CVE-2022-0552

Reference Links

• https://access.redhat.com/security/cve/CVE-2021-21409
• https://bugzilla.redhat.com/show_bug.cgi?id=2052539
• https://github.com/openshift/origin-aggregated-logging/commit/d6b72d6c32e7c06b65324294d10406546734004d
• https://access.redhat.com/errata/RHSA-2022:0721
• https://access.redhat.com/errata/RHSA-2022:0727
• https://access.redhat.com/errata/RHSA-2022:0728
• https://access.redhat.com/security/cve/cve-2022-0552
• https://github.com/ViaQ/elasticsearch/releases/tag/elasticsearch-oss-6.8.1.redhat-00019
• https://github.com/ViaQ/security/releases/tag/opendistro_security-0.10.1.2-redhat-00009
• https://www.cve.org/CVERecord?id=CVE-2022-0552 https://nvd.nist.gov/vuln/detail/CVE-2022-0552 https://access.redhat.com/security/cve/CVE-2021-21409

Parent vulnerabilities

(Appears in the following advisories)

• RHSA-2022:0727
• RHSA-2022:0728
• RHSA-2022:0721

Frequently Asked Questions

• What is the severity of CVE-2022-0552?

  CVE-2022-0552 has a medium severity rating due to the incomplete fix in the netty-codec-http package.

• How do I fix CVE-2022-0552?

  To fix CVE-2022-0552, ensure that the vulnerable netty-codec-http maven package is removed from your OpenShift Logging container.

• Which software is affected by CVE-2022-0552?

  CVE-2022-0552 affects the Red Hat Origin Aggregated Logging version 3.11.

• What is the nature of the flaw in CVE-2022-0552?

  The flaw in CVE-2022-0552 is due to the incomplete remediation of a previously reported issue in the netty-codec-http package.

• Is CVE-2022-0552 exploitable?

  CVE-2022-0552 may be exploitable under certain conditions due to the presence of the vulnerable version of the netty-codec-http package in the container.