[RHSA-2021:4628-03] Low: Openshift Logging 5.1.4 bug fix and security update

[Security announcements for all Red Hat products and services.]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Low: Openshift Logging 5.1.4 bug fix and security update
Advisory ID:       RHSA-2021:4628-01
Product:           Red Hat OpenShift Enterprise
Advisory URL:      https://access.redhat.com/errata/RHSA-2021:4628
Issue date:        2021-11-17
CVE Names:         CVE-2020-36385 CVE-2021-0512 CVE-2021-3656 
                   CVE-2021-3733 CVE-2021-22946 CVE-2021-22947 
                   CVE-2021-23369 CVE-2021-23383 CVE-2021-33928 
                   CVE-2021-33929 CVE-2021-33930 CVE-2021-33938 
=====================================================================

1. Summary:

An update is now available for OpenShift Logging 5.1.4.

Red Hat Product Security has rated this update as having a security impact
of Low. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Openshift Logging Bug Fix Release (5.1.4)

Security Fix(es):

* nodejs-handlebars: Remote code execution when compiling untrusted compile
templates with strict:true option (CVE-2021-23369)

* nodejs-handlebars: Remote code execution when compiling untrusted compile
templates with compat:true option (CVE-2021-23383)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

For OpenShift Container Platform 4.8 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this errata update:

https://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html

For Red Hat OpenShift Logging 5.1, see the following instructions to apply
this update:

https://docs.openshift.com/container-platform/4.8/logging/cluster-logging-upgrading.html

4. Bugs fixed (https://bugzilla.redhat.com/):

1948761 - CVE-2021-23369 nodejs-handlebars: Remote code execution when compiling untrusted compile templates with strict:true option
1956688 - CVE-2021-23383 nodejs-handlebars: Remote code execution when compiling untrusted compile templates with compat:true option

5. JIRA issues fixed (https://issues.jboss.org/):

LOG-1858 - OpenShift Alerting Rules Style-Guide Compliance
LOG-1917 - [release-5.1] Fluentd logs emit transaction failed: error_class=NoMethodError while forwarding to external syslog server

6. References:

https://access.redhat.com/security/cve/CVE-2020-36385
https://access.redhat.com/security/cve/CVE-2021-0512
https://access.redhat.com/security/cve/CVE-2021-3656
https://access.redhat.com/security/cve/CVE-2021-3733
https://access.redhat.com/security/cve/CVE-2021-22946
https://access.redhat.com/security/cve/CVE-2021-22947
https://access.redhat.com/security/cve/CVE-2021-23369
https://access.redhat.com/security/cve/CVE-2021-23383
https://access.redhat.com/security/cve/CVE-2021-33928
https://access.redhat.com/security/cve/CVE-2021-33929
https://access.redhat.com/security/cve/CVE-2021-33930
https://access.redhat.com/security/cve/CVE-2021-33938
https://access.redhat.com/security/updates/classification/#low

7. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYZTDv9zjgjWX9erEAQhIQg//Rm96M/DJX3gfb3iZWuu92RqgI4+TXDa5
IzmpBOpZhlcE811g0uF+A9UPWVlwM0xU1ndm3LP1aYXrvtvMufEdkCobFysZPYMa
ITb2PFHkz+Tunk5zBelDJIzxZdP3//jc9zcsPcHvJpKQUsLZCz8VZYKIq+5zJ3UC
RJnWNknCZ1iCSAsQYzV8PplxCwxXSGv0RQpK2UEvi/KiL6nLMMdlm7X0wSU3PY0M
mrn24TKD8E+GUxo42X1eCFIFqA+nubp3tX2NT0Kd2f3dJc6sifMt36wr1hk1CpJK
grjxFFWxdTtsBpicn2SW8v7r1/f7BV/b+HZfO5FQV5c9J+XggPOWbVjQ9F3iUgmS
e3zt5AFMlfTqgKkqHGvQYQfgXNQmoTX2ZuLwtPDwP3NIj8iblVLorLoajE0cI/rr
192SkG0NfGuxfsoUxTtQM82vLQEw/VSeerWFYbtm4bPBTNzxtjenNQpjLjSmKo2h
GIzU/7ZdEGNxn4iilrZHiIGKuA+DVo9SjoV/gBmKrdLfB6rUI4lgec6iTi7dn9c+
KSJ15iq4LcMvkgRwbLMuVE8kcTGCODBeQt10f31ZYNeLAETfVc5t9WvgQ70ENnCX
l0wnvTk+pUt/4ayQw1SkuJYy4NAEbIUEKqfh+Zx5wTe41oqqcIOzOuM0XSNTnJIB
xlb1mParNrM=
=e9V4
-----END PGP SIGNATURE-----