RHSA-2021:5127: Moderate: Openshift Logging security and bug update (5.2.4)
Openshift Logging Security and Bug Fix Release (5.2.4)<br>Security Fix(es):<br><li> log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value (CVE-2021-44228)</li> <li> netty: Request smuggling via content-length header (CVE-2021-21409)</li> <li> netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data (CVE-2021-37136)</li> <li> netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way (CVE-2021-37137)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2021:5127?
The severity of RHSA-2021:5127 is critical due to the remote code execution vulnerability in Log4j.
How do I fix RHSA-2021:5127?
To fix RHSA-2021:5127, upgrade the affected OpenShift Logging components to the patched version provided in the release.
What vulnerabilities does RHSA-2021:5127 address?
RHSA-2021:5127 addresses vulnerabilities such as CVE-2021-44228 for Log4j and CVE-2021-21409 for Netty.
What software versions are affected by RHSA-2021:5127?
RHSA-2021:5127 affects specific versions of OpenShift Logging components that incorporate vulnerable versions of Log4j and Netty.
Is RHSA-2021:5127 part of a larger security issue?
Yes, RHSA-2021:5127 is part of broader security concerns related to the widely exploited Log4j vulnerability.