RedHat: RHSA-2023-4933:01 Moderate: Logging Subsystem 5.7.6 - Red Hat
Summary
Logging Subsystem 5.7.6 - Red Hat OpenShift
Security Fix(es):
* openshift-logging: LokiStack authorisation is cached too broadly
(CVE-2023-4456)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Summary
Solution
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
References
https://access.redhat.com/security/cve/CVE-2023-3899 https://access.redhat.com/security/cve/CVE-2023-4456 https://access.redhat.com/security/cve/CVE-2023-32360 https://access.redhat.com/security/cve/CVE-2023-34969 https://access.redhat.com/security/updates/classification/#moderate
Package List
Topic
Logging Subsystem 5.7.6 - Red Hat OpenShiftRed Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.
Topic
Relevant Releases Architectures
Bugs Fixed
2233087 - CVE-2023-4456 openshift-logging: LokiStack authorisation is cached too broadly
5. JIRA issues fixed (https://issues.redhat.com/):
LOG-4413 - Warning in Vector logs sending logs to Splunk
LOG-4456 - [release-5.7] Loki search does not allow special chars
LOG-4459 - [release-5.7] Search content disappears when link is copy pasted or shared with other user with opened with similar permissions on project.
LOG-4460 - Loki custom labelKeys is causing vector to enter CrashLoopBackOff state
LOG-4501 - Modify max_read_bytes for Vector not releasing deleted file handles
