origin-aggregated-logging/elasticsearch: Incomplete fix for netty-codec-http CVE-2021-21409
Published Apr 11, 2022
5.9
MEDIUMCVSS 3.1
EPSS 1.18%
Description
A flaw was found in the original fix for the netty-codec-http CVE-2021-21409, where the OpenShift Logging openshift-logging/elasticsearch6-rhel8 container was incomplete. The vulnerable netty-codec-http maven package was not removed from the image content. This flaw affects origin-aggregated-logging versions 3.11.
Affected products
- Vendor n/a Product Origin-Aggregated-Logging/elasticsearch Defaultn/a
- Version origin-aggregated-logging versions 3.11StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| n/a | Origin-Aggregated-Logging/elasticsearch | n/a |
|
- 3.11
No data.
OpenShift Logging 5.1
openshift-logging/elasticsearch6-rhel8:v6.8.1-120
Fixed · RHSA-2022:0727
OpenShift Logging 5.2
openshift-logging/elasticsearch6-rhel8:v6.8.1-124
Fixed · RHSA-2022:0728
OpenShift Logging 5.3
openshift-logging/elasticsearch6-rhel8:v6.8.1-123
Fixed · RHSA-2022:0721
| Product | Package | State | Advisory |
|---|---|---|---|
| OpenShift Logging 5.1 | openshift-logging/elasticsearch6-rhel8:v6.8.1-120 | Fixed | RHSA-2022:0727 |
| OpenShift Logging 5.2 | openshift-logging/elasticsearch6-rhel8:v6.8.1-124 | Fixed | RHSA-2022:0728 |
| OpenShift Logging 5.3 | openshift-logging/elasticsearch6-rhel8:v6.8.1-123 | Fixed | RHSA-2022:0721 |
No package ranges for this CVE.
Remediation
Red Hat statement
This CVE only applies to the OpenShift Logging openshift-logging/elasticsearch6-rhel8 container image, shipped in OpenShift Logging 5.1, 5.2. and 5.3. https://access.redhat.com/errata/RHSA-2021:5128 https://access.redhat.com/errata/RHSA-2021:5127 https://access.redhat.com/errata/RHSA-2021:5129
References (7)
- https://access.redhat.com/security/cve/CVE-2021-21409 x_refsource_MISCVendor Advisory
- https://access.redhat.com/security/cve/CVE-2022-0552 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2052539 x_refsource_MISCIssue TrackingVendor Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-15674 Advisory
- https://github.com/openshift/origin-aggregated-logging/commit/d6b72d6c32e7c06b65324294d10406546734004d x_refsource_MISCPatchThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-0552
- https://www.cve.org/CVERecord?id=CVE-2022-0552
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2021-21409 | x_refsource_MISCVendor Advisory | |
| https://access.redhat.com/security/cve/CVE-2022-0552 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2052539 | x_refsource_MISCIssue TrackingVendor Advisory | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-15674 | Advisory | |
| https://github.com/openshift/origin-aggregated-logging/commit/d6b72d6c32e7c06b65324294d10406546734004d | x_refsource_MISCPatchThird Party Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2022-0552 | ||
| https://www.cve.org/CVERecord?id=CVE-2022-0552 |
Change history (0)
No recorded changes yet.