Read the docs
Red Hat Security Advisory

RHSA-2022:2217

Red Hat OpenShift Logging Security and Bug update Release 5.3.7

Released 2022-05-11 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 5 records

TI-2022-06074 CVE-2022-21698 · GHSA-cg3q-j54f-5p7p

Uncontrolled Resource Consumption in promhttp

Priority MEDIUM 48

client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05994 Published 2022-02-15 Partial fix · 1.11.1 CWE-400
TI-2021-15209 CVE-2021-37137 · GHSA-9vjp-v76f-g363

Uncontrolled resource consumption in Netty

Priority MEDIUM 48

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.06565 Published 2021-10-19 Partial fix · 4.1.68Final, 4.1.68.Final CWE-400
TI-2021-15208 CVE-2021-37136 · GHSA-grg4-wf29-r9vv

Uncontrolled resource consumption in Netty

Priority MEDIUM 48

The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05908 Published 2021-10-19 Partial fix · 4.1.68Final, 4.1.68.Final CWE-400
TI-2022-00670 CVE-2022-0759 · GHSA-69p3-xp37-f692

Improper certificate validation in kubeclient

Priority LOW 37

A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00942 Published 2022-03-25 Partial fix · 4.9.3 CWE-295