytesplice
(CVE-2023-28120)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Summary
Solution
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
References
https://access.redhat.com/security/cve/CVE-2021-26341 https://access.redhat.com/security/cve/CVE-2021-33655 https://access.redhat.com/security/cve/CVE-2021-33656 https://access.redhat.com/security/cve/CVE-2022-1462 https://access.redhat.com/security/cve/CVE-2022-1679 https://access.redhat.com/security/cve/CVE-2022-1789 https://access.redhat.com/security/cve/CVE-2022-2196 https://access.redhat.com/security/cve/CVE-2022-2663 https://access.redhat.com/security/cve/CVE-2022-3028 https://access.redhat.com/security/cve/CVE-2022-3239 https://access.redhat.com/security/cve/CVE-2022-3522 https://access.redhat.com/security/cve/CVE-2022-3524 https://access.redhat.com/security/cve/CVE-2022-3564 https://access.redhat.com/security/cve/CVE-2022-3566 https://access.redhat.com/security/cve/CVE-2022-3567 https://access.redhat.com/security/cve/CVE-2022-3619 https://access.redhat.com/security/cve/CVE-2022-3623 https://access.redhat.com/security/cve/CVE-2022-3625 https://access.redhat.com/security/cve/CVE-2022-3627 https://access.redhat.com/security/cve/CVE-2022-3628 https://access.redhat.com/security/cve/CVE-2022-3707 https://access.redhat.com/security/cve/CVE-2022-3970 https://access.redhat.com/security/cve/CVE-2022-4129 https://access.redhat.com/security/cve/CVE-2022-20141 https://access.redhat.com/security/cve/CVE-2022-25147 https://access.redhat.com/security/cve/CVE-2022-25265 https://access.redhat.com/security/cve/CVE-2022-30594 https://access.redhat.com/security/cve/CVE-2022-36227 https://access.redhat.com/security/cve/CVE-2022-39188 https://access.redhat.com/security/cve/CVE-2022-39189 https://access.redhat.com/security/cve/CVE-2022-41218 https://access.redhat.com/security/cve/CVE-2022-41674 https://access.redhat.com/security/cve/CVE-2022-41723 https://access.redhat.com/security/cve/CVE-2022-42703 https://access.redhat.com/security/cve/CVE-2022-42720 https://access.redhat.com/security/cve/CVE-2022-42721 https://access.redhat.com/security/cve/CVE-2022-42722 https://access.redhat.com/security/cve/CVE-2022-43750 https://access.redhat.com/security/cve/CVE-2022-47929 https://access.redhat.com/security/cve/CVE-2023-0394 https://access.redhat.com/security/cve/CVE-2023-0461 https://access.redhat.com/security/cve/CVE-2023-1195 https://access.redhat.com/security/cve/CVE-2023-1582 https://access.redhat.com/security/cve/CVE-2023-2491 https://access.redhat.com/security/cve/CVE-2023-22490 https://access.redhat.com/security/cve/CVE-2023-23454 https://access.redhat.com/security/cve/CVE-2023-23946 https://access.redhat.com/security/cve/CVE-2023-25652 https://access.redhat.com/security/cve/CVE-2023-25815 https://access.redhat.com/security/cve/CVE-2023-27535 https://access.redhat.com/security/cve/CVE-2023-27539 https://access.redhat.com/security/cve/CVE-2023-28120 https://access.redhat.com/security/cve/CVE-2023-29007 https://access.redhat.com/security/updates/classification/#moderate
Package List
Topic
Logging Subsystem 5.7.2 - Red Hat OpenShiftRed Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.
Topic
Relevant Releases Architectures
Bugs Fixed
2178358 - CVE-2022-41723 net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding
2179637 - CVE-2023-28120 rubygem-activesupport: Possible XSS in SafeBuffer#bytesplice
2179649 - CVE-2023-27539 rubygem-rack: denial of service in header parsing
5. JIRA issues fixed (https://issues.redhat.com/):
LOG-3314 - [fluentd] The passphrase can not be enabled when forwarding logs to Kafka
LOG-3316 - openshift-logging namespace can not be deleted directly when use lokistack as default store.
LOG-3330 - run.sh shows incorrect chunk_limit_size if changed.
LOG-3445 - [vector to loki] validation is not disabled when tls.insecureSkipVerify=true
LOG-3749 - Unability to configure nodePlacement and toleration for logging-view-plugin
LOG-3784 - [fluentd http] the defaut value HTTP content type application/x-ndjson is unsupported on datadog
LOG-3827 - [fluentd http] The passphase isn't generated in fluent.conf
LOG-3878 - [vector] PHP multiline errors are collected line by line when detectMultilineErrors is enabled.
LOG-3945 - [Vector] Collector pods in CrashLoopBackOff when ClusterLogForwarder pipeline has space in between the pipeline name.
LOG-3997 - Add http to log_forwarder_output_info metrics
LOG-4011 - [Vector] Collector not complying with the custom tlsSecurityProfile configuration.
LOG-4019 - [release-5.7] fluentd multiline exception plugin fails to detect JS client exception
LOG-4049 - [release-5.7] User can list labels and label values for all user workload namespaces via Loki Label APIs
LOG-4052 - [release-5.7] Fix Loki timeouts querying logs from OCP Console
LOG-4098 - [release-5.7] No log_forwarder_output_info for splunk and google logging
LOG-4151 - Fluentd fix missing nil check for rotated_tw in update_watcher
LOG-4163 - [release-5.7] TLS configuration for multiple Kafka brokers is not created in Vector
LOG-4185 - Resources, tolerations and nodeSelector for the collector are missing
LOG-4218 - Vector fails to run when configuring syslog forwarding for audit log
LOG-4219 - Vector handles journal log as container log when enabling syslog forwarding. It breaks the compatibility with Fluentd
LOG-4220 - [RHOCP4.11] Logs of POD which doesn't have labels specified by structuredTypeKey are parsed to JSON, and forwarded to app-xxxxxx
LOG-4221 - [release-5.7] Fluentd wrongly closes a log file due to hash collision
