(RHSA-2022:6051) Important: Logging Subsystem 5.5.0 - Red Hat OpenShift security update

2022-08-1816:00:25

access.redhat.com

logging subsystem red hat openshift cve-2022-0759 cve-2022-30631 cve-2021-38561 cve-2022-21698 unix

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.123

Percentile

95.5%

JSON

Logging Subsystem 5.5.0 - Red Hat OpenShift

Security Fix(es):

kubeclient: kubeconfig parsing error can lead to MITM attacks (CVE-2022-0759)
golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
golang: out-of-bounds read in golang.org/x/text/language leads to DoS (CVE-2021-38561)
prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.