[RHSA-2022:0236-04] Moderate: OpenShift Container Platform 3.11.570 security update

[Security announcements for all Red Hat products and services.]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: OpenShift Container Platform 3.11.570 security update
Advisory ID:       RHSA-2022:0236-01
Product:           Red Hat OpenShift Enterprise
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:0236
Issue date:        2022-01-25
CVE Names:         CVE-2020-25704 CVE-2020-36322 CVE-2021-42739 
                   CVE-2021-44832 
=====================================================================

1. Summary:

Red Hat OpenShift Container Platform release 3.11.570 is now available with
updates to packages and images that fix several bugs and add enhancements.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

Security Fix(es):

* log4j-core: remote code execution via JDBC Appender (CVE-2021-44832)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

For OpenShift Container Platform 3.11 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/3.11/upgrading/index.html

4. Bugs fixed (https://bugzilla.redhat.com/):

2035951 - CVE-2021-44832 log4j-core: remote code execution via JDBC Appender

5. References:

https://access.redhat.com/security/cve/CVE-2020-25704
https://access.redhat.com/security/cve/CVE-2020-36322
https://access.redhat.com/security/cve/CVE-2021-42739
https://access.redhat.com/security/cve/CVE-2021-44832
https://access.redhat.com/security/updates/classification/#moderate

6. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYfAw9dzjgjWX9erEAQgZHA//RQEUJDAIfwZ6j1vcnQ9M6aP3fP6Z7eZa
nspVXrjlCidRz2S1Fbwjq7+NvUtBCoRUj0pPDZPMXk+xNmyMBiwel4PQ3suVrMTt
zvwcsvdG5mOmr1dmHfcgOxcSkXJfPWLh4uh62Edx9JqmYQbatlMY5653AGJPu5Sz
BKsNefxAcjbVi7jYLfgxORPtRBRYy3i2a+bwOWIToN0o51Wmei/Jqg8czZ1/jAuy
RmbnWIPI65HKJcl+fwg1Ocq0hl6eEV7+dzRW3ak1nPwdS5+LtljDtxGxOFLuCbj5
l4eGLOd2Y0nTeQBviH+B9VS9pdMH0JaeZe4CP3PQ+vZv1YQG3YEEMOwImTKUb62s
qZ8sMk1gymuTRYp4wLoz4LJsca6tHgF3jikhpVNzjpvnPZxRcPRU5DmxcWLT8qeI
7XUyJtX2aNssIRfoySHh3O8qaTiUGAWsMbbIv/dETdKsnZj7uQgsYJ84TbSLk6px
Ld4fouFbvkZMCWgZ82bSFstsW5LzGQcTmbqwZzEMZkiTxYXRHV6HcuiCRAhpnt2e
x+EraztP2VOQAR+R13WzUTmfqVGIrpZUtiKrAGOAssSVazjUBfmyCqF8pyJJGlUz
FMfB/4niRTtizU3Lh5T0R8blRYY0bsPSRi3Ata3pqtTq8VcsWTWHlTSupR6zuRpL
lP+Yd3KmrNM=
=lsDj
-----END PGP SIGNATURE-----