Red Hat Security Advisory

RHSA-2022:1461

Logging Subsystem 5.4 - Red Hat OpenShift Security and Bug update

Released 2022-04-20 · Red Hat rating Important · View on Red Hat →

Fixed in

RHOL 5.4 for RHEL 8 openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/fluentd-rhel8

Fixes 2 records

TI-2022-06074 CVE-2022-21698 · GHSA-cg3q-j54f-5p7p

Uncontrolled Resource Consumption in promhttp

MEDIUM 48

client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05994 Published 2022-02-15 Partial fix · 1.11.1 CWE-400

TI-2022-00670 CVE-2022-0759 · GHSA-69p3-xp37-f692

Improper certificate validation in kubeclient

LOW 37

A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00942 Published 2022-03-25 Partial fix · 4.9.3 CWE-295