Read the docs
Red Hat Security Advisory

RHSA-2021:5129

Openshift Logging security and bug update (5.3.1)

Released 2021-12-14 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 5 records

TI-2021-19919 CVE-2021-44228 · GHSA-jfh8-c2jp-5v3q

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

Priority CRITICAL 100KEV

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other J…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.99999 Published 2021-12-10 Partial fix · 2.15.0, 2.3.1 +5 CWE-20
TI-2021-15209 CVE-2021-37137 · GHSA-9vjp-v76f-g363

Uncontrolled resource consumption in Netty

Priority MEDIUM 48

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.06565 Published 2021-10-19 Partial fix · 4.1.68Final, 4.1.68.Final CWE-400
TI-2021-15208 CVE-2021-37136 · GHSA-grg4-wf29-r9vv

Uncontrolled resource consumption in Netty

Priority MEDIUM 48

The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05908 Published 2021-10-19 Partial fix · 4.1.68Final, 4.1.68.Final CWE-400