Headline
CVE-2022-0552: Update netty to 4.1.63 · openshift/origin-aggregated-logging@d6b72d6
A flaw was found in the original fix for the netty-codec-http CVE-2021-21409, where the OpenShift Logging openshift-logging/elasticsearch6-rhel8 container was incomplete. The vulnerable netty-codec-http maven package was not removed from the image content. This flaw affects origin-aggregated-logging versions 3.11.
@@ -21,7 +21,7 @@ ARG OPENSHIFT_CI
ENV ES_PATH_CONF=/etc/elasticsearch/ \
ES_HOME=/usr/share/elasticsearch \
ES_VER=6.8.1.redhat-00018 \
ES_VER=6.8.1.redhat-00019 \
HOME=/opt/app-root/src \
INSTANCE_RAM=512G \
JAVA_VER=11 \
@@ -30,7 +30,7 @@ ENV ES_PATH_CONF=/etc/elasticsearch/ \
NODE_QUORUM=1 \
PROMETHEUS_EXPORTER_VER=6.8.1.2-redhat-00001 \
INGEST_PLUGIN_VER=6.8.1.0-redhat-00003 \
OPENDISTRO_VER=0.10.1.2-redhat-00006 \
OPENDISTRO_VER=0.10.1.2-redhat-00009 \
PLUGIN_LOGLEVEL=INFO \
RECOVER_AFTER_NODES=1 \
RECOVER_EXPECTED_NODES=1 \