Red Hat Security Advisory

RHSA-2021:5137

Openshift Logging Security Release (5.0.10)

Released 2021-12-14 · Red Hat rating Moderate · View on Red Hat →

Fixed in

OpenShift Logging 5.0 openshift-logging/elasticsearch6-rhel8

Fixes 2 records

TI-2021-19919 CVE-2021-44228 · GHSA-jfh8-c2jp-5v3q

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

CRITICAL 100KEV

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other J…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.99999 Published 2021-12-10 Partial fix · 2.15.0, 2.3.1 +5 CWE-20

TI-2021-20393 CVE-2021-45046 · GHSA-7rjr-3q55-vv33

Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

CRITICAL 98KEV

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations.

CVSS 3.1CRITICAL 9.0 Network No auth No interaction EPSS 0.99977 Published 2021-12-14 Partial fix · 2.16.0, 2.12.2 +5 CWE-917