Red Hat Security Advisory

RHSA-2022:6051

Logging Subsystem 5.5.0 - Red Hat OpenShift security update

Released 2022-08-18 · Red Hat rating Important · View on Red Hat →

Fixed in

RHOL 5.5 for RHEL 8 openshift-logging/cluster-logging-rhel8-operator, openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator +6

Fixes 4 records

TI-2022-06074 CVE-2022-21698 · GHSA-cg3q-j54f-5p7p

Uncontrolled Resource Consumption in promhttp

MEDIUM 48

client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05994 Published 2022-02-15 Partial fix · 1.11.1 CWE-400

TI-2021-16156 CVE-2021-38561 · GHSA-ppp9-7jff-5vj2

golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an…

MEDIUM 42

golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01484 Published 2022-12-26 Partial fix · 0.3.7 CWE-125

TI-2022-12767 CVE-2022-30631 · GHSA-r654-8j96-crqx

Stack exhaustion when reading certain archives in compress/gzip

LOW 37

Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compres…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02186 Published 2022-08-09 Partial fix · 1.17.12, 1.18.4 CWE-674

TI-2022-00670 CVE-2022-0759 · GHSA-69p3-xp37-f692

Improper certificate validation in kubeclient

LOW 37

A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00942 Published 2022-03-25 Partial fix · 4.9.3 CWE-295