Bug 2052539 (CVE-2022-0552)

Summary:	CVE-2022-0552 origin-aggregated-logging/elasticsearch: Incomplete fix for netty-codec-http CVE-2021-21409
Product:	[Other] Security Response	Reporter:	Przemyslaw Roguski <proguski>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ewolinet, jcantril, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the original fix for the netty-codec-http CVE-2021-21409, where the OpenShift Logging openshift-logging/elasticsearch6-rhel8 container was incomplete. The vulnerable netty-codec-http maven package was not removed from the image content.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-03-03 06:19:34 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2052523, 2052715

Description Przemyslaw Roguski 2022-02-09 14:17:19 UTC

It was found that the original fix for netty-codec-http CVE-2021-21409 in the OpenShift Logging elasticsearch6 container was incomplete, as the vulnerable netty-codec-http maven package was not removed from the image content.

Comment 3 errata-xmlrpc 2022-03-01 14:05:40 UTC

This issue has been addressed in the following products:

  OpenShift Logging 5.3

Via RHSA-2022:0721 https://access.redhat.com/errata/RHSA-2022:0721

Comment 4 errata-xmlrpc 2022-03-01 18:16:07 UTC

This issue has been addressed in the following products:

  OpenShift Logging 5.1

Via RHSA-2022:0727 https://access.redhat.com/errata/RHSA-2022:0727

Comment 5 errata-xmlrpc 2022-03-02 12:49:58 UTC

This issue has been addressed in the following products:

  OpenShift Logging 5.2

Via RHSA-2022:0728 https://access.redhat.com/errata/RHSA-2022:0728

Comment 6 Product Security DevOps Team 2022-03-03 06:19:32 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-0552

Comment 7 Przemyslaw Roguski 2022-03-14 19:49:42 UTC

This vulnerability has been addressed by this upstream commits:
[https://github.com/ViaQ/elasticsearch/releases/tag/elasticsearch-oss-6.8.1.redhat-00019]
[https://github.com/ViaQ/security/releases/tag/opendistro_security-0.10.1.2-redhat-00009]
[https://github.com/openshift/origin-aggregated-logging/commit/d6b72d6c32e7c06b65324294d10406546734004d]