Red Hat Security Advisory

RHSA-2022:8889

Openshift Logging 5.3.14 bug fix release and security update

Released 2022-12-08 · Red Hat rating Moderate · View on Red Hat →

Fixed in

OpenShift Logging 5.3 openshift-logging/elasticsearch-operator-bundle, openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator +1

Fixes 3 records

TI-2020-18753 CVE-2020-36518 · GHSA-57j2-w4cx-62h2

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of…

MEDIUM 47

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0486 Published 2022-03-11 Partial fix · 2.13.2.1, 2.12.6.1 CWE-787

TI-2022-20343 CVE-2022-42004 · GHSA-rgv9-q543-rqg4

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a…

MEDIUM 45

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03409 Published 2022-10-02 Partial fix · 2.12.7.1, 2.13.4 CWE-502

TI-2022-20342 CVE-2022-42003 · GHSA-jjjh-jjxp-wpff

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion…

LOW 39

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGL…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03409 Published 2022-10-02 Partial fix · 2.12.7.1, 2.13.4.2 CWE-502