{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Data Grid is now available.\n \nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Data Grid is an in-memory, distributed, NoSQL datastore solution. It increases application response times and allows for dramatically improving performance while providing availability, reliability, and elastic scale.\n \nData Grid 8.2.3 replaces Data Grid 8.2.2 and includes bug fixes and enhancements. Find out more about Data Grid 8.2.3 in the Release Notes [3].\n\nSecurity Fix(es):\n\n* log4j-core: remote code execution via JDBC Appender (CVE-2021-44832)\n\n* log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228) (CVE-2021-45046)\n\n* log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern (CVE-2021-45105)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2022:0205",
        "url": "https://access.redhat.com/errata/RHSA-2022:0205"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches\u0026product=data.grid\u0026version=8.2",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches\u0026product=data.grid\u0026version=8.2"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_data_grid/8.2/html-single/red_hat_data_grid_8.2_release_notes/index",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_data_grid/8.2/html-single/red_hat_data_grid_8.2_release_notes/index"
      },
      {
        "category": "external",
        "summary": "2032580",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2032580"
      },
      {
        "category": "external",
        "summary": "2034067",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2034067"
      },
      {
        "category": "external",
        "summary": "2035951",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2035951"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0205.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Data Grid 8.2.3 security update",
    "tracking": {
      "current_release_date": "2026-05-29T20:04:06+00:00",
      "generator": {
        "date": "2026-05-29T20:04:06+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.1"
        }
      },
      "id": "RHSA-2022:0205",
      "initial_release_date": "2022-01-20T11:39:58+00:00",
      "revision_history": [
        {
          "date": "2022-01-20T11:39:58+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2022-01-20T11:39:58+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-29T20:04:06+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Data Grid 8.2.3",
                "product": {
                  "name": "Red Hat Data Grid 8.2.3",
                  "product_id": "Red Hat Data Grid 8.2.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_data_grid:8.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Data Grid"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-44832",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2021-12-28T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2035951"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j-core: remote code execution via JDBC Appender",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Log4j 1.x is not impacted by this vulnerability. Therefore versions of log4j shipped with Red Hat Enterprise Linux are NOT affected by this flaw.\n\nFor Elasticsearch, as shipped in OpenShift Container Platform and OpenShift Logging, access to the log4j2.properties configuration is limited only to the cluster administrators and exploitation requires cluster logging changes, what reduced the impact of this vulnerability significantly [0].\n\n[0] https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476#update-jan-6-5",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Data Grid 8.2.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-44832"
        },
        {
          "category": "external",
          "summary": "RHBZ#2035951",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2035951"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44832",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-44832"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44832",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44832"
        },
        {
          "category": "external",
          "summary": "https://issues.apache.org/jira/browse/LOG4J2-3293",
          "url": "https://issues.apache.org/jira/browse/LOG4J2-3293"
        }
      ],
      "release_date": "2021-12-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-01-20T11:39:58+00:00",
          "details": "To install this update, do the following:\n \n1. Download the Data Grid 8.2.3 server patch from the customer portal[\u00b2].\n2. Back up your existing Data Grid installation. You should back up databases, configuration files, and so on.\n3. Install the Data Grid 8.2.3 server patch. Refer to the 8.2.3 Release Notes[\u00b3] for patching instructions.\n4. Restart Data Grid to ensure the changes take effect.",
          "product_ids": [
            "Red Hat Data Grid 8.2.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0205"
        },
        {
          "category": "workaround",
          "details": "As per upstream:\n- In prior releases confirm that if the JDBC Appender is being used it is not configured to use any protocol other than Java.\n- Note that only the log4j-core JAR file is impacted by this vulnerability. Applications using only the log4j-api JAR file without the log4j-core JAR file are not impacted by this vulnerability.",
          "product_ids": [
            "Red Hat Data Grid 8.2.3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Data Grid 8.2.3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "log4j-core: remote code execution via JDBC Appender"
    },
    {
      "cve": "CVE-2021-45046",
      "cwe": {
        "id": "CWE-917",
        "name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
      },
      "discovery_date": "2021-12-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2032580"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Apache Log4j logging library in versions from 2.0.0 and before 2.16.0. A remote attacker with control over Thread Context Map (MDC) input data could craft malicious input using a JNDI Lookup pattern resulting in remote code execution (RCE) in a limited number of environments.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Although we have matched Apache\u0027s CVSS score, with the exception of the scope metric which will remain unaltered at \"unchanged\"; as we believe code execution would be at the permission levels of the running JVM and not exceeding that of the original CVE-2021-44228 flaw.\n \nWe have given this vulnerability an impact rating of Moderate, this is because of the unlikely nature of log4j lookup mapping values being derived from attacker controlled values. This is not the default configuration for end-applications using log4j 2.x and would require explicit action from a privileged user (a developer or administrator) to access the vulnerability. \nIn certain non-default configurations, it was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was insufficient.\n\nThis issue affects the log4j version between 2.0 and 2.15. Log4j 1.x is NOT impacted by this vulnerability. \n\nPrerequisites to exploit this flaw are :\n\n- A remotely accessible endpoint with any protocol (HTTP, TCP, etc) that allows an attacker to send arbitrary data,\n- A log statement in the endpoint that logs the attacker controlled data.\n- Log4j configuration file should be explicitly configured to use a non-default Pattern Layout with a Context Lookup eg. ($${ctx:loginId}) \n\nIn most cases, the mitigation suggested for CVE-2021-44228 (i.e. to set the system property `log4j2.noFormatMsgLookup` to `true) does NOT mitigate this specific vulnerability. \nLog4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default.\n\nFor Elasticsearch, as shipped in OpenShift 3.11, the \"log4j2.formatMsgNoLookups=true\" system property mitigation is sufficient as there are no included non-standard configurations that allow for exploitation:\n\nhttps://github.com/openshift/openshift-ansible/blob/release-3.11/roles/openshift_logging_elasticsearch/templates/log4j2.properties.j2\n\nhttps://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476\n\nFor CodeReady Studio the fix for this flaw is available on CodeReady Studio 12.21.3 and above versions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Data Grid 8.2.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-45046"
        },
        {
          "category": "external",
          "summary": "RHBZ#2032580",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2032580"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-45046",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-45046"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-45046",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45046"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/security/cve/CVE-2021-44228",
          "url": "https://access.redhat.com/security/cve/CVE-2021-44228"
        },
        {
          "category": "external",
          "summary": "https://logging.apache.org/log4j/2.x/security.html",
          "url": "https://logging.apache.org/log4j/2.x/security.html"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2021/12/14/4",
          "url": "https://www.openwall.com/lists/oss-security/2021/12/14/4"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "release_date": "2021-12-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-01-20T11:39:58+00:00",
          "details": "To install this update, do the following:\n \n1. Download the Data Grid 8.2.3 server patch from the customer portal[\u00b2].\n2. Back up your existing Data Grid installation. You should back up databases, configuration files, and so on.\n3. Install the Data Grid 8.2.3 server patch. Refer to the 8.2.3 Release Notes[\u00b3] for patching instructions.\n4. Restart Data Grid to ensure the changes take effect.",
          "product_ids": [
            "Red Hat Data Grid 8.2.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0205"
        },
        {
          "category": "workaround",
          "details": "For Log4j versions up to and including 2.15.0, this issue can be mitigated by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class).",
          "product_ids": [
            "Red Hat Data Grid 8.2.3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Data Grid 8.2.3"
          ]
        }
      ],
      "threats": [
        {
          "category": "exploit_status",
          "date": "2023-05-01T00:00:00+00:00",
          "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)"
    },
    {
      "cve": "CVE-2021-45105",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2021-12-19T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2034067"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Apache Log4j logging library 2.x. when the logging configuration uses a non-default Pattern Layout with a Context Lookup. Attackers with control over Thread Context Map (MDC) input data can craft malicious input data that contains a recursive lookup and can cause Denial of Service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has performed an analysis of this flaw and has classified the Attack Complexity(AC) as High because there are multiple factors involved which are beyond attacker\u0027s control:\n\n- The application has to use the logging configuration using a Context Map Lookup (for example, $${ctx:loginId}) which is a non-default Pattern Layout.\n- The application developer has to use the map org.apache.logging.log4j.ThreadContext in the application code and save at-least one key (for example, ThreadContext.put(\"loginId\", \"myId\");) in the ThreadContext map object.\n- Attackers must also know this saved key name in order to exploit this flaw.\n\nNote that saving keys in this map is a non-essential usage of log4j and just an optional feature provided. Refer to https://logging.apache.org/log4j/2.x/manual/lookups.html#ContextMapLookup to know more about the Context Map Lookup feature of Log4j.\n\nLog4j 1.x is not impacted by this vulnerability. Note that only the log4j-core JAR file is impacted by this vulnerability. Applications using ONLY the log4j-api JAR file without the log4j-core JAR file are NOT impacted by this vulnerability.\n\n\nDespite including a vulnerable version of Log4j 2.x, this vulnerability is not exploitable in Elasticsearch[0], as shipped in OpenShift Container Platform and OpenShift Logging. OpenShift 3.11 specifically does not contain any context lookups:\n\nhttps://github.com/openshift/openshift-ansible/blob/release-3.11/roles/openshift_logging_elasticsearch/templates/log4j2.properties.j2\n\nThis vulnerability is therefore rated Low for Elasticsearch in OpenShift Container Platform and OpenShift Logging.\n\n[0] https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476#update-december-18-4",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Data Grid 8.2.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-45105"
        },
        {
          "category": "external",
          "summary": "RHBZ#2034067",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2034067"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-45105",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-45105"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-45105",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45105"
        },
        {
          "category": "external",
          "summary": "https://issues.apache.org/jira/browse/LOG4J2-3230",
          "url": "https://issues.apache.org/jira/browse/LOG4J2-3230"
        },
        {
          "category": "external",
          "summary": "https://logging.apache.org/log4j/2.x/security.html",
          "url": "https://logging.apache.org/log4j/2.x/security.html"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2021/12/19/1",
          "url": "https://www.openwall.com/lists/oss-security/2021/12/19/1"
        }
      ],
      "release_date": "2021-12-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-01-20T11:39:58+00:00",
          "details": "To install this update, do the following:\n \n1. Download the Data Grid 8.2.3 server patch from the customer portal[\u00b2].\n2. Back up your existing Data Grid installation. You should back up databases, configuration files, and so on.\n3. Install the Data Grid 8.2.3 server patch. Refer to the 8.2.3 Release Notes[\u00b3] for patching instructions.\n4. Restart Data Grid to ensure the changes take effect.",
          "product_ids": [
            "Red Hat Data Grid 8.2.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0205"
        },
        {
          "category": "workaround",
          "details": "For Log4j 2 versions up to and including 2.16.0, this flaw can be mitigated by:\n- In PatternLayout in the Log4j logging configuration, replace Context Lookups like ${ctx:loginId} or $${ctx:loginId} with Thread Context Map patterns (%X, %mdc, or %MDC) like %X{loginId}.\n- Otherwise, in the Log4j logging configuration, remove references to Context Lookups like ${ctx:loginId} or $${ctx:loginId} where they originate from sources external to the application such as HTTP headers or user input.",
          "product_ids": [
            "Red Hat Data Grid 8.2.3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Data Grid 8.2.3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A security update is now available for Red Hat JBoss Enterprise Application Platform 7.4.\n\nRed Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime.\n\nThis asynchronous patch is a security update for Red Hat JBoss Enterprise Application Platform 7.4.\n\nSecurity Fix(es):\n\n* log4j-core: remote code execution via JDBC Appender (CVE-2021-44832)\n\n* log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228) (CVE-2021-45046)\n\n* log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern (CVE-2021-45105)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2022:0216",
        "url": "https://access.redhat.com/errata/RHSA-2022:0216"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#low",
        "url": "https://access.redhat.com/security/updates/classification/#low"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches\u0026product=appplatform\u0026version=7.4",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches\u0026product=appplatform\u0026version=7.4"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/vulnerabilities/RHSB-2021-009",
        "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2021-009"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/solutions/6577421",
        "url": "https://access.redhat.com/solutions/6577421"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/"
      },
      {
        "category": "external",
        "summary": "2032580",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2032580"
      },
      {
        "category": "external",
        "summary": "2034067",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2034067"
      },
      {
        "category": "external",
        "summary": "2035951",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2035951"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0216.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4 security update",
    "tracking": {
      "current_release_date": "2026-05-29T20:04:06+00:00",
      "generator": {
        "date": "2026-05-29T20:04:06+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.1"
        }
      },
      "id": "RHSA-2022:0216",
      "initial_release_date": "2022-01-20T16:00:06+00:00",
      "revision_history": [
        {
          "date": "2022-01-20T16:00:06+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-10-23T23:11:16+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-29T20:04:06+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 7",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 7",
                  "product_id": "Red Hat JBoss Enterprise Application Platform 7",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Enterprise Application Platform"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-44832",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2021-12-28T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2035951"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j-core: remote code execution via JDBC Appender",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Log4j 1.x is not impacted by this vulnerability. Therefore versions of log4j shipped with Red Hat Enterprise Linux are NOT affected by this flaw.\n\nFor Elasticsearch, as shipped in OpenShift Container Platform and OpenShift Logging, access to the log4j2.properties configuration is limited only to the cluster administrators and exploitation requires cluster logging changes, what reduced the impact of this vulnerability significantly [0].\n\n[0] https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476#update-jan-6-5",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-44832"
        },
        {
          "category": "external",
          "summary": "RHBZ#2035951",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2035951"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44832",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-44832"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44832",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44832"
        },
        {
          "category": "external",
          "summary": "https://issues.apache.org/jira/browse/LOG4J2-3293",
          "url": "https://issues.apache.org/jira/browse/LOG4J2-3293"
        }
      ],
      "release_date": "2021-12-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-01-20T16:00:06+00:00",
          "details": "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 7"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0216"
        },
        {
          "category": "workaround",
          "details": "As per upstream:\n- In prior releases confirm that if the JDBC Appender is being used it is not configured to use any protocol other than Java.\n- Note that only the log4j-core JAR file is impacted by this vulnerability. Applications using only the log4j-api JAR file without the log4j-core JAR file are not impacted by this vulnerability.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 7"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 7"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "log4j-core: remote code execution via JDBC Appender"
    },
    {
      "cve": "CVE-2021-45046",
      "cwe": {
        "id": "CWE-917",
        "name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
      },
      "discovery_date": "2021-12-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2032580"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Apache Log4j logging library in versions from 2.0.0 and before 2.16.0. A remote attacker with control over Thread Context Map (MDC) input data could craft malicious input using a JNDI Lookup pattern resulting in remote code execution (RCE) in a limited number of environments.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Although we have matched Apache\u0027s CVSS score, with the exception of the scope metric which will remain unaltered at \"unchanged\"; as we believe code execution would be at the permission levels of the running JVM and not exceeding that of the original CVE-2021-44228 flaw.\n \nWe have given this vulnerability an impact rating of Moderate, this is because of the unlikely nature of log4j lookup mapping values being derived from attacker controlled values. This is not the default configuration for end-applications using log4j 2.x and would require explicit action from a privileged user (a developer or administrator) to access the vulnerability. \nIn certain non-default configurations, it was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was insufficient.\n\nThis issue affects the log4j version between 2.0 and 2.15. Log4j 1.x is NOT impacted by this vulnerability. \n\nPrerequisites to exploit this flaw are :\n\n- A remotely accessible endpoint with any protocol (HTTP, TCP, etc) that allows an attacker to send arbitrary data,\n- A log statement in the endpoint that logs the attacker controlled data.\n- Log4j configuration file should be explicitly configured to use a non-default Pattern Layout with a Context Lookup eg. ($${ctx:loginId}) \n\nIn most cases, the mitigation suggested for CVE-2021-44228 (i.e. to set the system property `log4j2.noFormatMsgLookup` to `true) does NOT mitigate this specific vulnerability. \nLog4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default.\n\nFor Elasticsearch, as shipped in OpenShift 3.11, the \"log4j2.formatMsgNoLookups=true\" system property mitigation is sufficient as there are no included non-standard configurations that allow for exploitation:\n\nhttps://github.com/openshift/openshift-ansible/blob/release-3.11/roles/openshift_logging_elasticsearch/templates/log4j2.properties.j2\n\nhttps://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476\n\nFor CodeReady Studio the fix for this flaw is available on CodeReady Studio 12.21.3 and above versions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-45046"
        },
        {
          "category": "external",
          "summary": "RHBZ#2032580",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2032580"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-45046",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-45046"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-45046",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45046"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/security/cve/CVE-2021-44228",
          "url": "https://access.redhat.com/security/cve/CVE-2021-44228"
        },
        {
          "category": "external",
          "summary": "https://logging.apache.org/log4j/2.x/security.html",
          "url": "https://logging.apache.org/log4j/2.x/security.html"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2021/12/14/4",
          "url": "https://www.openwall.com/lists/oss-security/2021/12/14/4"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "release_date": "2021-12-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-01-20T16:00:06+00:00",
          "details": "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 7"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0216"
        },
        {
          "category": "workaround",
          "details": "For Log4j versions up to and including 2.15.0, this issue can be mitigated by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class).",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 7"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 7"
          ]
        }
      ],
      "threats": [
        {
          "category": "exploit_status",
          "date": "2023-05-01T00:00:00+00:00",
          "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)"
    },
    {
      "cve": "CVE-2021-45105",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2021-12-19T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2034067"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Apache Log4j logging library 2.x. when the logging configuration uses a non-default Pattern Layout with a Context Lookup. Attackers with control over Thread Context Map (MDC) input data can craft malicious input data that contains a recursive lookup and can cause Denial of Service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has performed an analysis of this flaw and has classified the Attack Complexity(AC) as High because there are multiple factors involved which are beyond attacker\u0027s control:\n\n- The application has to use the logging configuration using a Context Map Lookup (for example, $${ctx:loginId}) which is a non-default Pattern Layout.\n- The application developer has to use the map org.apache.logging.log4j.ThreadContext in the application code and save at-least one key (for example, ThreadContext.put(\"loginId\", \"myId\");) in the ThreadContext map object.\n- Attackers must also know this saved key name in order to exploit this flaw.\n\nNote that saving keys in this map is a non-essential usage of log4j and just an optional feature provided. Refer to https://logging.apache.org/log4j/2.x/manual/lookups.html#ContextMapLookup to know more about the Context Map Lookup feature of Log4j.\n\nLog4j 1.x is not impacted by this vulnerability. Note that only the log4j-core JAR file is impacted by this vulnerability. Applications using ONLY the log4j-api JAR file without the log4j-core JAR file are NOT impacted by this vulnerability.\n\n\nDespite including a vulnerable version of Log4j 2.x, this vulnerability is not exploitable in Elasticsearch[0], as shipped in OpenShift Container Platform and OpenShift Logging. OpenShift 3.11 specifically does not contain any context lookups:\n\nhttps://github.com/openshift/openshift-ansible/blob/release-3.11/roles/openshift_logging_elasticsearch/templates/log4j2.properties.j2\n\nThis vulnerability is therefore rated Low for Elasticsearch in OpenShift Container Platform and OpenShift Logging.\n\n[0] https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476#update-december-18-4",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-45105"
        },
        {
          "category": "external",
          "summary": "RHBZ#2034067",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2034067"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-45105",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-45105"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-45105",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45105"
        },
        {
          "category": "external",
          "summary": "https://issues.apache.org/jira/browse/LOG4J2-3230",
          "url": "https://issues.apache.org/jira/browse/LOG4J2-3230"
        },
        {
          "category": "external",
          "summary": "https://logging.apache.org/log4j/2.x/security.html",
          "url": "https://logging.apache.org/log4j/2.x/security.html"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2021/12/19/1",
          "url": "https://www.openwall.com/lists/oss-security/2021/12/19/1"
        }
      ],
      "release_date": "2021-12-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-01-20T16:00:06+00:00",
          "details": "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 7"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0216"
        },
        {
          "category": "workaround",
          "details": "For Log4j 2 versions up to and including 2.16.0, this flaw can be mitigated by:\n- In PatternLayout in the Log4j logging configuration, replace Context Lookups like ${ctx:loginId} or $${ctx:loginId} with Thread Context Map patterns (%X, %mdc, or %MDC) like %X{loginId}.\n- Otherwise, in the Log4j logging configuration, remove references to Context Lookups like ${ctx:loginId} or $${ctx:loginId} where they originate from sources external to the application such as HTTP headers or user input.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 7"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 7"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A security update to Red Hat Integration Camel Extensions for Quarkus 2.2 is now available. The purpose of this text-only errata is to inform you about the security issues fixed.\n\nRed Hat Product Security has rated this update as having an impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update of Red Hat Integration - Camel Extensions for Quarkus serves as a replacement for 2.2 GA and includes the following security Fix(es):\n\nSecurity Fix(es):\n\n* log4j-core: remote code execution via JDBC Appender (CVE-2021-44832)\n\n* log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228) (CVE-2021-45046)\n\n* log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern (CVE-2021-45105)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2022:0222",
        "url": "https://access.redhat.com/errata/RHSA-2022:0222"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=red.hat.integration\u0026version=2022-Q1",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=red.hat.integration\u0026version=2022-Q1"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_integration/2022.q1",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_integration/2022.q1"
      },
      {
        "category": "external",
        "summary": "2032580",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2032580"
      },
      {
        "category": "external",
        "summary": "2034067",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2034067"
      },
      {
        "category": "external",
        "summary": "2035951",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2035951"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0222.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Integration Camel Extensions for Quarkus 2.2 security update",
    "tracking": {
      "current_release_date": "2026-05-29T20:04:06+00:00",
      "generator": {
        "date": "2026-05-29T20:04:06+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.1"
        }
      },
      "id": "RHSA-2022:0222",
      "initial_release_date": "2022-01-20T18:54:26+00:00",
      "revision_history": [
        {
          "date": "2022-01-20T18:54:26+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2022-01-20T18:54:26+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-29T20:04:06+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Integration Camel Extensions for Quarkus 2.2",
                "product": {
                  "name": "Red Hat Integration Camel Extensions for Quarkus 2.2",
                  "product_id": "Red Hat Integration Camel Extensions for Quarkus 2.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:camel_quarkus:2.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Integration"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-44832",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2021-12-28T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2035951"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j-core: remote code execution via JDBC Appender",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Log4j 1.x is not impacted by this vulnerability. Therefore versions of log4j shipped with Red Hat Enterprise Linux are NOT affected by this flaw.\n\nFor Elasticsearch, as shipped in OpenShift Container Platform and OpenShift Logging, access to the log4j2.properties configuration is limited only to the cluster administrators and exploitation requires cluster logging changes, what reduced the impact of this vulnerability significantly [0].\n\n[0] https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476#update-jan-6-5",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Integration Camel Extensions for Quarkus 2.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-44832"
        },
        {
          "category": "external",
          "summary": "RHBZ#2035951",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2035951"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44832",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-44832"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44832",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44832"
        },
        {
          "category": "external",
          "summary": "https://issues.apache.org/jira/browse/LOG4J2-3293",
          "url": "https://issues.apache.org/jira/browse/LOG4J2-3293"
        }
      ],
      "release_date": "2021-12-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-01-20T18:54:26+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Integration Camel Extensions for Quarkus 2.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0222"
        },
        {
          "category": "workaround",
          "details": "As per upstream:\n- In prior releases confirm that if the JDBC Appender is being used it is not configured to use any protocol other than Java.\n- Note that only the log4j-core JAR file is impacted by this vulnerability. Applications using only the log4j-api JAR file without the log4j-core JAR file are not impacted by this vulnerability.",
          "product_ids": [
            "Red Hat Integration Camel Extensions for Quarkus 2.2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Integration Camel Extensions for Quarkus 2.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "log4j-core: remote code execution via JDBC Appender"
    },
    {
      "cve": "CVE-2021-45046",
      "cwe": {
        "id": "CWE-917",
        "name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
      },
      "discovery_date": "2021-12-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2032580"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Apache Log4j logging library in versions from 2.0.0 and before 2.16.0. A remote attacker with control over Thread Context Map (MDC) input data could craft malicious input using a JNDI Lookup pattern resulting in remote code execution (RCE) in a limited number of environments.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Although we have matched Apache\u0027s CVSS score, with the exception of the scope metric which will remain unaltered at \"unchanged\"; as we believe code execution would be at the permission levels of the running JVM and not exceeding that of the original CVE-2021-44228 flaw.\n \nWe have given this vulnerability an impact rating of Moderate, this is because of the unlikely nature of log4j lookup mapping values being derived from attacker controlled values. This is not the default configuration for end-applications using log4j 2.x and would require explicit action from a privileged user (a developer or administrator) to access the vulnerability. \nIn certain non-default configurations, it was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was insufficient.\n\nThis issue affects the log4j version between 2.0 and 2.15. Log4j 1.x is NOT impacted by this vulnerability. \n\nPrerequisites to exploit this flaw are :\n\n- A remotely accessible endpoint with any protocol (HTTP, TCP, etc) that allows an attacker to send arbitrary data,\n- A log statement in the endpoint that logs the attacker controlled data.\n- Log4j configuration file should be explicitly configured to use a non-default Pattern Layout with a Context Lookup eg. ($${ctx:loginId}) \n\nIn most cases, the mitigation suggested for CVE-2021-44228 (i.e. to set the system property `log4j2.noFormatMsgLookup` to `true) does NOT mitigate this specific vulnerability. \nLog4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default.\n\nFor Elasticsearch, as shipped in OpenShift 3.11, the \"log4j2.formatMsgNoLookups=true\" system property mitigation is sufficient as there are no included non-standard configurations that allow for exploitation:\n\nhttps://github.com/openshift/openshift-ansible/blob/release-3.11/roles/openshift_logging_elasticsearch/templates/log4j2.properties.j2\n\nhttps://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476\n\nFor CodeReady Studio the fix for this flaw is available on CodeReady Studio 12.21.3 and above versions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Integration Camel Extensions for Quarkus 2.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-45046"
        },
        {
          "category": "external",
          "summary": "RHBZ#2032580",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2032580"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-45046",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-45046"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-45046",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45046"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/security/cve/CVE-2021-44228",
          "url": "https://access.redhat.com/security/cve/CVE-2021-44228"
        },
        {
          "category": "external",
          "summary": "https://logging.apache.org/log4j/2.x/security.html",
          "url": "https://logging.apache.org/log4j/2.x/security.html"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2021/12/14/4",
          "url": "https://www.openwall.com/lists/oss-security/2021/12/14/4"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "release_date": "2021-12-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-01-20T18:54:26+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Integration Camel Extensions for Quarkus 2.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0222"
        },
        {
          "category": "workaround",
          "details": "For Log4j versions up to and including 2.15.0, this issue can be mitigated by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class).",
          "product_ids": [
            "Red Hat Integration Camel Extensions for Quarkus 2.2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Integration Camel Extensions for Quarkus 2.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "exploit_status",
          "date": "2023-05-01T00:00:00+00:00",
          "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)"
    },
    {
      "cve": "CVE-2021-45105",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2021-12-19T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2034067"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Apache Log4j logging library 2.x. when the logging configuration uses a non-default Pattern Layout with a Context Lookup. Attackers with control over Thread Context Map (MDC) input data can craft malicious input data that contains a recursive lookup and can cause Denial of Service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has performed an analysis of this flaw and has classified the Attack Complexity(AC) as High because there are multiple factors involved which are beyond attacker\u0027s control:\n\n- The application has to use the logging configuration using a Context Map Lookup (for example, $${ctx:loginId}) which is a non-default Pattern Layout.\n- The application developer has to use the map org.apache.logging.log4j.ThreadContext in the application code and save at-least one key (for example, ThreadContext.put(\"loginId\", \"myId\");) in the ThreadContext map object.\n- Attackers must also know this saved key name in order to exploit this flaw.\n\nNote that saving keys in this map is a non-essential usage of log4j and just an optional feature provided. Refer to https://logging.apache.org/log4j/2.x/manual/lookups.html#ContextMapLookup to know more about the Context Map Lookup feature of Log4j.\n\nLog4j 1.x is not impacted by this vulnerability. Note that only the log4j-core JAR file is impacted by this vulnerability. Applications using ONLY the log4j-api JAR file without the log4j-core JAR file are NOT impacted by this vulnerability.\n\n\nDespite including a vulnerable version of Log4j 2.x, this vulnerability is not exploitable in Elasticsearch[0], as shipped in OpenShift Container Platform and OpenShift Logging. OpenShift 3.11 specifically does not contain any context lookups:\n\nhttps://github.com/openshift/openshift-ansible/blob/release-3.11/roles/openshift_logging_elasticsearch/templates/log4j2.properties.j2\n\nThis vulnerability is therefore rated Low for Elasticsearch in OpenShift Container Platform and OpenShift Logging.\n\n[0] https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476#update-december-18-4",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Integration Camel Extensions for Quarkus 2.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-45105"
        },
        {
          "category": "external",
          "summary": "RHBZ#2034067",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2034067"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-45105",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-45105"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-45105",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45105"
        },
        {
          "category": "external",
          "summary": "https://issues.apache.org/jira/browse/LOG4J2-3230",
          "url": "https://issues.apache.org/jira/browse/LOG4J2-3230"
        },
        {
          "category": "external",
          "summary": "https://logging.apache.org/log4j/2.x/security.html",
          "url": "https://logging.apache.org/log4j/2.x/security.html"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2021/12/19/1",
          "url": "https://www.openwall.com/lists/oss-security/2021/12/19/1"
        }
      ],
      "release_date": "2021-12-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-01-20T18:54:26+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Integration Camel Extensions for Quarkus 2.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0222"
        },
        {
          "category": "workaround",
          "details": "For Log4j 2 versions up to and including 2.16.0, this flaw can be mitigated by:\n- In PatternLayout in the Log4j logging configuration, replace Context Lookups like ${ctx:loginId} or $${ctx:loginId} with Thread Context Map patterns (%X, %mdc, or %MDC) like %X{loginId}.\n- Otherwise, in the Log4j logging configuration, remove references to Context Lookups like ${ctx:loginId} or $${ctx:loginId} where they originate from sources external to the application such as HTTP headers or user input.",
          "product_ids": [
            "Red Hat Integration Camel Extensions for Quarkus 2.2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Integration Camel Extensions for Quarkus 2.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A minor version update (from 1.6.2 to 1.6.3) is now available for Red Hat Integration Camel K that includes bug fixes. The purpose of this text-only errata is to inform you about the security issues fixed in this release.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "A minor version update (from 1.6.2 to 1.6.3) is now available for Red Hat Camel K that includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n\n* log4j-core: remote code execution via JDBC Appender (CVE-2021-44832)\n\n* log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228) (CVE-2021-45046)\n\n* log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern (CVE-2021-45105)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2022:0223",
        "url": "https://access.redhat.com/errata/RHSA-2022:0223"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=red.hat.integration\u0026version=2022-Q1",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=red.hat.integration\u0026version=2022-Q1"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_integration/2022.q1",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_integration/2022.q1"
      },
      {
        "category": "external",
        "summary": "2032580",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2032580"
      },
      {
        "category": "external",
        "summary": "2034067",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2034067"
      },
      {
        "category": "external",
        "summary": "2035951",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2035951"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0223.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Integration Camel-K 1.6.3 release and security update",
    "tracking": {
      "current_release_date": "2026-05-29T20:04:06+00:00",
      "generator": {
        "date": "2026-05-29T20:04:06+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.1"
        }
      },
      "id": "RHSA-2022:0223",
      "initial_release_date": "2022-01-20T18:55:14+00:00",
      "revision_history": [
        {
          "date": "2022-01-20T18:55:14+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2022-01-20T18:55:14+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-29T20:04:06+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Integration Camel-K 1.6.3",
                "product": {
                  "name": "Red Hat Integration Camel-K 1.6.3",
                  "product_id": "Red Hat Integration Camel-K 1.6.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:integration:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Integration"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-44832",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2021-12-28T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2035951"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j-core: remote code execution via JDBC Appender",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Log4j 1.x is not impacted by this vulnerability. Therefore versions of log4j shipped with Red Hat Enterprise Linux are NOT affected by this flaw.\n\nFor Elasticsearch, as shipped in OpenShift Container Platform and OpenShift Logging, access to the log4j2.properties configuration is limited only to the cluster administrators and exploitation requires cluster logging changes, what reduced the impact of this vulnerability significantly [0].\n\n[0] https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476#update-jan-6-5",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Integration Camel-K 1.6.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-44832"
        },
        {
          "category": "external",
          "summary": "RHBZ#2035951",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2035951"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44832",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-44832"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44832",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44832"
        },
        {
          "category": "external",
          "summary": "https://issues.apache.org/jira/browse/LOG4J2-3293",
          "url": "https://issues.apache.org/jira/browse/LOG4J2-3293"
        }
      ],
      "release_date": "2021-12-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-01-20T18:55:14+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Integration Camel-K 1.6.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0223"
        },
        {
          "category": "workaround",
          "details": "As per upstream:\n- In prior releases confirm that if the JDBC Appender is being used it is not configured to use any protocol other than Java.\n- Note that only the log4j-core JAR file is impacted by this vulnerability. Applications using only the log4j-api JAR file without the log4j-core JAR file are not impacted by this vulnerability.",
          "product_ids": [
            "Red Hat Integration Camel-K 1.6.3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Integration Camel-K 1.6.3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "log4j-core: remote code execution via JDBC Appender"
    },
    {
      "cve": "CVE-2021-45046",
      "cwe": {
        "id": "CWE-917",
        "name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
      },
      "discovery_date": "2021-12-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2032580"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Apache Log4j logging library in versions from 2.0.0 and before 2.16.0. A remote attacker with control over Thread Context Map (MDC) input data could craft malicious input using a JNDI Lookup pattern resulting in remote code execution (RCE) in a limited number of environments.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Although we have matched Apache\u0027s CVSS score, with the exception of the scope metric which will remain unaltered at \"unchanged\"; as we believe code execution would be at the permission levels of the running JVM and not exceeding that of the original CVE-2021-44228 flaw.\n \nWe have given this vulnerability an impact rating of Moderate, this is because of the unlikely nature of log4j lookup mapping values being derived from attacker controlled values. This is not the default configuration for end-applications using log4j 2.x and would require explicit action from a privileged user (a developer or administrator) to access the vulnerability. \nIn certain non-default configurations, it was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was insufficient.\n\nThis issue affects the log4j version between 2.0 and 2.15. Log4j 1.x is NOT impacted by this vulnerability. \n\nPrerequisites to exploit this flaw are :\n\n- A remotely accessible endpoint with any protocol (HTTP, TCP, etc) that allows an attacker to send arbitrary data,\n- A log statement in the endpoint that logs the attacker controlled data.\n- Log4j configuration file should be explicitly configured to use a non-default Pattern Layout with a Context Lookup eg. ($${ctx:loginId}) \n\nIn most cases, the mitigation suggested for CVE-2021-44228 (i.e. to set the system property `log4j2.noFormatMsgLookup` to `true) does NOT mitigate this specific vulnerability. \nLog4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default.\n\nFor Elasticsearch, as shipped in OpenShift 3.11, the \"log4j2.formatMsgNoLookups=true\" system property mitigation is sufficient as there are no included non-standard configurations that allow for exploitation:\n\nhttps://github.com/openshift/openshift-ansible/blob/release-3.11/roles/openshift_logging_elasticsearch/templates/log4j2.properties.j2\n\nhttps://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476\n\nFor CodeReady Studio the fix for this flaw is available on CodeReady Studio 12.21.3 and above versions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Integration Camel-K 1.6.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-45046"
        },
        {
          "category": "external",
          "summary": "RHBZ#2032580",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2032580"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-45046",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-45046"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-45046",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45046"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/security/cve/CVE-2021-44228",
          "url": "https://access.redhat.com/security/cve/CVE-2021-44228"
        },
        {
          "category": "external",
          "summary": "https://logging.apache.org/log4j/2.x/security.html",
          "url": "https://logging.apache.org/log4j/2.x/security.html"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2021/12/14/4",
          "url": "https://www.openwall.com/lists/oss-security/2021/12/14/4"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "release_date": "2021-12-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-01-20T18:55:14+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Integration Camel-K 1.6.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0223"
        },
        {
          "category": "workaround",
          "details": "For Log4j versions up to and including 2.15.0, this issue can be mitigated by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class).",
          "product_ids": [
            "Red Hat Integration Camel-K 1.6.3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Integration Camel-K 1.6.3"
          ]
        }
      ],
      "threats": [
        {
          "category": "exploit_status",
          "date": "2023-05-01T00:00:00+00:00",
          "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)"
    },
    {
      "cve": "CVE-2021-45105",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2021-12-19T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2034067"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Apache Log4j logging library 2.x. when the logging configuration uses a non-default Pattern Layout with a Context Lookup. Attackers with control over Thread Context Map (MDC) input data can craft malicious input data that contains a recursive lookup and can cause Denial of Service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has performed an analysis of this flaw and has classified the Attack Complexity(AC) as High because there are multiple factors involved which are beyond attacker\u0027s control:\n\n- The application has to use the logging configuration using a Context Map Lookup (for example, $${ctx:loginId}) which is a non-default Pattern Layout.\n- The application developer has to use the map org.apache.logging.log4j.ThreadContext in the application code and save at-least one key (for example, ThreadContext.put(\"loginId\", \"myId\");) in the ThreadContext map object.\n- Attackers must also know this saved key name in order to exploit this flaw.\n\nNote that saving keys in this map is a non-essential usage of log4j and just an optional feature provided. Refer to https://logging.apache.org/log4j/2.x/manual/lookups.html#ContextMapLookup to know more about the Context Map Lookup feature of Log4j.\n\nLog4j 1.x is not impacted by this vulnerability. Note that only the log4j-core JAR file is impacted by this vulnerability. Applications using ONLY the log4j-api JAR file without the log4j-core JAR file are NOT impacted by this vulnerability.\n\n\nDespite including a vulnerable version of Log4j 2.x, this vulnerability is not exploitable in Elasticsearch[0], as shipped in OpenShift Container Platform and OpenShift Logging. OpenShift 3.11 specifically does not contain any context lookups:\n\nhttps://github.com/openshift/openshift-ansible/blob/release-3.11/roles/openshift_logging_elasticsearch/templates/log4j2.properties.j2\n\nThis vulnerability is therefore rated Low for Elasticsearch in OpenShift Container Platform and OpenShift Logging.\n\n[0] https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476#update-december-18-4",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Integration Camel-K 1.6.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-45105"
        },
        {
          "category": "external",
          "summary": "RHBZ#2034067",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2034067"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-45105",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-45105"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-45105",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45105"
        },
        {
          "category": "external",
          "summary": "https://issues.apache.org/jira/browse/LOG4J2-3230",
          "url": "https://issues.apache.org/jira/browse/LOG4J2-3230"
        },
        {
          "category": "external",
          "summary": "https://logging.apache.org/log4j/2.x/security.html",
          "url": "https://logging.apache.org/log4j/2.x/security.html"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2021/12/19/1",
          "url": "https://www.openwall.com/lists/oss-security/2021/12/19/1"
        }
      ],
      "release_date": "2021-12-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-01-20T18:55:14+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Integration Camel-K 1.6.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0223"
        },
        {
          "category": "workaround",
          "details": "For Log4j 2 versions up to and including 2.16.0, this flaw can be mitigated by:\n- In PatternLayout in the Log4j logging configuration, replace Context Lookups like ${ctx:loginId} or $${ctx:loginId} with Thread Context Map patterns (%X, %mdc, or %MDC) like %X{loginId}.\n- Otherwise, in the Log4j logging configuration, remove references to Context Lookups like ${ctx:loginId} or $${ctx:loginId} where they originate from sources external to the application such as HTTP headers or user input.",
          "product_ids": [
            "Red Hat Integration Camel-K 1.6.3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Integration Camel-K 1.6.3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for OpenShift Logging (5.0.12)\n\nRed Hat Product Security has rated this update as having a security impact of\nModerate. A Common Vulnerability Scoring System (CVSS) base score, which gives\na detailed severity rating, is available for each vulnerability from the CVE\nlink(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Openshift Logging Bug Fix Release (5.0.12)\n\nSecurity Fix(es):\n\n* log4j-core: remote code execution via JDBC Appender (CVE-2021-44832)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2022:0225",
        "url": "https://access.redhat.com/errata/RHSA-2022:0225"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2035951",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2035951"
      },
      {
        "category": "external",
        "summary": "LOG-2089",
        "url": "https://issues.redhat.com/browse/LOG-2089"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0225.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat OpenShift Enterprise Logging bug fix and security update (5.0.12)",
    "tracking": {
      "current_release_date": "2026-05-29T20:04:09+00:00",
      "generator": {
        "date": "2026-05-29T20:04:09+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.1"
        }
      },
      "id": "RHSA-2022:0225",
      "initial_release_date": "2022-01-20T21:09:05+00:00",
      "revision_history": [
        {
          "date": "2022-01-20T21:09:05+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2022-01-20T21:09:06+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-29T20:04:09+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "OpenShift Logging 5.0",
                "product": {
                  "name": "OpenShift Logging 5.0",
                  "product_id": "8Base-OSE-LOGGING-5.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:logging:5.0::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Enterprise"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:989d85eee44074af63c6aea0f80a11c86338a32eed0db930feec87c7d08d5135_s390x",
                "product": {
                  "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:989d85eee44074af63c6aea0f80a11c86338a32eed0db930feec87c7d08d5135_s390x",
                  "product_id": "openshift-logging/cluster-logging-rhel8-operator@sha256:989d85eee44074af63c6aea0f80a11c86338a32eed0db930feec87c7d08d5135_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cluster-logging-rhel8-operator@sha256:989d85eee44074af63c6aea0f80a11c86338a32eed0db930feec87c7d08d5135?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel8-operator\u0026tag=v5.0.12-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:d9b8605f7d19097c5f0a91d678cc2f102af892878871880023fc41721b276ef7_s390x",
                "product": {
                  "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:d9b8605f7d19097c5f0a91d678cc2f102af892878871880023fc41721b276ef7_s390x",
                  "product_id": "openshift-logging/elasticsearch-rhel8-operator@sha256:d9b8605f7d19097c5f0a91d678cc2f102af892878871880023fc41721b276ef7_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-rhel8-operator@sha256:d9b8605f7d19097c5f0a91d678cc2f102af892878871880023fc41721b276ef7?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-rhel8-operator\u0026tag=v5.0.12-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:dba9c39a48e4f4a93db4daa1d596a08fc60c8c55c6b7889a7b69be241c7cd119_s390x",
                "product": {
                  "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:dba9c39a48e4f4a93db4daa1d596a08fc60c8c55c6b7889a7b69be241c7cd119_s390x",
                  "product_id": "openshift-logging/elasticsearch-proxy-rhel8@sha256:dba9c39a48e4f4a93db4daa1d596a08fc60c8c55c6b7889a7b69be241c7cd119_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-proxy-rhel8@sha256:dba9c39a48e4f4a93db4daa1d596a08fc60c8c55c6b7889a7b69be241c7cd119?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-proxy-rhel8\u0026tag=v5.0.12-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/logging-curator5-rhel8@sha256:f561d39b3e7249000f22471454d04323d529217842e293d0bc10af30acaa7ad8_s390x",
                "product": {
                  "name": "openshift-logging/logging-curator5-rhel8@sha256:f561d39b3e7249000f22471454d04323d529217842e293d0bc10af30acaa7ad8_s390x",
                  "product_id": "openshift-logging/logging-curator5-rhel8@sha256:f561d39b3e7249000f22471454d04323d529217842e293d0bc10af30acaa7ad8_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/logging-curator5-rhel8@sha256:f561d39b3e7249000f22471454d04323d529217842e293d0bc10af30acaa7ad8?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/logging-curator5-rhel8\u0026tag=v5.0.12-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch6-rhel8@sha256:5b6bd22611e78f26389183e0e3cc6f860eda122720909a3644f6edc7eae4e8da_s390x",
                "product": {
                  "name": "openshift-logging/elasticsearch6-rhel8@sha256:5b6bd22611e78f26389183e0e3cc6f860eda122720909a3644f6edc7eae4e8da_s390x",
                  "product_id": "openshift-logging/elasticsearch6-rhel8@sha256:5b6bd22611e78f26389183e0e3cc6f860eda122720909a3644f6edc7eae4e8da_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch6-rhel8@sha256:5b6bd22611e78f26389183e0e3cc6f860eda122720909a3644f6edc7eae4e8da?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch6-rhel8\u0026tag=v5.0.12-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/eventrouter-rhel8@sha256:b64462859b9229e261a14035b65ab702bd301fcba043254796c9bf28205e6d79_s390x",
                "product": {
                  "name": "openshift-logging/eventrouter-rhel8@sha256:b64462859b9229e261a14035b65ab702bd301fcba043254796c9bf28205e6d79_s390x",
                  "product_id": "openshift-logging/eventrouter-rhel8@sha256:b64462859b9229e261a14035b65ab702bd301fcba043254796c9bf28205e6d79_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/eventrouter-rhel8@sha256:b64462859b9229e261a14035b65ab702bd301fcba043254796c9bf28205e6d79?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel8\u0026tag=v5.0.12-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/fluentd-rhel8@sha256:a1fce6215b404d0107dc435c7f3458d7c3acc4f927ad177af43b18c9cadc1bb1_s390x",
                "product": {
                  "name": "openshift-logging/fluentd-rhel8@sha256:a1fce6215b404d0107dc435c7f3458d7c3acc4f927ad177af43b18c9cadc1bb1_s390x",
                  "product_id": "openshift-logging/fluentd-rhel8@sha256:a1fce6215b404d0107dc435c7f3458d7c3acc4f927ad177af43b18c9cadc1bb1_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/fluentd-rhel8@sha256:a1fce6215b404d0107dc435c7f3458d7c3acc4f927ad177af43b18c9cadc1bb1?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/fluentd-rhel8\u0026tag=v5.0.12-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/kibana6-rhel8@sha256:23a36e4ba3a8c26585c28a0fc1a947a2f35092fdc92631c9e242928556143374_s390x",
                "product": {
                  "name": "openshift-logging/kibana6-rhel8@sha256:23a36e4ba3a8c26585c28a0fc1a947a2f35092fdc92631c9e242928556143374_s390x",
                  "product_id": "openshift-logging/kibana6-rhel8@sha256:23a36e4ba3a8c26585c28a0fc1a947a2f35092fdc92631c9e242928556143374_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kibana6-rhel8@sha256:23a36e4ba3a8c26585c28a0fc1a947a2f35092fdc92631c9e242928556143374?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/kibana6-rhel8\u0026tag=v5.0.12-1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:6444d97d9ed0d5e07c8df5a9ae55cb431250c5432cec6e90ecaae0fbe00be6d5_ppc64le",
                "product": {
                  "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:6444d97d9ed0d5e07c8df5a9ae55cb431250c5432cec6e90ecaae0fbe00be6d5_ppc64le",
                  "product_id": "openshift-logging/cluster-logging-rhel8-operator@sha256:6444d97d9ed0d5e07c8df5a9ae55cb431250c5432cec6e90ecaae0fbe00be6d5_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cluster-logging-rhel8-operator@sha256:6444d97d9ed0d5e07c8df5a9ae55cb431250c5432cec6e90ecaae0fbe00be6d5?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel8-operator\u0026tag=v5.0.12-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:87a757926b3934d21632b830511ca077d9fdb12417fa8886fad85c10143a6842_ppc64le",
                "product": {
                  "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:87a757926b3934d21632b830511ca077d9fdb12417fa8886fad85c10143a6842_ppc64le",
                  "product_id": "openshift-logging/elasticsearch-rhel8-operator@sha256:87a757926b3934d21632b830511ca077d9fdb12417fa8886fad85c10143a6842_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-rhel8-operator@sha256:87a757926b3934d21632b830511ca077d9fdb12417fa8886fad85c10143a6842?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-rhel8-operator\u0026tag=v5.0.12-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:411a7dc6932d910e53aeb09320d25325ff4228930ae198cfe67d21404fa0e3ed_ppc64le",
                "product": {
                  "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:411a7dc6932d910e53aeb09320d25325ff4228930ae198cfe67d21404fa0e3ed_ppc64le",
                  "product_id": "openshift-logging/elasticsearch-proxy-rhel8@sha256:411a7dc6932d910e53aeb09320d25325ff4228930ae198cfe67d21404fa0e3ed_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-proxy-rhel8@sha256:411a7dc6932d910e53aeb09320d25325ff4228930ae198cfe67d21404fa0e3ed?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-proxy-rhel8\u0026tag=v5.0.12-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/logging-curator5-rhel8@sha256:76bb02283a7740fbc2f25fd95e0f0b30118a585296a62bcc745872ecdd93ba1e_ppc64le",
                "product": {
                  "name": "openshift-logging/logging-curator5-rhel8@sha256:76bb02283a7740fbc2f25fd95e0f0b30118a585296a62bcc745872ecdd93ba1e_ppc64le",
                  "product_id": "openshift-logging/logging-curator5-rhel8@sha256:76bb02283a7740fbc2f25fd95e0f0b30118a585296a62bcc745872ecdd93ba1e_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/logging-curator5-rhel8@sha256:76bb02283a7740fbc2f25fd95e0f0b30118a585296a62bcc745872ecdd93ba1e?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/logging-curator5-rhel8\u0026tag=v5.0.12-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch6-rhel8@sha256:c014b38a59a73f425c8ebd764148bad4956f24eda4670c42fd67826546df01be_ppc64le",
                "product": {
                  "name": "openshift-logging/elasticsearch6-rhel8@sha256:c014b38a59a73f425c8ebd764148bad4956f24eda4670c42fd67826546df01be_ppc64le",
                  "product_id": "openshift-logging/elasticsearch6-rhel8@sha256:c014b38a59a73f425c8ebd764148bad4956f24eda4670c42fd67826546df01be_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch6-rhel8@sha256:c014b38a59a73f425c8ebd764148bad4956f24eda4670c42fd67826546df01be?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch6-rhel8\u0026tag=v5.0.12-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/eventrouter-rhel8@sha256:4afc627224c584844325fac536c2e8f0b510fa4ff84b9b05bdafe2d8505f4eac_ppc64le",
                "product": {
                  "name": "openshift-logging/eventrouter-rhel8@sha256:4afc627224c584844325fac536c2e8f0b510fa4ff84b9b05bdafe2d8505f4eac_ppc64le",
                  "product_id": "openshift-logging/eventrouter-rhel8@sha256:4afc627224c584844325fac536c2e8f0b510fa4ff84b9b05bdafe2d8505f4eac_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/eventrouter-rhel8@sha256:4afc627224c584844325fac536c2e8f0b510fa4ff84b9b05bdafe2d8505f4eac?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel8\u0026tag=v5.0.12-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/fluentd-rhel8@sha256:70d1eeac2c53a0c77fdcf1ae305c12786227aa6e7f4f1f3ab4365a119111f1ea_ppc64le",
                "product": {
                  "name": "openshift-logging/fluentd-rhel8@sha256:70d1eeac2c53a0c77fdcf1ae305c12786227aa6e7f4f1f3ab4365a119111f1ea_ppc64le",
                  "product_id": "openshift-logging/fluentd-rhel8@sha256:70d1eeac2c53a0c77fdcf1ae305c12786227aa6e7f4f1f3ab4365a119111f1ea_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/fluentd-rhel8@sha256:70d1eeac2c53a0c77fdcf1ae305c12786227aa6e7f4f1f3ab4365a119111f1ea?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/fluentd-rhel8\u0026tag=v5.0.12-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/kibana6-rhel8@sha256:7cc111b0928dd598abfe6f4db5c021e056e7fa1270a3953168924f5194f00db5_ppc64le",
                "product": {
                  "name": "openshift-logging/kibana6-rhel8@sha256:7cc111b0928dd598abfe6f4db5c021e056e7fa1270a3953168924f5194f00db5_ppc64le",
                  "product_id": "openshift-logging/kibana6-rhel8@sha256:7cc111b0928dd598abfe6f4db5c021e056e7fa1270a3953168924f5194f00db5_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kibana6-rhel8@sha256:7cc111b0928dd598abfe6f4db5c021e056e7fa1270a3953168924f5194f00db5?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/kibana6-rhel8\u0026tag=v5.0.12-1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:e5f8312c65a081ae6433e9d8ed6e81682f5883781f4c757585559800b19fcb94_amd64",
                "product": {
                  "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:e5f8312c65a081ae6433e9d8ed6e81682f5883781f4c757585559800b19fcb94_amd64",
                  "product_id": "openshift-logging/cluster-logging-rhel8-operator@sha256:e5f8312c65a081ae6433e9d8ed6e81682f5883781f4c757585559800b19fcb94_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cluster-logging-rhel8-operator@sha256:e5f8312c65a081ae6433e9d8ed6e81682f5883781f4c757585559800b19fcb94?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel8-operator\u0026tag=v5.0.12-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/cluster-logging-operator-bundle@sha256:88c8992a0850de9983c13c3a8e5b5cb2ed1779e31e86c0c7195ab0d38fc2727d_amd64",
                "product": {
                  "name": "openshift-logging/cluster-logging-operator-bundle@sha256:88c8992a0850de9983c13c3a8e5b5cb2ed1779e31e86c0c7195ab0d38fc2727d_amd64",
                  "product_id": "openshift-logging/cluster-logging-operator-bundle@sha256:88c8992a0850de9983c13c3a8e5b5cb2ed1779e31e86c0c7195ab0d38fc2727d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cluster-logging-operator-bundle@sha256:88c8992a0850de9983c13c3a8e5b5cb2ed1779e31e86c0c7195ab0d38fc2727d?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-operator-bundle\u0026tag=v5.0.12-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:31ee1ebcb1276a491a5fee1b86aacbd1ebc0c07bdd4c9b536ce95c948995b6d0_amd64",
                "product": {
                  "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:31ee1ebcb1276a491a5fee1b86aacbd1ebc0c07bdd4c9b536ce95c948995b6d0_amd64",
                  "product_id": "openshift-logging/elasticsearch-rhel8-operator@sha256:31ee1ebcb1276a491a5fee1b86aacbd1ebc0c07bdd4c9b536ce95c948995b6d0_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-rhel8-operator@sha256:31ee1ebcb1276a491a5fee1b86aacbd1ebc0c07bdd4c9b536ce95c948995b6d0?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-rhel8-operator\u0026tag=v5.0.12-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-operator-bundle@sha256:6fda7c65e256b5ca27a3e0b99d5289fd3eb67cc738787f659ee449e79e01e56c_amd64",
                "product": {
                  "name": "openshift-logging/elasticsearch-operator-bundle@sha256:6fda7c65e256b5ca27a3e0b99d5289fd3eb67cc738787f659ee449e79e01e56c_amd64",
                  "product_id": "openshift-logging/elasticsearch-operator-bundle@sha256:6fda7c65e256b5ca27a3e0b99d5289fd3eb67cc738787f659ee449e79e01e56c_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-operator-bundle@sha256:6fda7c65e256b5ca27a3e0b99d5289fd3eb67cc738787f659ee449e79e01e56c?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-operator-bundle\u0026tag=v5.0.12-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:a3a23a88514f9f9117f2dceb99c7686b2056ebf3b7dd3c82efa34f5855e549e8_amd64",
                "product": {
                  "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:a3a23a88514f9f9117f2dceb99c7686b2056ebf3b7dd3c82efa34f5855e549e8_amd64",
                  "product_id": "openshift-logging/elasticsearch-proxy-rhel8@sha256:a3a23a88514f9f9117f2dceb99c7686b2056ebf3b7dd3c82efa34f5855e549e8_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-proxy-rhel8@sha256:a3a23a88514f9f9117f2dceb99c7686b2056ebf3b7dd3c82efa34f5855e549e8?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-proxy-rhel8\u0026tag=v5.0.12-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/logging-curator5-rhel8@sha256:3f1a81fdc28c7254be59a8a3630f4c36c05f655bab886627393823ffa9ad2cf6_amd64",
                "product": {
                  "name": "openshift-logging/logging-curator5-rhel8@sha256:3f1a81fdc28c7254be59a8a3630f4c36c05f655bab886627393823ffa9ad2cf6_amd64",
                  "product_id": "openshift-logging/logging-curator5-rhel8@sha256:3f1a81fdc28c7254be59a8a3630f4c36c05f655bab886627393823ffa9ad2cf6_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/logging-curator5-rhel8@sha256:3f1a81fdc28c7254be59a8a3630f4c36c05f655bab886627393823ffa9ad2cf6?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/logging-curator5-rhel8\u0026tag=v5.0.12-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch6-rhel8@sha256:15aef84c7916059dbddcdb5abadf9bd17ce282d4ab1e85c7b9473a025fc1d7ae_amd64",
                "product": {
                  "name": "openshift-logging/elasticsearch6-rhel8@sha256:15aef84c7916059dbddcdb5abadf9bd17ce282d4ab1e85c7b9473a025fc1d7ae_amd64",
                  "product_id": "openshift-logging/elasticsearch6-rhel8@sha256:15aef84c7916059dbddcdb5abadf9bd17ce282d4ab1e85c7b9473a025fc1d7ae_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch6-rhel8@sha256:15aef84c7916059dbddcdb5abadf9bd17ce282d4ab1e85c7b9473a025fc1d7ae?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch6-rhel8\u0026tag=v5.0.12-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/eventrouter-rhel8@sha256:f659b70ed9b1ecb132337b75e6b3891f3e0452be4bf39e3cff517a51d6520f7a_amd64",
                "product": {
                  "name": "openshift-logging/eventrouter-rhel8@sha256:f659b70ed9b1ecb132337b75e6b3891f3e0452be4bf39e3cff517a51d6520f7a_amd64",
                  "product_id": "openshift-logging/eventrouter-rhel8@sha256:f659b70ed9b1ecb132337b75e6b3891f3e0452be4bf39e3cff517a51d6520f7a_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/eventrouter-rhel8@sha256:f659b70ed9b1ecb132337b75e6b3891f3e0452be4bf39e3cff517a51d6520f7a?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel8\u0026tag=v5.0.12-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/fluentd-rhel8@sha256:b7139adf92aec389c86c3d2911773520abe984a6902cf92f1d7a124480f60823_amd64",
                "product": {
                  "name": "openshift-logging/fluentd-rhel8@sha256:b7139adf92aec389c86c3d2911773520abe984a6902cf92f1d7a124480f60823_amd64",
                  "product_id": "openshift-logging/fluentd-rhel8@sha256:b7139adf92aec389c86c3d2911773520abe984a6902cf92f1d7a124480f60823_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/fluentd-rhel8@sha256:b7139adf92aec389c86c3d2911773520abe984a6902cf92f1d7a124480f60823?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/fluentd-rhel8\u0026tag=v5.0.12-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/kibana6-rhel8@sha256:749d9a8434d2c5a4251d59701a3a57ece72b2fe8f3a450c6e3161905cbbd4ce3_amd64",
                "product": {
                  "name": "openshift-logging/kibana6-rhel8@sha256:749d9a8434d2c5a4251d59701a3a57ece72b2fe8f3a450c6e3161905cbbd4ce3_amd64",
                  "product_id": "openshift-logging/kibana6-rhel8@sha256:749d9a8434d2c5a4251d59701a3a57ece72b2fe8f3a450c6e3161905cbbd4ce3_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kibana6-rhel8@sha256:749d9a8434d2c5a4251d59701a3a57ece72b2fe8f3a450c6e3161905cbbd4ce3?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/kibana6-rhel8\u0026tag=v5.0.12-1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/cluster-logging-operator-bundle@sha256:88c8992a0850de9983c13c3a8e5b5cb2ed1779e31e86c0c7195ab0d38fc2727d_amd64 as a component of OpenShift Logging 5.0",
          "product_id": "8Base-OSE-LOGGING-5.0:openshift-logging/cluster-logging-operator-bundle@sha256:88c8992a0850de9983c13c3a8e5b5cb2ed1779e31e86c0c7195ab0d38fc2727d_amd64"
        },
        "product_reference": "openshift-logging/cluster-logging-operator-bundle@sha256:88c8992a0850de9983c13c3a8e5b5cb2ed1779e31e86c0c7195ab0d38fc2727d_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:6444d97d9ed0d5e07c8df5a9ae55cb431250c5432cec6e90ecaae0fbe00be6d5_ppc64le as a component of OpenShift Logging 5.0",
          "product_id": "8Base-OSE-LOGGING-5.0:openshift-logging/cluster-logging-rhel8-operator@sha256:6444d97d9ed0d5e07c8df5a9ae55cb431250c5432cec6e90ecaae0fbe00be6d5_ppc64le"
        },
        "product_reference": "openshift-logging/cluster-logging-rhel8-operator@sha256:6444d97d9ed0d5e07c8df5a9ae55cb431250c5432cec6e90ecaae0fbe00be6d5_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:989d85eee44074af63c6aea0f80a11c86338a32eed0db930feec87c7d08d5135_s390x as a component of OpenShift Logging 5.0",
          "product_id": "8Base-OSE-LOGGING-5.0:openshift-logging/cluster-logging-rhel8-operator@sha256:989d85eee44074af63c6aea0f80a11c86338a32eed0db930feec87c7d08d5135_s390x"
        },
        "product_reference": "openshift-logging/cluster-logging-rhel8-operator@sha256:989d85eee44074af63c6aea0f80a11c86338a32eed0db930feec87c7d08d5135_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:e5f8312c65a081ae6433e9d8ed6e81682f5883781f4c757585559800b19fcb94_amd64 as a component of OpenShift Logging 5.0",
          "product_id": "8Base-OSE-LOGGING-5.0:openshift-logging/cluster-logging-rhel8-operator@sha256:e5f8312c65a081ae6433e9d8ed6e81682f5883781f4c757585559800b19fcb94_amd64"
        },
        "product_reference": "openshift-logging/cluster-logging-rhel8-operator@sha256:e5f8312c65a081ae6433e9d8ed6e81682f5883781f4c757585559800b19fcb94_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-operator-bundle@sha256:6fda7c65e256b5ca27a3e0b99d5289fd3eb67cc738787f659ee449e79e01e56c_amd64 as a component of OpenShift Logging 5.0",
          "product_id": "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-operator-bundle@sha256:6fda7c65e256b5ca27a3e0b99d5289fd3eb67cc738787f659ee449e79e01e56c_amd64"
        },
        "product_reference": "openshift-logging/elasticsearch-operator-bundle@sha256:6fda7c65e256b5ca27a3e0b99d5289fd3eb67cc738787f659ee449e79e01e56c_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:411a7dc6932d910e53aeb09320d25325ff4228930ae198cfe67d21404fa0e3ed_ppc64le as a component of OpenShift Logging 5.0",
          "product_id": "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-proxy-rhel8@sha256:411a7dc6932d910e53aeb09320d25325ff4228930ae198cfe67d21404fa0e3ed_ppc64le"
        },
        "product_reference": "openshift-logging/elasticsearch-proxy-rhel8@sha256:411a7dc6932d910e53aeb09320d25325ff4228930ae198cfe67d21404fa0e3ed_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:a3a23a88514f9f9117f2dceb99c7686b2056ebf3b7dd3c82efa34f5855e549e8_amd64 as a component of OpenShift Logging 5.0",
          "product_id": "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-proxy-rhel8@sha256:a3a23a88514f9f9117f2dceb99c7686b2056ebf3b7dd3c82efa34f5855e549e8_amd64"
        },
        "product_reference": "openshift-logging/elasticsearch-proxy-rhel8@sha256:a3a23a88514f9f9117f2dceb99c7686b2056ebf3b7dd3c82efa34f5855e549e8_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:dba9c39a48e4f4a93db4daa1d596a08fc60c8c55c6b7889a7b69be241c7cd119_s390x as a component of OpenShift Logging 5.0",
          "product_id": "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-proxy-rhel8@sha256:dba9c39a48e4f4a93db4daa1d596a08fc60c8c55c6b7889a7b69be241c7cd119_s390x"
        },
        "product_reference": "openshift-logging/elasticsearch-proxy-rhel8@sha256:dba9c39a48e4f4a93db4daa1d596a08fc60c8c55c6b7889a7b69be241c7cd119_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:31ee1ebcb1276a491a5fee1b86aacbd1ebc0c07bdd4c9b536ce95c948995b6d0_amd64 as a component of OpenShift Logging 5.0",
          "product_id": "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-rhel8-operator@sha256:31ee1ebcb1276a491a5fee1b86aacbd1ebc0c07bdd4c9b536ce95c948995b6d0_amd64"
        },
        "product_reference": "openshift-logging/elasticsearch-rhel8-operator@sha256:31ee1ebcb1276a491a5fee1b86aacbd1ebc0c07bdd4c9b536ce95c948995b6d0_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:87a757926b3934d21632b830511ca077d9fdb12417fa8886fad85c10143a6842_ppc64le as a component of OpenShift Logging 5.0",
          "product_id": "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-rhel8-operator@sha256:87a757926b3934d21632b830511ca077d9fdb12417fa8886fad85c10143a6842_ppc64le"
        },
        "product_reference": "openshift-logging/elasticsearch-rhel8-operator@sha256:87a757926b3934d21632b830511ca077d9fdb12417fa8886fad85c10143a6842_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:d9b8605f7d19097c5f0a91d678cc2f102af892878871880023fc41721b276ef7_s390x as a component of OpenShift Logging 5.0",
          "product_id": "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-rhel8-operator@sha256:d9b8605f7d19097c5f0a91d678cc2f102af892878871880023fc41721b276ef7_s390x"
        },
        "product_reference": "openshift-logging/elasticsearch-rhel8-operator@sha256:d9b8605f7d19097c5f0a91d678cc2f102af892878871880023fc41721b276ef7_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch6-rhel8@sha256:15aef84c7916059dbddcdb5abadf9bd17ce282d4ab1e85c7b9473a025fc1d7ae_amd64 as a component of OpenShift Logging 5.0",
          "product_id": "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch6-rhel8@sha256:15aef84c7916059dbddcdb5abadf9bd17ce282d4ab1e85c7b9473a025fc1d7ae_amd64"
        },
        "product_reference": "openshift-logging/elasticsearch6-rhel8@sha256:15aef84c7916059dbddcdb5abadf9bd17ce282d4ab1e85c7b9473a025fc1d7ae_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch6-rhel8@sha256:5b6bd22611e78f26389183e0e3cc6f860eda122720909a3644f6edc7eae4e8da_s390x as a component of OpenShift Logging 5.0",
          "product_id": "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch6-rhel8@sha256:5b6bd22611e78f26389183e0e3cc6f860eda122720909a3644f6edc7eae4e8da_s390x"
        },
        "product_reference": "openshift-logging/elasticsearch6-rhel8@sha256:5b6bd22611e78f26389183e0e3cc6f860eda122720909a3644f6edc7eae4e8da_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch6-rhel8@sha256:c014b38a59a73f425c8ebd764148bad4956f24eda4670c42fd67826546df01be_ppc64le as a component of OpenShift Logging 5.0",
          "product_id": "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch6-rhel8@sha256:c014b38a59a73f425c8ebd764148bad4956f24eda4670c42fd67826546df01be_ppc64le"
        },
        "product_reference": "openshift-logging/elasticsearch6-rhel8@sha256:c014b38a59a73f425c8ebd764148bad4956f24eda4670c42fd67826546df01be_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/eventrouter-rhel8@sha256:4afc627224c584844325fac536c2e8f0b510fa4ff84b9b05bdafe2d8505f4eac_ppc64le as a component of OpenShift Logging 5.0",
          "product_id": "8Base-OSE-LOGGING-5.0:openshift-logging/eventrouter-rhel8@sha256:4afc627224c584844325fac536c2e8f0b510fa4ff84b9b05bdafe2d8505f4eac_ppc64le"
        },
        "product_reference": "openshift-logging/eventrouter-rhel8@sha256:4afc627224c584844325fac536c2e8f0b510fa4ff84b9b05bdafe2d8505f4eac_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/eventrouter-rhel8@sha256:b64462859b9229e261a14035b65ab702bd301fcba043254796c9bf28205e6d79_s390x as a component of OpenShift Logging 5.0",
          "product_id": "8Base-OSE-LOGGING-5.0:openshift-logging/eventrouter-rhel8@sha256:b64462859b9229e261a14035b65ab702bd301fcba043254796c9bf28205e6d79_s390x"
        },
        "product_reference": "openshift-logging/eventrouter-rhel8@sha256:b64462859b9229e261a14035b65ab702bd301fcba043254796c9bf28205e6d79_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/eventrouter-rhel8@sha256:f659b70ed9b1ecb132337b75e6b3891f3e0452be4bf39e3cff517a51d6520f7a_amd64 as a component of OpenShift Logging 5.0",
          "product_id": "8Base-OSE-LOGGING-5.0:openshift-logging/eventrouter-rhel8@sha256:f659b70ed9b1ecb132337b75e6b3891f3e0452be4bf39e3cff517a51d6520f7a_amd64"
        },
        "product_reference": "openshift-logging/eventrouter-rhel8@sha256:f659b70ed9b1ecb132337b75e6b3891f3e0452be4bf39e3cff517a51d6520f7a_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/fluentd-rhel8@sha256:70d1eeac2c53a0c77fdcf1ae305c12786227aa6e7f4f1f3ab4365a119111f1ea_ppc64le as a component of OpenShift Logging 5.0",
          "product_id": "8Base-OSE-LOGGING-5.0:openshift-logging/fluentd-rhel8@sha256:70d1eeac2c53a0c77fdcf1ae305c12786227aa6e7f4f1f3ab4365a119111f1ea_ppc64le"
        },
        "product_reference": "openshift-logging/fluentd-rhel8@sha256:70d1eeac2c53a0c77fdcf1ae305c12786227aa6e7f4f1f3ab4365a119111f1ea_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/fluentd-rhel8@sha256:a1fce6215b404d0107dc435c7f3458d7c3acc4f927ad177af43b18c9cadc1bb1_s390x as a component of OpenShift Logging 5.0",
          "product_id": "8Base-OSE-LOGGING-5.0:openshift-logging/fluentd-rhel8@sha256:a1fce6215b404d0107dc435c7f3458d7c3acc4f927ad177af43b18c9cadc1bb1_s390x"
        },
        "product_reference": "openshift-logging/fluentd-rhel8@sha256:a1fce6215b404d0107dc435c7f3458d7c3acc4f927ad177af43b18c9cadc1bb1_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/fluentd-rhel8@sha256:b7139adf92aec389c86c3d2911773520abe984a6902cf92f1d7a124480f60823_amd64 as a component of OpenShift Logging 5.0",
          "product_id": "8Base-OSE-LOGGING-5.0:openshift-logging/fluentd-rhel8@sha256:b7139adf92aec389c86c3d2911773520abe984a6902cf92f1d7a124480f60823_amd64"
        },
        "product_reference": "openshift-logging/fluentd-rhel8@sha256:b7139adf92aec389c86c3d2911773520abe984a6902cf92f1d7a124480f60823_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/kibana6-rhel8@sha256:23a36e4ba3a8c26585c28a0fc1a947a2f35092fdc92631c9e242928556143374_s390x as a component of OpenShift Logging 5.0",
          "product_id": "8Base-OSE-LOGGING-5.0:openshift-logging/kibana6-rhel8@sha256:23a36e4ba3a8c26585c28a0fc1a947a2f35092fdc92631c9e242928556143374_s390x"
        },
        "product_reference": "openshift-logging/kibana6-rhel8@sha256:23a36e4ba3a8c26585c28a0fc1a947a2f35092fdc92631c9e242928556143374_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/kibana6-rhel8@sha256:749d9a8434d2c5a4251d59701a3a57ece72b2fe8f3a450c6e3161905cbbd4ce3_amd64 as a component of OpenShift Logging 5.0",
          "product_id": "8Base-OSE-LOGGING-5.0:openshift-logging/kibana6-rhel8@sha256:749d9a8434d2c5a4251d59701a3a57ece72b2fe8f3a450c6e3161905cbbd4ce3_amd64"
        },
        "product_reference": "openshift-logging/kibana6-rhel8@sha256:749d9a8434d2c5a4251d59701a3a57ece72b2fe8f3a450c6e3161905cbbd4ce3_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/kibana6-rhel8@sha256:7cc111b0928dd598abfe6f4db5c021e056e7fa1270a3953168924f5194f00db5_ppc64le as a component of OpenShift Logging 5.0",
          "product_id": "8Base-OSE-LOGGING-5.0:openshift-logging/kibana6-rhel8@sha256:7cc111b0928dd598abfe6f4db5c021e056e7fa1270a3953168924f5194f00db5_ppc64le"
        },
        "product_reference": "openshift-logging/kibana6-rhel8@sha256:7cc111b0928dd598abfe6f4db5c021e056e7fa1270a3953168924f5194f00db5_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/logging-curator5-rhel8@sha256:3f1a81fdc28c7254be59a8a3630f4c36c05f655bab886627393823ffa9ad2cf6_amd64 as a component of OpenShift Logging 5.0",
          "product_id": "8Base-OSE-LOGGING-5.0:openshift-logging/logging-curator5-rhel8@sha256:3f1a81fdc28c7254be59a8a3630f4c36c05f655bab886627393823ffa9ad2cf6_amd64"
        },
        "product_reference": "openshift-logging/logging-curator5-rhel8@sha256:3f1a81fdc28c7254be59a8a3630f4c36c05f655bab886627393823ffa9ad2cf6_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/logging-curator5-rhel8@sha256:76bb02283a7740fbc2f25fd95e0f0b30118a585296a62bcc745872ecdd93ba1e_ppc64le as a component of OpenShift Logging 5.0",
          "product_id": "8Base-OSE-LOGGING-5.0:openshift-logging/logging-curator5-rhel8@sha256:76bb02283a7740fbc2f25fd95e0f0b30118a585296a62bcc745872ecdd93ba1e_ppc64le"
        },
        "product_reference": "openshift-logging/logging-curator5-rhel8@sha256:76bb02283a7740fbc2f25fd95e0f0b30118a585296a62bcc745872ecdd93ba1e_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/logging-curator5-rhel8@sha256:f561d39b3e7249000f22471454d04323d529217842e293d0bc10af30acaa7ad8_s390x as a component of OpenShift Logging 5.0",
          "product_id": "8Base-OSE-LOGGING-5.0:openshift-logging/logging-curator5-rhel8@sha256:f561d39b3e7249000f22471454d04323d529217842e293d0bc10af30acaa7ad8_s390x"
        },
        "product_reference": "openshift-logging/logging-curator5-rhel8@sha256:f561d39b3e7249000f22471454d04323d529217842e293d0bc10af30acaa7ad8_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-44832",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2021-12-28T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-OSE-LOGGING-5.0:openshift-logging/cluster-logging-operator-bundle@sha256:88c8992a0850de9983c13c3a8e5b5cb2ed1779e31e86c0c7195ab0d38fc2727d_amd64",
            "8Base-OSE-LOGGING-5.0:openshift-logging/cluster-logging-rhel8-operator@sha256:6444d97d9ed0d5e07c8df5a9ae55cb431250c5432cec6e90ecaae0fbe00be6d5_ppc64le",
            "8Base-OSE-LOGGING-5.0:openshift-logging/cluster-logging-rhel8-operator@sha256:989d85eee44074af63c6aea0f80a11c86338a32eed0db930feec87c7d08d5135_s390x",
            "8Base-OSE-LOGGING-5.0:openshift-logging/cluster-logging-rhel8-operator@sha256:e5f8312c65a081ae6433e9d8ed6e81682f5883781f4c757585559800b19fcb94_amd64",
            "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-operator-bundle@sha256:6fda7c65e256b5ca27a3e0b99d5289fd3eb67cc738787f659ee449e79e01e56c_amd64",
            "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-proxy-rhel8@sha256:411a7dc6932d910e53aeb09320d25325ff4228930ae198cfe67d21404fa0e3ed_ppc64le",
            "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-proxy-rhel8@sha256:a3a23a88514f9f9117f2dceb99c7686b2056ebf3b7dd3c82efa34f5855e549e8_amd64",
            "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-proxy-rhel8@sha256:dba9c39a48e4f4a93db4daa1d596a08fc60c8c55c6b7889a7b69be241c7cd119_s390x",
            "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-rhel8-operator@sha256:31ee1ebcb1276a491a5fee1b86aacbd1ebc0c07bdd4c9b536ce95c948995b6d0_amd64",
            "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-rhel8-operator@sha256:87a757926b3934d21632b830511ca077d9fdb12417fa8886fad85c10143a6842_ppc64le",
            "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-rhel8-operator@sha256:d9b8605f7d19097c5f0a91d678cc2f102af892878871880023fc41721b276ef7_s390x",
            "8Base-OSE-LOGGING-5.0:openshift-logging/eventrouter-rhel8@sha256:4afc627224c584844325fac536c2e8f0b510fa4ff84b9b05bdafe2d8505f4eac_ppc64le",
            "8Base-OSE-LOGGING-5.0:openshift-logging/eventrouter-rhel8@sha256:b64462859b9229e261a14035b65ab702bd301fcba043254796c9bf28205e6d79_s390x",
            "8Base-OSE-LOGGING-5.0:openshift-logging/eventrouter-rhel8@sha256:f659b70ed9b1ecb132337b75e6b3891f3e0452be4bf39e3cff517a51d6520f7a_amd64",
            "8Base-OSE-LOGGING-5.0:openshift-logging/fluentd-rhel8@sha256:70d1eeac2c53a0c77fdcf1ae305c12786227aa6e7f4f1f3ab4365a119111f1ea_ppc64le",
            "8Base-OSE-LOGGING-5.0:openshift-logging/fluentd-rhel8@sha256:a1fce6215b404d0107dc435c7f3458d7c3acc4f927ad177af43b18c9cadc1bb1_s390x",
            "8Base-OSE-LOGGING-5.0:openshift-logging/fluentd-rhel8@sha256:b7139adf92aec389c86c3d2911773520abe984a6902cf92f1d7a124480f60823_amd64",
            "8Base-OSE-LOGGING-5.0:openshift-logging/kibana6-rhel8@sha256:23a36e4ba3a8c26585c28a0fc1a947a2f35092fdc92631c9e242928556143374_s390x",
            "8Base-OSE-LOGGING-5.0:openshift-logging/kibana6-rhel8@sha256:749d9a8434d2c5a4251d59701a3a57ece72b2fe8f3a450c6e3161905cbbd4ce3_amd64",
            "8Base-OSE-LOGGING-5.0:openshift-logging/kibana6-rhel8@sha256:7cc111b0928dd598abfe6f4db5c021e056e7fa1270a3953168924f5194f00db5_ppc64le",
            "8Base-OSE-LOGGING-5.0:openshift-logging/logging-curator5-rhel8@sha256:3f1a81fdc28c7254be59a8a3630f4c36c05f655bab886627393823ffa9ad2cf6_amd64",
            "8Base-OSE-LOGGING-5.0:openshift-logging/logging-curator5-rhel8@sha256:76bb02283a7740fbc2f25fd95e0f0b30118a585296a62bcc745872ecdd93ba1e_ppc64le",
            "8Base-OSE-LOGGING-5.0:openshift-logging/logging-curator5-rhel8@sha256:f561d39b3e7249000f22471454d04323d529217842e293d0bc10af30acaa7ad8_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2035951"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j-core: remote code execution via JDBC Appender",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Log4j 1.x is not impacted by this vulnerability. Therefore versions of log4j shipped with Red Hat Enterprise Linux are NOT affected by this flaw.\n\nFor Elasticsearch, as shipped in OpenShift Container Platform and OpenShift Logging, access to the log4j2.properties configuration is limited only to the cluster administrators and exploitation requires cluster logging changes, what reduced the impact of this vulnerability significantly [0].\n\n[0] https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476#update-jan-6-5",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch6-rhel8@sha256:15aef84c7916059dbddcdb5abadf9bd17ce282d4ab1e85c7b9473a025fc1d7ae_amd64",
          "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch6-rhel8@sha256:5b6bd22611e78f26389183e0e3cc6f860eda122720909a3644f6edc7eae4e8da_s390x",
          "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch6-rhel8@sha256:c014b38a59a73f425c8ebd764148bad4956f24eda4670c42fd67826546df01be_ppc64le"
        ],
        "known_not_affected": [
          "8Base-OSE-LOGGING-5.0:openshift-logging/cluster-logging-operator-bundle@sha256:88c8992a0850de9983c13c3a8e5b5cb2ed1779e31e86c0c7195ab0d38fc2727d_amd64",
          "8Base-OSE-LOGGING-5.0:openshift-logging/cluster-logging-rhel8-operator@sha256:6444d97d9ed0d5e07c8df5a9ae55cb431250c5432cec6e90ecaae0fbe00be6d5_ppc64le",
          "8Base-OSE-LOGGING-5.0:openshift-logging/cluster-logging-rhel8-operator@sha256:989d85eee44074af63c6aea0f80a11c86338a32eed0db930feec87c7d08d5135_s390x",
          "8Base-OSE-LOGGING-5.0:openshift-logging/cluster-logging-rhel8-operator@sha256:e5f8312c65a081ae6433e9d8ed6e81682f5883781f4c757585559800b19fcb94_amd64",
          "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-operator-bundle@sha256:6fda7c65e256b5ca27a3e0b99d5289fd3eb67cc738787f659ee449e79e01e56c_amd64",
          "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-proxy-rhel8@sha256:411a7dc6932d910e53aeb09320d25325ff4228930ae198cfe67d21404fa0e3ed_ppc64le",
          "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-proxy-rhel8@sha256:a3a23a88514f9f9117f2dceb99c7686b2056ebf3b7dd3c82efa34f5855e549e8_amd64",
          "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-proxy-rhel8@sha256:dba9c39a48e4f4a93db4daa1d596a08fc60c8c55c6b7889a7b69be241c7cd119_s390x",
          "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-rhel8-operator@sha256:31ee1ebcb1276a491a5fee1b86aacbd1ebc0c07bdd4c9b536ce95c948995b6d0_amd64",
          "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-rhel8-operator@sha256:87a757926b3934d21632b830511ca077d9fdb12417fa8886fad85c10143a6842_ppc64le",
          "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-rhel8-operator@sha256:d9b8605f7d19097c5f0a91d678cc2f102af892878871880023fc41721b276ef7_s390x",
          "8Base-OSE-LOGGING-5.0:openshift-logging/eventrouter-rhel8@sha256:4afc627224c584844325fac536c2e8f0b510fa4ff84b9b05bdafe2d8505f4eac_ppc64le",
          "8Base-OSE-LOGGING-5.0:openshift-logging/eventrouter-rhel8@sha256:b64462859b9229e261a14035b65ab702bd301fcba043254796c9bf28205e6d79_s390x",
          "8Base-OSE-LOGGING-5.0:openshift-logging/eventrouter-rhel8@sha256:f659b70ed9b1ecb132337b75e6b3891f3e0452be4bf39e3cff517a51d6520f7a_amd64",
          "8Base-OSE-LOGGING-5.0:openshift-logging/fluentd-rhel8@sha256:70d1eeac2c53a0c77fdcf1ae305c12786227aa6e7f4f1f3ab4365a119111f1ea_ppc64le",
          "8Base-OSE-LOGGING-5.0:openshift-logging/fluentd-rhel8@sha256:a1fce6215b404d0107dc435c7f3458d7c3acc4f927ad177af43b18c9cadc1bb1_s390x",
          "8Base-OSE-LOGGING-5.0:openshift-logging/fluentd-rhel8@sha256:b7139adf92aec389c86c3d2911773520abe984a6902cf92f1d7a124480f60823_amd64",
          "8Base-OSE-LOGGING-5.0:openshift-logging/kibana6-rhel8@sha256:23a36e4ba3a8c26585c28a0fc1a947a2f35092fdc92631c9e242928556143374_s390x",
          "8Base-OSE-LOGGING-5.0:openshift-logging/kibana6-rhel8@sha256:749d9a8434d2c5a4251d59701a3a57ece72b2fe8f3a450c6e3161905cbbd4ce3_amd64",
          "8Base-OSE-LOGGING-5.0:openshift-logging/kibana6-rhel8@sha256:7cc111b0928dd598abfe6f4db5c021e056e7fa1270a3953168924f5194f00db5_ppc64le",
          "8Base-OSE-LOGGING-5.0:openshift-logging/logging-curator5-rhel8@sha256:3f1a81fdc28c7254be59a8a3630f4c36c05f655bab886627393823ffa9ad2cf6_amd64",
          "8Base-OSE-LOGGING-5.0:openshift-logging/logging-curator5-rhel8@sha256:76bb02283a7740fbc2f25fd95e0f0b30118a585296a62bcc745872ecdd93ba1e_ppc64le",
          "8Base-OSE-LOGGING-5.0:openshift-logging/logging-curator5-rhel8@sha256:f561d39b3e7249000f22471454d04323d529217842e293d0bc10af30acaa7ad8_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-44832"
        },
        {
          "category": "external",
          "summary": "RHBZ#2035951",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2035951"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44832",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-44832"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44832",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44832"
        },
        {
          "category": "external",
          "summary": "https://issues.apache.org/jira/browse/LOG4J2-3293",
          "url": "https://issues.apache.org/jira/browse/LOG4J2-3293"
        }
      ],
      "release_date": "2021-12-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-01-20T21:09:05+00:00",
          "details": "For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html\n\nFor Red Hat OpenShift Logging 5.0, see the following instructions to apply this update:\n\nhttps://docs.openshift.com/container-platform/4.7/logging/cluster-logging-upgrading.html",
          "product_ids": [
            "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch6-rhel8@sha256:15aef84c7916059dbddcdb5abadf9bd17ce282d4ab1e85c7b9473a025fc1d7ae_amd64",
            "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch6-rhel8@sha256:5b6bd22611e78f26389183e0e3cc6f860eda122720909a3644f6edc7eae4e8da_s390x",
            "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch6-rhel8@sha256:c014b38a59a73f425c8ebd764148bad4956f24eda4670c42fd67826546df01be_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0225"
        },
        {
          "category": "workaround",
          "details": "As per upstream:\n- In prior releases confirm that if the JDBC Appender is being used it is not configured to use any protocol other than Java.\n- Note that only the log4j-core JAR file is impacted by this vulnerability. Applications using only the log4j-api JAR file without the log4j-core JAR file are not impacted by this vulnerability.",
          "product_ids": [
            "8Base-OSE-LOGGING-5.0:openshift-logging/cluster-logging-operator-bundle@sha256:88c8992a0850de9983c13c3a8e5b5cb2ed1779e31e86c0c7195ab0d38fc2727d_amd64",
            "8Base-OSE-LOGGING-5.0:openshift-logging/cluster-logging-rhel8-operator@sha256:6444d97d9ed0d5e07c8df5a9ae55cb431250c5432cec6e90ecaae0fbe00be6d5_ppc64le",
            "8Base-OSE-LOGGING-5.0:openshift-logging/cluster-logging-rhel8-operator@sha256:989d85eee44074af63c6aea0f80a11c86338a32eed0db930feec87c7d08d5135_s390x",
            "8Base-OSE-LOGGING-5.0:openshift-logging/cluster-logging-rhel8-operator@sha256:e5f8312c65a081ae6433e9d8ed6e81682f5883781f4c757585559800b19fcb94_amd64",
            "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-operator-bundle@sha256:6fda7c65e256b5ca27a3e0b99d5289fd3eb67cc738787f659ee449e79e01e56c_amd64",
            "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-proxy-rhel8@sha256:411a7dc6932d910e53aeb09320d25325ff4228930ae198cfe67d21404fa0e3ed_ppc64le",
            "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-proxy-rhel8@sha256:a3a23a88514f9f9117f2dceb99c7686b2056ebf3b7dd3c82efa34f5855e549e8_amd64",
            "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-proxy-rhel8@sha256:dba9c39a48e4f4a93db4daa1d596a08fc60c8c55c6b7889a7b69be241c7cd119_s390x",
            "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-rhel8-operator@sha256:31ee1ebcb1276a491a5fee1b86aacbd1ebc0c07bdd4c9b536ce95c948995b6d0_amd64",
            "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-rhel8-operator@sha256:87a757926b3934d21632b830511ca077d9fdb12417fa8886fad85c10143a6842_ppc64le",
            "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-rhel8-operator@sha256:d9b8605f7d19097c5f0a91d678cc2f102af892878871880023fc41721b276ef7_s390x",
            "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch6-rhel8@sha256:15aef84c7916059dbddcdb5abadf9bd17ce282d4ab1e85c7b9473a025fc1d7ae_amd64",
            "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch6-rhel8@sha256:5b6bd22611e78f26389183e0e3cc6f860eda122720909a3644f6edc7eae4e8da_s390x",
            "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch6-rhel8@sha256:c014b38a59a73f425c8ebd764148bad4956f24eda4670c42fd67826546df01be_ppc64le",
            "8Base-OSE-LOGGING-5.0:openshift-logging/eventrouter-rhel8@sha256:4afc627224c584844325fac536c2e8f0b510fa4ff84b9b05bdafe2d8505f4eac_ppc64le",
            "8Base-OSE-LOGGING-5.0:openshift-logging/eventrouter-rhel8@sha256:b64462859b9229e261a14035b65ab702bd301fcba043254796c9bf28205e6d79_s390x",
            "8Base-OSE-LOGGING-5.0:openshift-logging/eventrouter-rhel8@sha256:f659b70ed9b1ecb132337b75e6b3891f3e0452be4bf39e3cff517a51d6520f7a_amd64",
            "8Base-OSE-LOGGING-5.0:openshift-logging/fluentd-rhel8@sha256:70d1eeac2c53a0c77fdcf1ae305c12786227aa6e7f4f1f3ab4365a119111f1ea_ppc64le",
            "8Base-OSE-LOGGING-5.0:openshift-logging/fluentd-rhel8@sha256:a1fce6215b404d0107dc435c7f3458d7c3acc4f927ad177af43b18c9cadc1bb1_s390x",
            "8Base-OSE-LOGGING-5.0:openshift-logging/fluentd-rhel8@sha256:b7139adf92aec389c86c3d2911773520abe984a6902cf92f1d7a124480f60823_amd64",
            "8Base-OSE-LOGGING-5.0:openshift-logging/kibana6-rhel8@sha256:23a36e4ba3a8c26585c28a0fc1a947a2f35092fdc92631c9e242928556143374_s390x",
            "8Base-OSE-LOGGING-5.0:openshift-logging/kibana6-rhel8@sha256:749d9a8434d2c5a4251d59701a3a57ece72b2fe8f3a450c6e3161905cbbd4ce3_amd64",
            "8Base-OSE-LOGGING-5.0:openshift-logging/kibana6-rhel8@sha256:7cc111b0928dd598abfe6f4db5c021e056e7fa1270a3953168924f5194f00db5_ppc64le",
            "8Base-OSE-LOGGING-5.0:openshift-logging/logging-curator5-rhel8@sha256:3f1a81fdc28c7254be59a8a3630f4c36c05f655bab886627393823ffa9ad2cf6_amd64",
            "8Base-OSE-LOGGING-5.0:openshift-logging/logging-curator5-rhel8@sha256:76bb02283a7740fbc2f25fd95e0f0b30118a585296a62bcc745872ecdd93ba1e_ppc64le",
            "8Base-OSE-LOGGING-5.0:openshift-logging/logging-curator5-rhel8@sha256:f561d39b3e7249000f22471454d04323d529217842e293d0bc10af30acaa7ad8_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-OSE-LOGGING-5.0:openshift-logging/cluster-logging-operator-bundle@sha256:88c8992a0850de9983c13c3a8e5b5cb2ed1779e31e86c0c7195ab0d38fc2727d_amd64",
            "8Base-OSE-LOGGING-5.0:openshift-logging/cluster-logging-rhel8-operator@sha256:6444d97d9ed0d5e07c8df5a9ae55cb431250c5432cec6e90ecaae0fbe00be6d5_ppc64le",
            "8Base-OSE-LOGGING-5.0:openshift-logging/cluster-logging-rhel8-operator@sha256:989d85eee44074af63c6aea0f80a11c86338a32eed0db930feec87c7d08d5135_s390x",
            "8Base-OSE-LOGGING-5.0:openshift-logging/cluster-logging-rhel8-operator@sha256:e5f8312c65a081ae6433e9d8ed6e81682f5883781f4c757585559800b19fcb94_amd64",
            "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-operator-bundle@sha256:6fda7c65e256b5ca27a3e0b99d5289fd3eb67cc738787f659ee449e79e01e56c_amd64",
            "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-proxy-rhel8@sha256:411a7dc6932d910e53aeb09320d25325ff4228930ae198cfe67d21404fa0e3ed_ppc64le",
            "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-proxy-rhel8@sha256:a3a23a88514f9f9117f2dceb99c7686b2056ebf3b7dd3c82efa34f5855e549e8_amd64",
            "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-proxy-rhel8@sha256:dba9c39a48e4f4a93db4daa1d596a08fc60c8c55c6b7889a7b69be241c7cd119_s390x",
            "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-rhel8-operator@sha256:31ee1ebcb1276a491a5fee1b86aacbd1ebc0c07bdd4c9b536ce95c948995b6d0_amd64",
            "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-rhel8-operator@sha256:87a757926b3934d21632b830511ca077d9fdb12417fa8886fad85c10143a6842_ppc64le",
            "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch-rhel8-operator@sha256:d9b8605f7d19097c5f0a91d678cc2f102af892878871880023fc41721b276ef7_s390x",
            "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch6-rhel8@sha256:15aef84c7916059dbddcdb5abadf9bd17ce282d4ab1e85c7b9473a025fc1d7ae_amd64",
            "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch6-rhel8@sha256:5b6bd22611e78f26389183e0e3cc6f860eda122720909a3644f6edc7eae4e8da_s390x",
            "8Base-OSE-LOGGING-5.0:openshift-logging/elasticsearch6-rhel8@sha256:c014b38a59a73f425c8ebd764148bad4956f24eda4670c42fd67826546df01be_ppc64le",
            "8Base-OSE-LOGGING-5.0:openshift-logging/eventrouter-rhel8@sha256:4afc627224c584844325fac536c2e8f0b510fa4ff84b9b05bdafe2d8505f4eac_ppc64le",
            "8Base-OSE-LOGGING-5.0:openshift-logging/eventrouter-rhel8@sha256:b64462859b9229e261a14035b65ab702bd301fcba043254796c9bf28205e6d79_s390x",
            "8Base-OSE-LOGGING-5.0:openshift-logging/eventrouter-rhel8@sha256:f659b70ed9b1ecb132337b75e6b3891f3e0452be4bf39e3cff517a51d6520f7a_amd64",
            "8Base-OSE-LOGGING-5.0:openshift-logging/fluentd-rhel8@sha256:70d1eeac2c53a0c77fdcf1ae305c12786227aa6e7f4f1f3ab4365a119111f1ea_ppc64le",
            "8Base-OSE-LOGGING-5.0:openshift-logging/fluentd-rhel8@sha256:a1fce6215b404d0107dc435c7f3458d7c3acc4f927ad177af43b18c9cadc1bb1_s390x",
            "8Base-OSE-LOGGING-5.0:openshift-logging/fluentd-rhel8@sha256:b7139adf92aec389c86c3d2911773520abe984a6902cf92f1d7a124480f60823_amd64",
            "8Base-OSE-LOGGING-5.0:openshift-logging/kibana6-rhel8@sha256:23a36e4ba3a8c26585c28a0fc1a947a2f35092fdc92631c9e242928556143374_s390x",
            "8Base-OSE-LOGGING-5.0:openshift-logging/kibana6-rhel8@sha256:749d9a8434d2c5a4251d59701a3a57ece72b2fe8f3a450c6e3161905cbbd4ce3_amd64",
            "8Base-OSE-LOGGING-5.0:openshift-logging/kibana6-rhel8@sha256:7cc111b0928dd598abfe6f4db5c021e056e7fa1270a3953168924f5194f00db5_ppc64le",
            "8Base-OSE-LOGGING-5.0:openshift-logging/logging-curator5-rhel8@sha256:3f1a81fdc28c7254be59a8a3630f4c36c05f655bab886627393823ffa9ad2cf6_amd64",
            "8Base-OSE-LOGGING-5.0:openshift-logging/logging-curator5-rhel8@sha256:76bb02283a7740fbc2f25fd95e0f0b30118a585296a62bcc745872ecdd93ba1e_ppc64le",
            "8Base-OSE-LOGGING-5.0:openshift-logging/logging-curator5-rhel8@sha256:f561d39b3e7249000f22471454d04323d529217842e293d0bc10af30acaa7ad8_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "log4j-core: remote code execution via JDBC Appender"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for OpenShift Logging (5.1.7)\n\nRed Hat Product Security has rated this update as having a security impact of\nModerate. A Common Vulnerability Scoring System (CVSS) base score, which gives\na detailed severity rating, is available for each vulnerability from the CVE\nlink(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "OpenShift Logging Bug Fix Release (5.1.7)\n\nSecurity Fix(es):\n\n* nodejs-ua-parser-js: ReDoS via malicious User-Agent header (CVE-2021-27292)\n\n* log4j-core: remote code execution via JDBC Appender (CVE-2021-44832)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2022:0226",
        "url": "https://access.redhat.com/errata/RHSA-2022:0226"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "1940613",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1940613"
      },
      {
        "category": "external",
        "summary": "2035951",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2035951"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0226.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat OpenShift Enterprise Logging bug fix and security update (5.1.7)",
    "tracking": {
      "current_release_date": "2026-05-29T20:04:08+00:00",
      "generator": {
        "date": "2026-05-29T20:04:08+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.1"
        }
      },
      "id": "RHSA-2022:0226",
      "initial_release_date": "2022-01-20T21:39:00+00:00",
      "revision_history": [
        {
          "date": "2022-01-20T21:39:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2022-01-20T21:39:00+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-29T20:04:08+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "OpenShift Logging 5.1",
                "product": {
                  "name": "OpenShift Logging 5.1",
                  "product_id": "8Base-OSE-LOGGING-5.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:logging:5.1::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Enterprise"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:5f1436f57bc60663619d099cc54eac735a4ea885eb224a659b0aad66f14dcc36_s390x",
                "product": {
                  "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:5f1436f57bc60663619d099cc54eac735a4ea885eb224a659b0aad66f14dcc36_s390x",
                  "product_id": "openshift-logging/cluster-logging-rhel8-operator@sha256:5f1436f57bc60663619d099cc54eac735a4ea885eb224a659b0aad66f14dcc36_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cluster-logging-rhel8-operator@sha256:5f1436f57bc60663619d099cc54eac735a4ea885eb224a659b0aad66f14dcc36?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel8-operator\u0026tag=v5.1.7-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:747bf587b1cb27d3fc872f40938a8f3ded033c97eab756712ca2a427fbeee4f0_s390x",
                "product": {
                  "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:747bf587b1cb27d3fc872f40938a8f3ded033c97eab756712ca2a427fbeee4f0_s390x",
                  "product_id": "openshift-logging/elasticsearch-rhel8-operator@sha256:747bf587b1cb27d3fc872f40938a8f3ded033c97eab756712ca2a427fbeee4f0_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-rhel8-operator@sha256:747bf587b1cb27d3fc872f40938a8f3ded033c97eab756712ca2a427fbeee4f0?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-rhel8-operator\u0026tag=v5.1.7-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:7eca37c2de3ab91f5561bc30d6057dcc7e32dd3e41af9c78739b2c840d26f3d4_s390x",
                "product": {
                  "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:7eca37c2de3ab91f5561bc30d6057dcc7e32dd3e41af9c78739b2c840d26f3d4_s390x",
                  "product_id": "openshift-logging/elasticsearch-proxy-rhel8@sha256:7eca37c2de3ab91f5561bc30d6057dcc7e32dd3e41af9c78739b2c840d26f3d4_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-proxy-rhel8@sha256:7eca37c2de3ab91f5561bc30d6057dcc7e32dd3e41af9c78739b2c840d26f3d4?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-proxy-rhel8\u0026tag=v1.0.0-102"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch6-rhel8@sha256:3e971f5c333ced1166981d713355fd55f984108cd50bf458b9ea29eb637df9ce_s390x",
                "product": {
                  "name": "openshift-logging/elasticsearch6-rhel8@sha256:3e971f5c333ced1166981d713355fd55f984108cd50bf458b9ea29eb637df9ce_s390x",
                  "product_id": "openshift-logging/elasticsearch6-rhel8@sha256:3e971f5c333ced1166981d713355fd55f984108cd50bf458b9ea29eb637df9ce_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch6-rhel8@sha256:3e971f5c333ced1166981d713355fd55f984108cd50bf458b9ea29eb637df9ce?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch6-rhel8\u0026tag=v6.8.1-98"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/eventrouter-rhel8@sha256:499aa444f1c77cc0e238577b35ce707a6233b7c10695aa058f036694cc65f62d_s390x",
                "product": {
                  "name": "openshift-logging/eventrouter-rhel8@sha256:499aa444f1c77cc0e238577b35ce707a6233b7c10695aa058f036694cc65f62d_s390x",
                  "product_id": "openshift-logging/eventrouter-rhel8@sha256:499aa444f1c77cc0e238577b35ce707a6233b7c10695aa058f036694cc65f62d_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/eventrouter-rhel8@sha256:499aa444f1c77cc0e238577b35ce707a6233b7c10695aa058f036694cc65f62d?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel8\u0026tag=v0.3.0-97"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/fluentd-rhel8@sha256:dd94d77116595d5aede41e3fdd38681767a0ac294b743b9d608268fef97720d1_s390x",
                "product": {
                  "name": "openshift-logging/fluentd-rhel8@sha256:dd94d77116595d5aede41e3fdd38681767a0ac294b743b9d608268fef97720d1_s390x",
                  "product_id": "openshift-logging/fluentd-rhel8@sha256:dd94d77116595d5aede41e3fdd38681767a0ac294b743b9d608268fef97720d1_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/fluentd-rhel8@sha256:dd94d77116595d5aede41e3fdd38681767a0ac294b743b9d608268fef97720d1?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/fluentd-rhel8\u0026tag=v1.7.4-102"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/kibana6-rhel8@sha256:318f21b10f1b22d14a0bf0d895c597e29f498442bc90fb5c26886e696fbe68a5_s390x",
                "product": {
                  "name": "openshift-logging/kibana6-rhel8@sha256:318f21b10f1b22d14a0bf0d895c597e29f498442bc90fb5c26886e696fbe68a5_s390x",
                  "product_id": "openshift-logging/kibana6-rhel8@sha256:318f21b10f1b22d14a0bf0d895c597e29f498442bc90fb5c26886e696fbe68a5_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kibana6-rhel8@sha256:318f21b10f1b22d14a0bf0d895c597e29f498442bc90fb5c26886e696fbe68a5?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/kibana6-rhel8\u0026tag=v6.8.1-108"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:f96340f2ae0699d07b36e2e0e47bdda190635c276eb9122513f57b2f0ffd25f7_ppc64le",
                "product": {
                  "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:f96340f2ae0699d07b36e2e0e47bdda190635c276eb9122513f57b2f0ffd25f7_ppc64le",
                  "product_id": "openshift-logging/cluster-logging-rhel8-operator@sha256:f96340f2ae0699d07b36e2e0e47bdda190635c276eb9122513f57b2f0ffd25f7_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cluster-logging-rhel8-operator@sha256:f96340f2ae0699d07b36e2e0e47bdda190635c276eb9122513f57b2f0ffd25f7?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel8-operator\u0026tag=v5.1.7-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:0d759e02a84eaf59cffc0143b51fd922363f0488a537562731e5c71bbd555a92_ppc64le",
                "product": {
                  "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:0d759e02a84eaf59cffc0143b51fd922363f0488a537562731e5c71bbd555a92_ppc64le",
                  "product_id": "openshift-logging/elasticsearch-rhel8-operator@sha256:0d759e02a84eaf59cffc0143b51fd922363f0488a537562731e5c71bbd555a92_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-rhel8-operator@sha256:0d759e02a84eaf59cffc0143b51fd922363f0488a537562731e5c71bbd555a92?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-rhel8-operator\u0026tag=v5.1.7-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:b9025248fa3fe48e38e12409b77b93782a2c2977fd48cf43de74bfbf8ed4a016_ppc64le",
                "product": {
                  "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:b9025248fa3fe48e38e12409b77b93782a2c2977fd48cf43de74bfbf8ed4a016_ppc64le",
                  "product_id": "openshift-logging/elasticsearch-proxy-rhel8@sha256:b9025248fa3fe48e38e12409b77b93782a2c2977fd48cf43de74bfbf8ed4a016_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-proxy-rhel8@sha256:b9025248fa3fe48e38e12409b77b93782a2c2977fd48cf43de74bfbf8ed4a016?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-proxy-rhel8\u0026tag=v1.0.0-102"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch6-rhel8@sha256:9b1a4b2ca3c32aa6a8a5bbcb28af0e6bbd0ea5368ab317e8a0dc7ba5f9b0ddc4_ppc64le",
                "product": {
                  "name": "openshift-logging/elasticsearch6-rhel8@sha256:9b1a4b2ca3c32aa6a8a5bbcb28af0e6bbd0ea5368ab317e8a0dc7ba5f9b0ddc4_ppc64le",
                  "product_id": "openshift-logging/elasticsearch6-rhel8@sha256:9b1a4b2ca3c32aa6a8a5bbcb28af0e6bbd0ea5368ab317e8a0dc7ba5f9b0ddc4_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch6-rhel8@sha256:9b1a4b2ca3c32aa6a8a5bbcb28af0e6bbd0ea5368ab317e8a0dc7ba5f9b0ddc4?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch6-rhel8\u0026tag=v6.8.1-98"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/eventrouter-rhel8@sha256:b7706ebba12fba423afe2b333677aa4fa16ecd72cfcd2c5b076dfb34d5d400e6_ppc64le",
                "product": {
                  "name": "openshift-logging/eventrouter-rhel8@sha256:b7706ebba12fba423afe2b333677aa4fa16ecd72cfcd2c5b076dfb34d5d400e6_ppc64le",
                  "product_id": "openshift-logging/eventrouter-rhel8@sha256:b7706ebba12fba423afe2b333677aa4fa16ecd72cfcd2c5b076dfb34d5d400e6_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/eventrouter-rhel8@sha256:b7706ebba12fba423afe2b333677aa4fa16ecd72cfcd2c5b076dfb34d5d400e6?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel8\u0026tag=v0.3.0-97"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/fluentd-rhel8@sha256:63a5e130e712bf0292167f0aa8c3018b77bdb73042160fd14057d4678ff613ff_ppc64le",
                "product": {
                  "name": "openshift-logging/fluentd-rhel8@sha256:63a5e130e712bf0292167f0aa8c3018b77bdb73042160fd14057d4678ff613ff_ppc64le",
                  "product_id": "openshift-logging/fluentd-rhel8@sha256:63a5e130e712bf0292167f0aa8c3018b77bdb73042160fd14057d4678ff613ff_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/fluentd-rhel8@sha256:63a5e130e712bf0292167f0aa8c3018b77bdb73042160fd14057d4678ff613ff?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/fluentd-rhel8\u0026tag=v1.7.4-102"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/kibana6-rhel8@sha256:b43d04bc71797caab0d1b6bb5f14d18a04b09fee5272e9e03d50056dbb2116fc_ppc64le",
                "product": {
                  "name": "openshift-logging/kibana6-rhel8@sha256:b43d04bc71797caab0d1b6bb5f14d18a04b09fee5272e9e03d50056dbb2116fc_ppc64le",
                  "product_id": "openshift-logging/kibana6-rhel8@sha256:b43d04bc71797caab0d1b6bb5f14d18a04b09fee5272e9e03d50056dbb2116fc_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kibana6-rhel8@sha256:b43d04bc71797caab0d1b6bb5f14d18a04b09fee5272e9e03d50056dbb2116fc?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/kibana6-rhel8\u0026tag=v6.8.1-108"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:8715b4821f39144aeb5d015e0621c859b45d3175c0f8415bd1542f7f7f063dec_amd64",
                "product": {
                  "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:8715b4821f39144aeb5d015e0621c859b45d3175c0f8415bd1542f7f7f063dec_amd64",
                  "product_id": "openshift-logging/cluster-logging-rhel8-operator@sha256:8715b4821f39144aeb5d015e0621c859b45d3175c0f8415bd1542f7f7f063dec_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cluster-logging-rhel8-operator@sha256:8715b4821f39144aeb5d015e0621c859b45d3175c0f8415bd1542f7f7f063dec?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel8-operator\u0026tag=v5.1.7-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/cluster-logging-operator-bundle@sha256:cd21e02ce7d7900dd20083b561b98161199561726c310c1ff3f619b700a660d9_amd64",
                "product": {
                  "name": "openshift-logging/cluster-logging-operator-bundle@sha256:cd21e02ce7d7900dd20083b561b98161199561726c310c1ff3f619b700a660d9_amd64",
                  "product_id": "openshift-logging/cluster-logging-operator-bundle@sha256:cd21e02ce7d7900dd20083b561b98161199561726c310c1ff3f619b700a660d9_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cluster-logging-operator-bundle@sha256:cd21e02ce7d7900dd20083b561b98161199561726c310c1ff3f619b700a660d9?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-operator-bundle\u0026tag=v5.1.7-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:df696bb6cc563e646f51ccd409c961cfb06b39f361857392ec80f30add0927ab_amd64",
                "product": {
                  "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:df696bb6cc563e646f51ccd409c961cfb06b39f361857392ec80f30add0927ab_amd64",
                  "product_id": "openshift-logging/elasticsearch-rhel8-operator@sha256:df696bb6cc563e646f51ccd409c961cfb06b39f361857392ec80f30add0927ab_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-rhel8-operator@sha256:df696bb6cc563e646f51ccd409c961cfb06b39f361857392ec80f30add0927ab?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-rhel8-operator\u0026tag=v5.1.7-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-operator-bundle@sha256:8c60be512aa5cbec4247f2bcbcb0d829edc2f4b2c28ebd78673be8c15b4c4d99_amd64",
                "product": {
                  "name": "openshift-logging/elasticsearch-operator-bundle@sha256:8c60be512aa5cbec4247f2bcbcb0d829edc2f4b2c28ebd78673be8c15b4c4d99_amd64",
                  "product_id": "openshift-logging/elasticsearch-operator-bundle@sha256:8c60be512aa5cbec4247f2bcbcb0d829edc2f4b2c28ebd78673be8c15b4c4d99_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-operator-bundle@sha256:8c60be512aa5cbec4247f2bcbcb0d829edc2f4b2c28ebd78673be8c15b4c4d99?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-operator-bundle\u0026tag=v5.1.7-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:75ad4b059c54e8c089de590a7dd0425a07049fb4721e83e894bf72dba2580fe7_amd64",
                "product": {
                  "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:75ad4b059c54e8c089de590a7dd0425a07049fb4721e83e894bf72dba2580fe7_amd64",
                  "product_id": "openshift-logging/elasticsearch-proxy-rhel8@sha256:75ad4b059c54e8c089de590a7dd0425a07049fb4721e83e894bf72dba2580fe7_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-proxy-rhel8@sha256:75ad4b059c54e8c089de590a7dd0425a07049fb4721e83e894bf72dba2580fe7?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-proxy-rhel8\u0026tag=v1.0.0-102"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch6-rhel8@sha256:007deae6e82e1d870385f2c9ed90c1783f9fdb3aca0b97349a66a97e4380b9b4_amd64",
                "product": {
                  "name": "openshift-logging/elasticsearch6-rhel8@sha256:007deae6e82e1d870385f2c9ed90c1783f9fdb3aca0b97349a66a97e4380b9b4_amd64",
                  "product_id": "openshift-logging/elasticsearch6-rhel8@sha256:007deae6e82e1d870385f2c9ed90c1783f9fdb3aca0b97349a66a97e4380b9b4_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch6-rhel8@sha256:007deae6e82e1d870385f2c9ed90c1783f9fdb3aca0b97349a66a97e4380b9b4?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch6-rhel8\u0026tag=v6.8.1-98"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/eventrouter-rhel8@sha256:b21561dc5237b5c9bc65ffdfa8e62d364a02631e0e06307883463357229ff06f_amd64",
                "product": {
                  "name": "openshift-logging/eventrouter-rhel8@sha256:b21561dc5237b5c9bc65ffdfa8e62d364a02631e0e06307883463357229ff06f_amd64",
                  "product_id": "openshift-logging/eventrouter-rhel8@sha256:b21561dc5237b5c9bc65ffdfa8e62d364a02631e0e06307883463357229ff06f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/eventrouter-rhel8@sha256:b21561dc5237b5c9bc65ffdfa8e62d364a02631e0e06307883463357229ff06f?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel8\u0026tag=v0.3.0-97"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/fluentd-rhel8@sha256:2eb43cd05fa769240e683de25d8913ea1379c0f69d656dec66efd7d4f5e70217_amd64",
                "product": {
                  "name": "openshift-logging/fluentd-rhel8@sha256:2eb43cd05fa769240e683de25d8913ea1379c0f69d656dec66efd7d4f5e70217_amd64",
                  "product_id": "openshift-logging/fluentd-rhel8@sha256:2eb43cd05fa769240e683de25d8913ea1379c0f69d656dec66efd7d4f5e70217_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/fluentd-rhel8@sha256:2eb43cd05fa769240e683de25d8913ea1379c0f69d656dec66efd7d4f5e70217?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/fluentd-rhel8\u0026tag=v1.7.4-102"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/kibana6-rhel8@sha256:86302d1e4e1729fd7364b4db5061b4762c683f9d27ed09a7e1489406ac783d21_amd64",
                "product": {
                  "name": "openshift-logging/kibana6-rhel8@sha256:86302d1e4e1729fd7364b4db5061b4762c683f9d27ed09a7e1489406ac783d21_amd64",
                  "product_id": "openshift-logging/kibana6-rhel8@sha256:86302d1e4e1729fd7364b4db5061b4762c683f9d27ed09a7e1489406ac783d21_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kibana6-rhel8@sha256:86302d1e4e1729fd7364b4db5061b4762c683f9d27ed09a7e1489406ac783d21?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/kibana6-rhel8\u0026tag=v6.8.1-108"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/cluster-logging-operator-bundle@sha256:cd21e02ce7d7900dd20083b561b98161199561726c310c1ff3f619b700a660d9_amd64 as a component of OpenShift Logging 5.1",
          "product_id": "8Base-OSE-LOGGING-5.1:openshift-logging/cluster-logging-operator-bundle@sha256:cd21e02ce7d7900dd20083b561b98161199561726c310c1ff3f619b700a660d9_amd64"
        },
        "product_reference": "openshift-logging/cluster-logging-operator-bundle@sha256:cd21e02ce7d7900dd20083b561b98161199561726c310c1ff3f619b700a660d9_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:5f1436f57bc60663619d099cc54eac735a4ea885eb224a659b0aad66f14dcc36_s390x as a component of OpenShift Logging 5.1",
          "product_id": "8Base-OSE-LOGGING-5.1:openshift-logging/cluster-logging-rhel8-operator@sha256:5f1436f57bc60663619d099cc54eac735a4ea885eb224a659b0aad66f14dcc36_s390x"
        },
        "product_reference": "openshift-logging/cluster-logging-rhel8-operator@sha256:5f1436f57bc60663619d099cc54eac735a4ea885eb224a659b0aad66f14dcc36_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:8715b4821f39144aeb5d015e0621c859b45d3175c0f8415bd1542f7f7f063dec_amd64 as a component of OpenShift Logging 5.1",
          "product_id": "8Base-OSE-LOGGING-5.1:openshift-logging/cluster-logging-rhel8-operator@sha256:8715b4821f39144aeb5d015e0621c859b45d3175c0f8415bd1542f7f7f063dec_amd64"
        },
        "product_reference": "openshift-logging/cluster-logging-rhel8-operator@sha256:8715b4821f39144aeb5d015e0621c859b45d3175c0f8415bd1542f7f7f063dec_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:f96340f2ae0699d07b36e2e0e47bdda190635c276eb9122513f57b2f0ffd25f7_ppc64le as a component of OpenShift Logging 5.1",
          "product_id": "8Base-OSE-LOGGING-5.1:openshift-logging/cluster-logging-rhel8-operator@sha256:f96340f2ae0699d07b36e2e0e47bdda190635c276eb9122513f57b2f0ffd25f7_ppc64le"
        },
        "product_reference": "openshift-logging/cluster-logging-rhel8-operator@sha256:f96340f2ae0699d07b36e2e0e47bdda190635c276eb9122513f57b2f0ffd25f7_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-operator-bundle@sha256:8c60be512aa5cbec4247f2bcbcb0d829edc2f4b2c28ebd78673be8c15b4c4d99_amd64 as a component of OpenShift Logging 5.1",
          "product_id": "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-operator-bundle@sha256:8c60be512aa5cbec4247f2bcbcb0d829edc2f4b2c28ebd78673be8c15b4c4d99_amd64"
        },
        "product_reference": "openshift-logging/elasticsearch-operator-bundle@sha256:8c60be512aa5cbec4247f2bcbcb0d829edc2f4b2c28ebd78673be8c15b4c4d99_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:75ad4b059c54e8c089de590a7dd0425a07049fb4721e83e894bf72dba2580fe7_amd64 as a component of OpenShift Logging 5.1",
          "product_id": "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-proxy-rhel8@sha256:75ad4b059c54e8c089de590a7dd0425a07049fb4721e83e894bf72dba2580fe7_amd64"
        },
        "product_reference": "openshift-logging/elasticsearch-proxy-rhel8@sha256:75ad4b059c54e8c089de590a7dd0425a07049fb4721e83e894bf72dba2580fe7_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:7eca37c2de3ab91f5561bc30d6057dcc7e32dd3e41af9c78739b2c840d26f3d4_s390x as a component of OpenShift Logging 5.1",
          "product_id": "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-proxy-rhel8@sha256:7eca37c2de3ab91f5561bc30d6057dcc7e32dd3e41af9c78739b2c840d26f3d4_s390x"
        },
        "product_reference": "openshift-logging/elasticsearch-proxy-rhel8@sha256:7eca37c2de3ab91f5561bc30d6057dcc7e32dd3e41af9c78739b2c840d26f3d4_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:b9025248fa3fe48e38e12409b77b93782a2c2977fd48cf43de74bfbf8ed4a016_ppc64le as a component of OpenShift Logging 5.1",
          "product_id": "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-proxy-rhel8@sha256:b9025248fa3fe48e38e12409b77b93782a2c2977fd48cf43de74bfbf8ed4a016_ppc64le"
        },
        "product_reference": "openshift-logging/elasticsearch-proxy-rhel8@sha256:b9025248fa3fe48e38e12409b77b93782a2c2977fd48cf43de74bfbf8ed4a016_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:0d759e02a84eaf59cffc0143b51fd922363f0488a537562731e5c71bbd555a92_ppc64le as a component of OpenShift Logging 5.1",
          "product_id": "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-rhel8-operator@sha256:0d759e02a84eaf59cffc0143b51fd922363f0488a537562731e5c71bbd555a92_ppc64le"
        },
        "product_reference": "openshift-logging/elasticsearch-rhel8-operator@sha256:0d759e02a84eaf59cffc0143b51fd922363f0488a537562731e5c71bbd555a92_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:747bf587b1cb27d3fc872f40938a8f3ded033c97eab756712ca2a427fbeee4f0_s390x as a component of OpenShift Logging 5.1",
          "product_id": "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-rhel8-operator@sha256:747bf587b1cb27d3fc872f40938a8f3ded033c97eab756712ca2a427fbeee4f0_s390x"
        },
        "product_reference": "openshift-logging/elasticsearch-rhel8-operator@sha256:747bf587b1cb27d3fc872f40938a8f3ded033c97eab756712ca2a427fbeee4f0_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:df696bb6cc563e646f51ccd409c961cfb06b39f361857392ec80f30add0927ab_amd64 as a component of OpenShift Logging 5.1",
          "product_id": "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-rhel8-operator@sha256:df696bb6cc563e646f51ccd409c961cfb06b39f361857392ec80f30add0927ab_amd64"
        },
        "product_reference": "openshift-logging/elasticsearch-rhel8-operator@sha256:df696bb6cc563e646f51ccd409c961cfb06b39f361857392ec80f30add0927ab_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch6-rhel8@sha256:007deae6e82e1d870385f2c9ed90c1783f9fdb3aca0b97349a66a97e4380b9b4_amd64 as a component of OpenShift Logging 5.1",
          "product_id": "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch6-rhel8@sha256:007deae6e82e1d870385f2c9ed90c1783f9fdb3aca0b97349a66a97e4380b9b4_amd64"
        },
        "product_reference": "openshift-logging/elasticsearch6-rhel8@sha256:007deae6e82e1d870385f2c9ed90c1783f9fdb3aca0b97349a66a97e4380b9b4_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch6-rhel8@sha256:3e971f5c333ced1166981d713355fd55f984108cd50bf458b9ea29eb637df9ce_s390x as a component of OpenShift Logging 5.1",
          "product_id": "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch6-rhel8@sha256:3e971f5c333ced1166981d713355fd55f984108cd50bf458b9ea29eb637df9ce_s390x"
        },
        "product_reference": "openshift-logging/elasticsearch6-rhel8@sha256:3e971f5c333ced1166981d713355fd55f984108cd50bf458b9ea29eb637df9ce_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch6-rhel8@sha256:9b1a4b2ca3c32aa6a8a5bbcb28af0e6bbd0ea5368ab317e8a0dc7ba5f9b0ddc4_ppc64le as a component of OpenShift Logging 5.1",
          "product_id": "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch6-rhel8@sha256:9b1a4b2ca3c32aa6a8a5bbcb28af0e6bbd0ea5368ab317e8a0dc7ba5f9b0ddc4_ppc64le"
        },
        "product_reference": "openshift-logging/elasticsearch6-rhel8@sha256:9b1a4b2ca3c32aa6a8a5bbcb28af0e6bbd0ea5368ab317e8a0dc7ba5f9b0ddc4_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/eventrouter-rhel8@sha256:499aa444f1c77cc0e238577b35ce707a6233b7c10695aa058f036694cc65f62d_s390x as a component of OpenShift Logging 5.1",
          "product_id": "8Base-OSE-LOGGING-5.1:openshift-logging/eventrouter-rhel8@sha256:499aa444f1c77cc0e238577b35ce707a6233b7c10695aa058f036694cc65f62d_s390x"
        },
        "product_reference": "openshift-logging/eventrouter-rhel8@sha256:499aa444f1c77cc0e238577b35ce707a6233b7c10695aa058f036694cc65f62d_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/eventrouter-rhel8@sha256:b21561dc5237b5c9bc65ffdfa8e62d364a02631e0e06307883463357229ff06f_amd64 as a component of OpenShift Logging 5.1",
          "product_id": "8Base-OSE-LOGGING-5.1:openshift-logging/eventrouter-rhel8@sha256:b21561dc5237b5c9bc65ffdfa8e62d364a02631e0e06307883463357229ff06f_amd64"
        },
        "product_reference": "openshift-logging/eventrouter-rhel8@sha256:b21561dc5237b5c9bc65ffdfa8e62d364a02631e0e06307883463357229ff06f_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/eventrouter-rhel8@sha256:b7706ebba12fba423afe2b333677aa4fa16ecd72cfcd2c5b076dfb34d5d400e6_ppc64le as a component of OpenShift Logging 5.1",
          "product_id": "8Base-OSE-LOGGING-5.1:openshift-logging/eventrouter-rhel8@sha256:b7706ebba12fba423afe2b333677aa4fa16ecd72cfcd2c5b076dfb34d5d400e6_ppc64le"
        },
        "product_reference": "openshift-logging/eventrouter-rhel8@sha256:b7706ebba12fba423afe2b333677aa4fa16ecd72cfcd2c5b076dfb34d5d400e6_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/fluentd-rhel8@sha256:2eb43cd05fa769240e683de25d8913ea1379c0f69d656dec66efd7d4f5e70217_amd64 as a component of OpenShift Logging 5.1",
          "product_id": "8Base-OSE-LOGGING-5.1:openshift-logging/fluentd-rhel8@sha256:2eb43cd05fa769240e683de25d8913ea1379c0f69d656dec66efd7d4f5e70217_amd64"
        },
        "product_reference": "openshift-logging/fluentd-rhel8@sha256:2eb43cd05fa769240e683de25d8913ea1379c0f69d656dec66efd7d4f5e70217_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/fluentd-rhel8@sha256:63a5e130e712bf0292167f0aa8c3018b77bdb73042160fd14057d4678ff613ff_ppc64le as a component of OpenShift Logging 5.1",
          "product_id": "8Base-OSE-LOGGING-5.1:openshift-logging/fluentd-rhel8@sha256:63a5e130e712bf0292167f0aa8c3018b77bdb73042160fd14057d4678ff613ff_ppc64le"
        },
        "product_reference": "openshift-logging/fluentd-rhel8@sha256:63a5e130e712bf0292167f0aa8c3018b77bdb73042160fd14057d4678ff613ff_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/fluentd-rhel8@sha256:dd94d77116595d5aede41e3fdd38681767a0ac294b743b9d608268fef97720d1_s390x as a component of OpenShift Logging 5.1",
          "product_id": "8Base-OSE-LOGGING-5.1:openshift-logging/fluentd-rhel8@sha256:dd94d77116595d5aede41e3fdd38681767a0ac294b743b9d608268fef97720d1_s390x"
        },
        "product_reference": "openshift-logging/fluentd-rhel8@sha256:dd94d77116595d5aede41e3fdd38681767a0ac294b743b9d608268fef97720d1_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/kibana6-rhel8@sha256:318f21b10f1b22d14a0bf0d895c597e29f498442bc90fb5c26886e696fbe68a5_s390x as a component of OpenShift Logging 5.1",
          "product_id": "8Base-OSE-LOGGING-5.1:openshift-logging/kibana6-rhel8@sha256:318f21b10f1b22d14a0bf0d895c597e29f498442bc90fb5c26886e696fbe68a5_s390x"
        },
        "product_reference": "openshift-logging/kibana6-rhel8@sha256:318f21b10f1b22d14a0bf0d895c597e29f498442bc90fb5c26886e696fbe68a5_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/kibana6-rhel8@sha256:86302d1e4e1729fd7364b4db5061b4762c683f9d27ed09a7e1489406ac783d21_amd64 as a component of OpenShift Logging 5.1",
          "product_id": "8Base-OSE-LOGGING-5.1:openshift-logging/kibana6-rhel8@sha256:86302d1e4e1729fd7364b4db5061b4762c683f9d27ed09a7e1489406ac783d21_amd64"
        },
        "product_reference": "openshift-logging/kibana6-rhel8@sha256:86302d1e4e1729fd7364b4db5061b4762c683f9d27ed09a7e1489406ac783d21_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/kibana6-rhel8@sha256:b43d04bc71797caab0d1b6bb5f14d18a04b09fee5272e9e03d50056dbb2116fc_ppc64le as a component of OpenShift Logging 5.1",
          "product_id": "8Base-OSE-LOGGING-5.1:openshift-logging/kibana6-rhel8@sha256:b43d04bc71797caab0d1b6bb5f14d18a04b09fee5272e9e03d50056dbb2116fc_ppc64le"
        },
        "product_reference": "openshift-logging/kibana6-rhel8@sha256:b43d04bc71797caab0d1b6bb5f14d18a04b09fee5272e9e03d50056dbb2116fc_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-27292",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2021-03-17T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-OSE-LOGGING-5.1:openshift-logging/cluster-logging-operator-bundle@sha256:cd21e02ce7d7900dd20083b561b98161199561726c310c1ff3f619b700a660d9_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/cluster-logging-rhel8-operator@sha256:5f1436f57bc60663619d099cc54eac735a4ea885eb224a659b0aad66f14dcc36_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/cluster-logging-rhel8-operator@sha256:8715b4821f39144aeb5d015e0621c859b45d3175c0f8415bd1542f7f7f063dec_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/cluster-logging-rhel8-operator@sha256:f96340f2ae0699d07b36e2e0e47bdda190635c276eb9122513f57b2f0ffd25f7_ppc64le",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-operator-bundle@sha256:8c60be512aa5cbec4247f2bcbcb0d829edc2f4b2c28ebd78673be8c15b4c4d99_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-proxy-rhel8@sha256:75ad4b059c54e8c089de590a7dd0425a07049fb4721e83e894bf72dba2580fe7_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-proxy-rhel8@sha256:7eca37c2de3ab91f5561bc30d6057dcc7e32dd3e41af9c78739b2c840d26f3d4_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-proxy-rhel8@sha256:b9025248fa3fe48e38e12409b77b93782a2c2977fd48cf43de74bfbf8ed4a016_ppc64le",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-rhel8-operator@sha256:0d759e02a84eaf59cffc0143b51fd922363f0488a537562731e5c71bbd555a92_ppc64le",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-rhel8-operator@sha256:747bf587b1cb27d3fc872f40938a8f3ded033c97eab756712ca2a427fbeee4f0_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-rhel8-operator@sha256:df696bb6cc563e646f51ccd409c961cfb06b39f361857392ec80f30add0927ab_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch6-rhel8@sha256:007deae6e82e1d870385f2c9ed90c1783f9fdb3aca0b97349a66a97e4380b9b4_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch6-rhel8@sha256:3e971f5c333ced1166981d713355fd55f984108cd50bf458b9ea29eb637df9ce_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch6-rhel8@sha256:9b1a4b2ca3c32aa6a8a5bbcb28af0e6bbd0ea5368ab317e8a0dc7ba5f9b0ddc4_ppc64le",
            "8Base-OSE-LOGGING-5.1:openshift-logging/eventrouter-rhel8@sha256:499aa444f1c77cc0e238577b35ce707a6233b7c10695aa058f036694cc65f62d_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/eventrouter-rhel8@sha256:b21561dc5237b5c9bc65ffdfa8e62d364a02631e0e06307883463357229ff06f_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/eventrouter-rhel8@sha256:b7706ebba12fba423afe2b333677aa4fa16ecd72cfcd2c5b076dfb34d5d400e6_ppc64le",
            "8Base-OSE-LOGGING-5.1:openshift-logging/fluentd-rhel8@sha256:2eb43cd05fa769240e683de25d8913ea1379c0f69d656dec66efd7d4f5e70217_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/fluentd-rhel8@sha256:63a5e130e712bf0292167f0aa8c3018b77bdb73042160fd14057d4678ff613ff_ppc64le",
            "8Base-OSE-LOGGING-5.1:openshift-logging/fluentd-rhel8@sha256:dd94d77116595d5aede41e3fdd38681767a0ac294b743b9d608268fef97720d1_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1940613"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A regular expression denial of service (ReDoS) vulnerability was found in the npm library `ua-parser-js`. If a supplied user agent matches the `Noble` string and contains many spaces then the regex will conduct backtracking, taking an ever increasing amount of time depending on the number of spaces supplied. An attacker can use this vulnerability to potentially craft a malicious user agent resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs-ua-parser-js: ReDoS via malicious User-Agent header",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "While some components do package a vulnerable version of ua-parser-js, access to them requires OpenShift OAuth credentials and hence have been marked with a Low impact. This applies to the following products:\n  - OpenShift Container Platform (OCP)\n  - OpenShift ServiceMesh (OSSM) \n  - Red Hat OpenShift Jaeger (RHOSJ)\n  - Red Hat OpenShift Logging\n\nThe OCP presto-container does ship the vulnerable component, however since OCP 4.6 the Metering product has been deprecated [1], set as wont-fix and may be fixed in a future release.\n\nRed Hat Advanced Cluster Management for Kubernetes (RHACM) ships graphql-tools that pulls 0.7.23 version of ua-parser-js that uses the affected code.\n\n[1] - https://access.redhat.com/solutions/5707561",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-OSE-LOGGING-5.1:openshift-logging/kibana6-rhel8@sha256:318f21b10f1b22d14a0bf0d895c597e29f498442bc90fb5c26886e696fbe68a5_s390x",
          "8Base-OSE-LOGGING-5.1:openshift-logging/kibana6-rhel8@sha256:86302d1e4e1729fd7364b4db5061b4762c683f9d27ed09a7e1489406ac783d21_amd64",
          "8Base-OSE-LOGGING-5.1:openshift-logging/kibana6-rhel8@sha256:b43d04bc71797caab0d1b6bb5f14d18a04b09fee5272e9e03d50056dbb2116fc_ppc64le"
        ],
        "known_not_affected": [
          "8Base-OSE-LOGGING-5.1:openshift-logging/cluster-logging-operator-bundle@sha256:cd21e02ce7d7900dd20083b561b98161199561726c310c1ff3f619b700a660d9_amd64",
          "8Base-OSE-LOGGING-5.1:openshift-logging/cluster-logging-rhel8-operator@sha256:5f1436f57bc60663619d099cc54eac735a4ea885eb224a659b0aad66f14dcc36_s390x",
          "8Base-OSE-LOGGING-5.1:openshift-logging/cluster-logging-rhel8-operator@sha256:8715b4821f39144aeb5d015e0621c859b45d3175c0f8415bd1542f7f7f063dec_amd64",
          "8Base-OSE-LOGGING-5.1:openshift-logging/cluster-logging-rhel8-operator@sha256:f96340f2ae0699d07b36e2e0e47bdda190635c276eb9122513f57b2f0ffd25f7_ppc64le",
          "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-operator-bundle@sha256:8c60be512aa5cbec4247f2bcbcb0d829edc2f4b2c28ebd78673be8c15b4c4d99_amd64",
          "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-proxy-rhel8@sha256:75ad4b059c54e8c089de590a7dd0425a07049fb4721e83e894bf72dba2580fe7_amd64",
          "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-proxy-rhel8@sha256:7eca37c2de3ab91f5561bc30d6057dcc7e32dd3e41af9c78739b2c840d26f3d4_s390x",
          "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-proxy-rhel8@sha256:b9025248fa3fe48e38e12409b77b93782a2c2977fd48cf43de74bfbf8ed4a016_ppc64le",
          "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-rhel8-operator@sha256:0d759e02a84eaf59cffc0143b51fd922363f0488a537562731e5c71bbd555a92_ppc64le",
          "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-rhel8-operator@sha256:747bf587b1cb27d3fc872f40938a8f3ded033c97eab756712ca2a427fbeee4f0_s390x",
          "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-rhel8-operator@sha256:df696bb6cc563e646f51ccd409c961cfb06b39f361857392ec80f30add0927ab_amd64",
          "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch6-rhel8@sha256:007deae6e82e1d870385f2c9ed90c1783f9fdb3aca0b97349a66a97e4380b9b4_amd64",
          "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch6-rhel8@sha256:3e971f5c333ced1166981d713355fd55f984108cd50bf458b9ea29eb637df9ce_s390x",
          "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch6-rhel8@sha256:9b1a4b2ca3c32aa6a8a5bbcb28af0e6bbd0ea5368ab317e8a0dc7ba5f9b0ddc4_ppc64le",
          "8Base-OSE-LOGGING-5.1:openshift-logging/eventrouter-rhel8@sha256:499aa444f1c77cc0e238577b35ce707a6233b7c10695aa058f036694cc65f62d_s390x",
          "8Base-OSE-LOGGING-5.1:openshift-logging/eventrouter-rhel8@sha256:b21561dc5237b5c9bc65ffdfa8e62d364a02631e0e06307883463357229ff06f_amd64",
          "8Base-OSE-LOGGING-5.1:openshift-logging/eventrouter-rhel8@sha256:b7706ebba12fba423afe2b333677aa4fa16ecd72cfcd2c5b076dfb34d5d400e6_ppc64le",
          "8Base-OSE-LOGGING-5.1:openshift-logging/fluentd-rhel8@sha256:2eb43cd05fa769240e683de25d8913ea1379c0f69d656dec66efd7d4f5e70217_amd64",
          "8Base-OSE-LOGGING-5.1:openshift-logging/fluentd-rhel8@sha256:63a5e130e712bf0292167f0aa8c3018b77bdb73042160fd14057d4678ff613ff_ppc64le",
          "8Base-OSE-LOGGING-5.1:openshift-logging/fluentd-rhel8@sha256:dd94d77116595d5aede41e3fdd38681767a0ac294b743b9d608268fef97720d1_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-27292"
        },
        {
          "category": "external",
          "summary": "RHBZ#1940613",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1940613"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-27292",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-27292"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-27292",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27292"
        },
        {
          "category": "external",
          "summary": "https://gist.github.com/b-c-ds/6941d80d6b4e694df4bc269493b7be76",
          "url": "https://gist.github.com/b-c-ds/6941d80d6b4e694df4bc269493b7be76"
        }
      ],
      "release_date": "2021-02-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-01-20T21:39:00+00:00",
          "details": "For OpenShift Container Platform 4.8 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nFor Red Hat OpenShift Logging 5.1, see the following instructions to apply this update:\n\nhttps://docs.openshift.com/container-platform/4.8/logging/cluster-logging-upgrading.html",
          "product_ids": [
            "8Base-OSE-LOGGING-5.1:openshift-logging/kibana6-rhel8@sha256:318f21b10f1b22d14a0bf0d895c597e29f498442bc90fb5c26886e696fbe68a5_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/kibana6-rhel8@sha256:86302d1e4e1729fd7364b4db5061b4762c683f9d27ed09a7e1489406ac783d21_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/kibana6-rhel8@sha256:b43d04bc71797caab0d1b6bb5f14d18a04b09fee5272e9e03d50056dbb2116fc_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0226"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-OSE-LOGGING-5.1:openshift-logging/cluster-logging-operator-bundle@sha256:cd21e02ce7d7900dd20083b561b98161199561726c310c1ff3f619b700a660d9_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/cluster-logging-rhel8-operator@sha256:5f1436f57bc60663619d099cc54eac735a4ea885eb224a659b0aad66f14dcc36_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/cluster-logging-rhel8-operator@sha256:8715b4821f39144aeb5d015e0621c859b45d3175c0f8415bd1542f7f7f063dec_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/cluster-logging-rhel8-operator@sha256:f96340f2ae0699d07b36e2e0e47bdda190635c276eb9122513f57b2f0ffd25f7_ppc64le",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-operator-bundle@sha256:8c60be512aa5cbec4247f2bcbcb0d829edc2f4b2c28ebd78673be8c15b4c4d99_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-proxy-rhel8@sha256:75ad4b059c54e8c089de590a7dd0425a07049fb4721e83e894bf72dba2580fe7_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-proxy-rhel8@sha256:7eca37c2de3ab91f5561bc30d6057dcc7e32dd3e41af9c78739b2c840d26f3d4_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-proxy-rhel8@sha256:b9025248fa3fe48e38e12409b77b93782a2c2977fd48cf43de74bfbf8ed4a016_ppc64le",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-rhel8-operator@sha256:0d759e02a84eaf59cffc0143b51fd922363f0488a537562731e5c71bbd555a92_ppc64le",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-rhel8-operator@sha256:747bf587b1cb27d3fc872f40938a8f3ded033c97eab756712ca2a427fbeee4f0_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-rhel8-operator@sha256:df696bb6cc563e646f51ccd409c961cfb06b39f361857392ec80f30add0927ab_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch6-rhel8@sha256:007deae6e82e1d870385f2c9ed90c1783f9fdb3aca0b97349a66a97e4380b9b4_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch6-rhel8@sha256:3e971f5c333ced1166981d713355fd55f984108cd50bf458b9ea29eb637df9ce_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch6-rhel8@sha256:9b1a4b2ca3c32aa6a8a5bbcb28af0e6bbd0ea5368ab317e8a0dc7ba5f9b0ddc4_ppc64le",
            "8Base-OSE-LOGGING-5.1:openshift-logging/eventrouter-rhel8@sha256:499aa444f1c77cc0e238577b35ce707a6233b7c10695aa058f036694cc65f62d_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/eventrouter-rhel8@sha256:b21561dc5237b5c9bc65ffdfa8e62d364a02631e0e06307883463357229ff06f_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/eventrouter-rhel8@sha256:b7706ebba12fba423afe2b333677aa4fa16ecd72cfcd2c5b076dfb34d5d400e6_ppc64le",
            "8Base-OSE-LOGGING-5.1:openshift-logging/fluentd-rhel8@sha256:2eb43cd05fa769240e683de25d8913ea1379c0f69d656dec66efd7d4f5e70217_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/fluentd-rhel8@sha256:63a5e130e712bf0292167f0aa8c3018b77bdb73042160fd14057d4678ff613ff_ppc64le",
            "8Base-OSE-LOGGING-5.1:openshift-logging/fluentd-rhel8@sha256:dd94d77116595d5aede41e3fdd38681767a0ac294b743b9d608268fef97720d1_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/kibana6-rhel8@sha256:318f21b10f1b22d14a0bf0d895c597e29f498442bc90fb5c26886e696fbe68a5_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/kibana6-rhel8@sha256:86302d1e4e1729fd7364b4db5061b4762c683f9d27ed09a7e1489406ac783d21_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/kibana6-rhel8@sha256:b43d04bc71797caab0d1b6bb5f14d18a04b09fee5272e9e03d50056dbb2116fc_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "nodejs-ua-parser-js: ReDoS via malicious User-Agent header"
    },
    {
      "cve": "CVE-2021-44832",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2021-12-28T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-OSE-LOGGING-5.1:openshift-logging/cluster-logging-operator-bundle@sha256:cd21e02ce7d7900dd20083b561b98161199561726c310c1ff3f619b700a660d9_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/cluster-logging-rhel8-operator@sha256:5f1436f57bc60663619d099cc54eac735a4ea885eb224a659b0aad66f14dcc36_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/cluster-logging-rhel8-operator@sha256:8715b4821f39144aeb5d015e0621c859b45d3175c0f8415bd1542f7f7f063dec_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/cluster-logging-rhel8-operator@sha256:f96340f2ae0699d07b36e2e0e47bdda190635c276eb9122513f57b2f0ffd25f7_ppc64le",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-operator-bundle@sha256:8c60be512aa5cbec4247f2bcbcb0d829edc2f4b2c28ebd78673be8c15b4c4d99_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-proxy-rhel8@sha256:75ad4b059c54e8c089de590a7dd0425a07049fb4721e83e894bf72dba2580fe7_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-proxy-rhel8@sha256:7eca37c2de3ab91f5561bc30d6057dcc7e32dd3e41af9c78739b2c840d26f3d4_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-proxy-rhel8@sha256:b9025248fa3fe48e38e12409b77b93782a2c2977fd48cf43de74bfbf8ed4a016_ppc64le",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-rhel8-operator@sha256:0d759e02a84eaf59cffc0143b51fd922363f0488a537562731e5c71bbd555a92_ppc64le",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-rhel8-operator@sha256:747bf587b1cb27d3fc872f40938a8f3ded033c97eab756712ca2a427fbeee4f0_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-rhel8-operator@sha256:df696bb6cc563e646f51ccd409c961cfb06b39f361857392ec80f30add0927ab_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/eventrouter-rhel8@sha256:499aa444f1c77cc0e238577b35ce707a6233b7c10695aa058f036694cc65f62d_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/eventrouter-rhel8@sha256:b21561dc5237b5c9bc65ffdfa8e62d364a02631e0e06307883463357229ff06f_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/eventrouter-rhel8@sha256:b7706ebba12fba423afe2b333677aa4fa16ecd72cfcd2c5b076dfb34d5d400e6_ppc64le",
            "8Base-OSE-LOGGING-5.1:openshift-logging/fluentd-rhel8@sha256:2eb43cd05fa769240e683de25d8913ea1379c0f69d656dec66efd7d4f5e70217_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/fluentd-rhel8@sha256:63a5e130e712bf0292167f0aa8c3018b77bdb73042160fd14057d4678ff613ff_ppc64le",
            "8Base-OSE-LOGGING-5.1:openshift-logging/fluentd-rhel8@sha256:dd94d77116595d5aede41e3fdd38681767a0ac294b743b9d608268fef97720d1_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/kibana6-rhel8@sha256:318f21b10f1b22d14a0bf0d895c597e29f498442bc90fb5c26886e696fbe68a5_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/kibana6-rhel8@sha256:86302d1e4e1729fd7364b4db5061b4762c683f9d27ed09a7e1489406ac783d21_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/kibana6-rhel8@sha256:b43d04bc71797caab0d1b6bb5f14d18a04b09fee5272e9e03d50056dbb2116fc_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2035951"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j-core: remote code execution via JDBC Appender",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Log4j 1.x is not impacted by this vulnerability. Therefore versions of log4j shipped with Red Hat Enterprise Linux are NOT affected by this flaw.\n\nFor Elasticsearch, as shipped in OpenShift Container Platform and OpenShift Logging, access to the log4j2.properties configuration is limited only to the cluster administrators and exploitation requires cluster logging changes, what reduced the impact of this vulnerability significantly [0].\n\n[0] https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476#update-jan-6-5",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch6-rhel8@sha256:007deae6e82e1d870385f2c9ed90c1783f9fdb3aca0b97349a66a97e4380b9b4_amd64",
          "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch6-rhel8@sha256:3e971f5c333ced1166981d713355fd55f984108cd50bf458b9ea29eb637df9ce_s390x",
          "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch6-rhel8@sha256:9b1a4b2ca3c32aa6a8a5bbcb28af0e6bbd0ea5368ab317e8a0dc7ba5f9b0ddc4_ppc64le"
        ],
        "known_not_affected": [
          "8Base-OSE-LOGGING-5.1:openshift-logging/cluster-logging-operator-bundle@sha256:cd21e02ce7d7900dd20083b561b98161199561726c310c1ff3f619b700a660d9_amd64",
          "8Base-OSE-LOGGING-5.1:openshift-logging/cluster-logging-rhel8-operator@sha256:5f1436f57bc60663619d099cc54eac735a4ea885eb224a659b0aad66f14dcc36_s390x",
          "8Base-OSE-LOGGING-5.1:openshift-logging/cluster-logging-rhel8-operator@sha256:8715b4821f39144aeb5d015e0621c859b45d3175c0f8415bd1542f7f7f063dec_amd64",
          "8Base-OSE-LOGGING-5.1:openshift-logging/cluster-logging-rhel8-operator@sha256:f96340f2ae0699d07b36e2e0e47bdda190635c276eb9122513f57b2f0ffd25f7_ppc64le",
          "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-operator-bundle@sha256:8c60be512aa5cbec4247f2bcbcb0d829edc2f4b2c28ebd78673be8c15b4c4d99_amd64",
          "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-proxy-rhel8@sha256:75ad4b059c54e8c089de590a7dd0425a07049fb4721e83e894bf72dba2580fe7_amd64",
          "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-proxy-rhel8@sha256:7eca37c2de3ab91f5561bc30d6057dcc7e32dd3e41af9c78739b2c840d26f3d4_s390x",
          "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-proxy-rhel8@sha256:b9025248fa3fe48e38e12409b77b93782a2c2977fd48cf43de74bfbf8ed4a016_ppc64le",
          "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-rhel8-operator@sha256:0d759e02a84eaf59cffc0143b51fd922363f0488a537562731e5c71bbd555a92_ppc64le",
          "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-rhel8-operator@sha256:747bf587b1cb27d3fc872f40938a8f3ded033c97eab756712ca2a427fbeee4f0_s390x",
          "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-rhel8-operator@sha256:df696bb6cc563e646f51ccd409c961cfb06b39f361857392ec80f30add0927ab_amd64",
          "8Base-OSE-LOGGING-5.1:openshift-logging/eventrouter-rhel8@sha256:499aa444f1c77cc0e238577b35ce707a6233b7c10695aa058f036694cc65f62d_s390x",
          "8Base-OSE-LOGGING-5.1:openshift-logging/eventrouter-rhel8@sha256:b21561dc5237b5c9bc65ffdfa8e62d364a02631e0e06307883463357229ff06f_amd64",
          "8Base-OSE-LOGGING-5.1:openshift-logging/eventrouter-rhel8@sha256:b7706ebba12fba423afe2b333677aa4fa16ecd72cfcd2c5b076dfb34d5d400e6_ppc64le",
          "8Base-OSE-LOGGING-5.1:openshift-logging/fluentd-rhel8@sha256:2eb43cd05fa769240e683de25d8913ea1379c0f69d656dec66efd7d4f5e70217_amd64",
          "8Base-OSE-LOGGING-5.1:openshift-logging/fluentd-rhel8@sha256:63a5e130e712bf0292167f0aa8c3018b77bdb73042160fd14057d4678ff613ff_ppc64le",
          "8Base-OSE-LOGGING-5.1:openshift-logging/fluentd-rhel8@sha256:dd94d77116595d5aede41e3fdd38681767a0ac294b743b9d608268fef97720d1_s390x",
          "8Base-OSE-LOGGING-5.1:openshift-logging/kibana6-rhel8@sha256:318f21b10f1b22d14a0bf0d895c597e29f498442bc90fb5c26886e696fbe68a5_s390x",
          "8Base-OSE-LOGGING-5.1:openshift-logging/kibana6-rhel8@sha256:86302d1e4e1729fd7364b4db5061b4762c683f9d27ed09a7e1489406ac783d21_amd64",
          "8Base-OSE-LOGGING-5.1:openshift-logging/kibana6-rhel8@sha256:b43d04bc71797caab0d1b6bb5f14d18a04b09fee5272e9e03d50056dbb2116fc_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-44832"
        },
        {
          "category": "external",
          "summary": "RHBZ#2035951",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2035951"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44832",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-44832"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44832",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44832"
        },
        {
          "category": "external",
          "summary": "https://issues.apache.org/jira/browse/LOG4J2-3293",
          "url": "https://issues.apache.org/jira/browse/LOG4J2-3293"
        }
      ],
      "release_date": "2021-12-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-01-20T21:39:00+00:00",
          "details": "For OpenShift Container Platform 4.8 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nFor Red Hat OpenShift Logging 5.1, see the following instructions to apply this update:\n\nhttps://docs.openshift.com/container-platform/4.8/logging/cluster-logging-upgrading.html",
          "product_ids": [
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch6-rhel8@sha256:007deae6e82e1d870385f2c9ed90c1783f9fdb3aca0b97349a66a97e4380b9b4_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch6-rhel8@sha256:3e971f5c333ced1166981d713355fd55f984108cd50bf458b9ea29eb637df9ce_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch6-rhel8@sha256:9b1a4b2ca3c32aa6a8a5bbcb28af0e6bbd0ea5368ab317e8a0dc7ba5f9b0ddc4_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0226"
        },
        {
          "category": "workaround",
          "details": "As per upstream:\n- In prior releases confirm that if the JDBC Appender is being used it is not configured to use any protocol other than Java.\n- Note that only the log4j-core JAR file is impacted by this vulnerability. Applications using only the log4j-api JAR file without the log4j-core JAR file are not impacted by this vulnerability.",
          "product_ids": [
            "8Base-OSE-LOGGING-5.1:openshift-logging/cluster-logging-operator-bundle@sha256:cd21e02ce7d7900dd20083b561b98161199561726c310c1ff3f619b700a660d9_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/cluster-logging-rhel8-operator@sha256:5f1436f57bc60663619d099cc54eac735a4ea885eb224a659b0aad66f14dcc36_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/cluster-logging-rhel8-operator@sha256:8715b4821f39144aeb5d015e0621c859b45d3175c0f8415bd1542f7f7f063dec_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/cluster-logging-rhel8-operator@sha256:f96340f2ae0699d07b36e2e0e47bdda190635c276eb9122513f57b2f0ffd25f7_ppc64le",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-operator-bundle@sha256:8c60be512aa5cbec4247f2bcbcb0d829edc2f4b2c28ebd78673be8c15b4c4d99_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-proxy-rhel8@sha256:75ad4b059c54e8c089de590a7dd0425a07049fb4721e83e894bf72dba2580fe7_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-proxy-rhel8@sha256:7eca37c2de3ab91f5561bc30d6057dcc7e32dd3e41af9c78739b2c840d26f3d4_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-proxy-rhel8@sha256:b9025248fa3fe48e38e12409b77b93782a2c2977fd48cf43de74bfbf8ed4a016_ppc64le",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-rhel8-operator@sha256:0d759e02a84eaf59cffc0143b51fd922363f0488a537562731e5c71bbd555a92_ppc64le",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-rhel8-operator@sha256:747bf587b1cb27d3fc872f40938a8f3ded033c97eab756712ca2a427fbeee4f0_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-rhel8-operator@sha256:df696bb6cc563e646f51ccd409c961cfb06b39f361857392ec80f30add0927ab_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch6-rhel8@sha256:007deae6e82e1d870385f2c9ed90c1783f9fdb3aca0b97349a66a97e4380b9b4_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch6-rhel8@sha256:3e971f5c333ced1166981d713355fd55f984108cd50bf458b9ea29eb637df9ce_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch6-rhel8@sha256:9b1a4b2ca3c32aa6a8a5bbcb28af0e6bbd0ea5368ab317e8a0dc7ba5f9b0ddc4_ppc64le",
            "8Base-OSE-LOGGING-5.1:openshift-logging/eventrouter-rhel8@sha256:499aa444f1c77cc0e238577b35ce707a6233b7c10695aa058f036694cc65f62d_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/eventrouter-rhel8@sha256:b21561dc5237b5c9bc65ffdfa8e62d364a02631e0e06307883463357229ff06f_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/eventrouter-rhel8@sha256:b7706ebba12fba423afe2b333677aa4fa16ecd72cfcd2c5b076dfb34d5d400e6_ppc64le",
            "8Base-OSE-LOGGING-5.1:openshift-logging/fluentd-rhel8@sha256:2eb43cd05fa769240e683de25d8913ea1379c0f69d656dec66efd7d4f5e70217_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/fluentd-rhel8@sha256:63a5e130e712bf0292167f0aa8c3018b77bdb73042160fd14057d4678ff613ff_ppc64le",
            "8Base-OSE-LOGGING-5.1:openshift-logging/fluentd-rhel8@sha256:dd94d77116595d5aede41e3fdd38681767a0ac294b743b9d608268fef97720d1_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/kibana6-rhel8@sha256:318f21b10f1b22d14a0bf0d895c597e29f498442bc90fb5c26886e696fbe68a5_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/kibana6-rhel8@sha256:86302d1e4e1729fd7364b4db5061b4762c683f9d27ed09a7e1489406ac783d21_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/kibana6-rhel8@sha256:b43d04bc71797caab0d1b6bb5f14d18a04b09fee5272e9e03d50056dbb2116fc_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-OSE-LOGGING-5.1:openshift-logging/cluster-logging-operator-bundle@sha256:cd21e02ce7d7900dd20083b561b98161199561726c310c1ff3f619b700a660d9_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/cluster-logging-rhel8-operator@sha256:5f1436f57bc60663619d099cc54eac735a4ea885eb224a659b0aad66f14dcc36_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/cluster-logging-rhel8-operator@sha256:8715b4821f39144aeb5d015e0621c859b45d3175c0f8415bd1542f7f7f063dec_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/cluster-logging-rhel8-operator@sha256:f96340f2ae0699d07b36e2e0e47bdda190635c276eb9122513f57b2f0ffd25f7_ppc64le",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-operator-bundle@sha256:8c60be512aa5cbec4247f2bcbcb0d829edc2f4b2c28ebd78673be8c15b4c4d99_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-proxy-rhel8@sha256:75ad4b059c54e8c089de590a7dd0425a07049fb4721e83e894bf72dba2580fe7_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-proxy-rhel8@sha256:7eca37c2de3ab91f5561bc30d6057dcc7e32dd3e41af9c78739b2c840d26f3d4_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-proxy-rhel8@sha256:b9025248fa3fe48e38e12409b77b93782a2c2977fd48cf43de74bfbf8ed4a016_ppc64le",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-rhel8-operator@sha256:0d759e02a84eaf59cffc0143b51fd922363f0488a537562731e5c71bbd555a92_ppc64le",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-rhel8-operator@sha256:747bf587b1cb27d3fc872f40938a8f3ded033c97eab756712ca2a427fbeee4f0_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch-rhel8-operator@sha256:df696bb6cc563e646f51ccd409c961cfb06b39f361857392ec80f30add0927ab_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch6-rhel8@sha256:007deae6e82e1d870385f2c9ed90c1783f9fdb3aca0b97349a66a97e4380b9b4_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch6-rhel8@sha256:3e971f5c333ced1166981d713355fd55f984108cd50bf458b9ea29eb637df9ce_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/elasticsearch6-rhel8@sha256:9b1a4b2ca3c32aa6a8a5bbcb28af0e6bbd0ea5368ab317e8a0dc7ba5f9b0ddc4_ppc64le",
            "8Base-OSE-LOGGING-5.1:openshift-logging/eventrouter-rhel8@sha256:499aa444f1c77cc0e238577b35ce707a6233b7c10695aa058f036694cc65f62d_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/eventrouter-rhel8@sha256:b21561dc5237b5c9bc65ffdfa8e62d364a02631e0e06307883463357229ff06f_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/eventrouter-rhel8@sha256:b7706ebba12fba423afe2b333677aa4fa16ecd72cfcd2c5b076dfb34d5d400e6_ppc64le",
            "8Base-OSE-LOGGING-5.1:openshift-logging/fluentd-rhel8@sha256:2eb43cd05fa769240e683de25d8913ea1379c0f69d656dec66efd7d4f5e70217_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/fluentd-rhel8@sha256:63a5e130e712bf0292167f0aa8c3018b77bdb73042160fd14057d4678ff613ff_ppc64le",
            "8Base-OSE-LOGGING-5.1:openshift-logging/fluentd-rhel8@sha256:dd94d77116595d5aede41e3fdd38681767a0ac294b743b9d608268fef97720d1_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/kibana6-rhel8@sha256:318f21b10f1b22d14a0bf0d895c597e29f498442bc90fb5c26886e696fbe68a5_s390x",
            "8Base-OSE-LOGGING-5.1:openshift-logging/kibana6-rhel8@sha256:86302d1e4e1729fd7364b4db5061b4762c683f9d27ed09a7e1489406ac783d21_amd64",
            "8Base-OSE-LOGGING-5.1:openshift-logging/kibana6-rhel8@sha256:b43d04bc71797caab0d1b6bb5f14d18a04b09fee5272e9e03d50056dbb2116fc_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "log4j-core: remote code execution via JDBC Appender"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for OpenShift Logging (5.3.3)\n\nRed Hat Product Security has rated this update as having a security impact of\nModerate. A Common Vulnerability Scoring System (CVSS) base score, which gives\na detailed severity rating, is available for each vulnerability from the CVE\nlink(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Openshift Logging Bug Fix Release (5.3.3)\n\nSecurity Fix(es):\n\n* log4j-core: remote code execution via JDBC Appender (CVE-2021-44832)\n\n* nodejs-ua-parser-js: ReDoS via malicious User-Agent header (CVE-2021-27292)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2022:0227",
        "url": "https://access.redhat.com/errata/RHSA-2022:0227"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "1940613",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1940613"
      },
      {
        "category": "external",
        "summary": "2035951",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2035951"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0227.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat OpenShift Enterprise Logging bug fix and security update (5.3.3)",
    "tracking": {
      "current_release_date": "2026-05-29T20:04:08+00:00",
      "generator": {
        "date": "2026-05-29T20:04:08+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.1"
        }
      },
      "id": "RHSA-2022:0227",
      "initial_release_date": "2022-01-20T21:40:25+00:00",
      "revision_history": [
        {
          "date": "2022-01-20T21:40:25+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2022-01-20T21:40:25+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-29T20:04:08+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "OpenShift Logging 5.3",
                "product": {
                  "name": "OpenShift Logging 5.3",
                  "product_id": "8Base-OSE-LOGGING-5.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:logging:5.3::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Enterprise"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:74e4ae6c04abc489b90cab07c40f24f68ab7f92e366d3661ba3130ca6fa205c9_amd64",
                "product": {
                  "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:74e4ae6c04abc489b90cab07c40f24f68ab7f92e366d3661ba3130ca6fa205c9_amd64",
                  "product_id": "openshift-logging/cluster-logging-rhel8-operator@sha256:74e4ae6c04abc489b90cab07c40f24f68ab7f92e366d3661ba3130ca6fa205c9_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cluster-logging-rhel8-operator@sha256:74e4ae6c04abc489b90cab07c40f24f68ab7f92e366d3661ba3130ca6fa205c9?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel8-operator\u0026tag=v5.3.3-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/cluster-logging-operator-bundle@sha256:1eab02e25f64839b15747d2bb8e0e6f8c3f632e9372a5ee926cde2c1e5cbc998_amd64",
                "product": {
                  "name": "openshift-logging/cluster-logging-operator-bundle@sha256:1eab02e25f64839b15747d2bb8e0e6f8c3f632e9372a5ee926cde2c1e5cbc998_amd64",
                  "product_id": "openshift-logging/cluster-logging-operator-bundle@sha256:1eab02e25f64839b15747d2bb8e0e6f8c3f632e9372a5ee926cde2c1e5cbc998_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cluster-logging-operator-bundle@sha256:1eab02e25f64839b15747d2bb8e0e6f8c3f632e9372a5ee926cde2c1e5cbc998?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-operator-bundle\u0026tag=v5.3.3-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:1e342d10db70e1b160f906c65e6caa25aa64c519dd7ae7e8233fe2fe65121207_amd64",
                "product": {
                  "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:1e342d10db70e1b160f906c65e6caa25aa64c519dd7ae7e8233fe2fe65121207_amd64",
                  "product_id": "openshift-logging/elasticsearch-rhel8-operator@sha256:1e342d10db70e1b160f906c65e6caa25aa64c519dd7ae7e8233fe2fe65121207_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-rhel8-operator@sha256:1e342d10db70e1b160f906c65e6caa25aa64c519dd7ae7e8233fe2fe65121207?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-rhel8-operator\u0026tag=v5.3.3-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-operator-bundle@sha256:eec91dbe056a85b3a8b61c5ce4d9383e182440f5ea496fac64a22cd7920daf5f_amd64",
                "product": {
                  "name": "openshift-logging/elasticsearch-operator-bundle@sha256:eec91dbe056a85b3a8b61c5ce4d9383e182440f5ea496fac64a22cd7920daf5f_amd64",
                  "product_id": "openshift-logging/elasticsearch-operator-bundle@sha256:eec91dbe056a85b3a8b61c5ce4d9383e182440f5ea496fac64a22cd7920daf5f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-operator-bundle@sha256:eec91dbe056a85b3a8b61c5ce4d9383e182440f5ea496fac64a22cd7920daf5f?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-operator-bundle\u0026tag=v5.3.3-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:37eda3069f8fb47a90b0adef38e93df074dbe57821e3c306da03e2c1e267e9ed_amd64",
                "product": {
                  "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:37eda3069f8fb47a90b0adef38e93df074dbe57821e3c306da03e2c1e267e9ed_amd64",
                  "product_id": "openshift-logging/elasticsearch-proxy-rhel8@sha256:37eda3069f8fb47a90b0adef38e93df074dbe57821e3c306da03e2c1e267e9ed_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-proxy-rhel8@sha256:37eda3069f8fb47a90b0adef38e93df074dbe57821e3c306da03e2c1e267e9ed?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-proxy-rhel8\u0026tag=v1.0.0-103"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:25f94f0e27668fe254b7ff74731d39b7ed9f6c278c52dcf759893d9a1abe4895_amd64",
                "product": {
                  "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:25f94f0e27668fe254b7ff74731d39b7ed9f6c278c52dcf759893d9a1abe4895_amd64",
                  "product_id": "openshift-logging/log-file-metric-exporter-rhel8@sha256:25f94f0e27668fe254b7ff74731d39b7ed9f6c278c52dcf759893d9a1abe4895_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/log-file-metric-exporter-rhel8@sha256:25f94f0e27668fe254b7ff74731d39b7ed9f6c278c52dcf759893d9a1abe4895?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel8\u0026tag=v1.0.0-70"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/logging-curator5-rhel8@sha256:b722f8982018f215a0a1566a561d742f1f7d99a2b507b8a7e874f6db1a6fef08_amd64",
                "product": {
                  "name": "openshift-logging/logging-curator5-rhel8@sha256:b722f8982018f215a0a1566a561d742f1f7d99a2b507b8a7e874f6db1a6fef08_amd64",
                  "product_id": "openshift-logging/logging-curator5-rhel8@sha256:b722f8982018f215a0a1566a561d742f1f7d99a2b507b8a7e874f6db1a6fef08_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/logging-curator5-rhel8@sha256:b722f8982018f215a0a1566a561d742f1f7d99a2b507b8a7e874f6db1a6fef08?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/logging-curator5-rhel8\u0026tag=v5.8.1-72"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch6-rhel8@sha256:5e2d853cc71ec673ce0f6bcc14628c2fd650a9153b8d7e5f8cd1a1b2ef36093e_amd64",
                "product": {
                  "name": "openshift-logging/elasticsearch6-rhel8@sha256:5e2d853cc71ec673ce0f6bcc14628c2fd650a9153b8d7e5f8cd1a1b2ef36093e_amd64",
                  "product_id": "openshift-logging/elasticsearch6-rhel8@sha256:5e2d853cc71ec673ce0f6bcc14628c2fd650a9153b8d7e5f8cd1a1b2ef36093e_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch6-rhel8@sha256:5e2d853cc71ec673ce0f6bcc14628c2fd650a9153b8d7e5f8cd1a1b2ef36093e?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch6-rhel8\u0026tag=v6.8.1-99"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/eventrouter-rhel8@sha256:956fb983f6ca0991c2d2a03f7054bd2c9881c03883e44d7b695dba475df62a29_amd64",
                "product": {
                  "name": "openshift-logging/eventrouter-rhel8@sha256:956fb983f6ca0991c2d2a03f7054bd2c9881c03883e44d7b695dba475df62a29_amd64",
                  "product_id": "openshift-logging/eventrouter-rhel8@sha256:956fb983f6ca0991c2d2a03f7054bd2c9881c03883e44d7b695dba475df62a29_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/eventrouter-rhel8@sha256:956fb983f6ca0991c2d2a03f7054bd2c9881c03883e44d7b695dba475df62a29?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel8\u0026tag=v0.3.0-98"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/fluentd-rhel8@sha256:ae0cf89749b44739b6f2560c3f6527cee2606b67388a7d965dd76644a25420f5_amd64",
                "product": {
                  "name": "openshift-logging/fluentd-rhel8@sha256:ae0cf89749b44739b6f2560c3f6527cee2606b67388a7d965dd76644a25420f5_amd64",
                  "product_id": "openshift-logging/fluentd-rhel8@sha256:ae0cf89749b44739b6f2560c3f6527cee2606b67388a7d965dd76644a25420f5_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/fluentd-rhel8@sha256:ae0cf89749b44739b6f2560c3f6527cee2606b67388a7d965dd76644a25420f5?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/fluentd-rhel8\u0026tag=v1.7.4-103"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/kibana6-rhel8@sha256:680c44946a899270de101bca06b22ed5b4eba0b85c1e01e21e30fc6a2740ab2d_amd64",
                "product": {
                  "name": "openshift-logging/kibana6-rhel8@sha256:680c44946a899270de101bca06b22ed5b4eba0b85c1e01e21e30fc6a2740ab2d_amd64",
                  "product_id": "openshift-logging/kibana6-rhel8@sha256:680c44946a899270de101bca06b22ed5b4eba0b85c1e01e21e30fc6a2740ab2d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kibana6-rhel8@sha256:680c44946a899270de101bca06b22ed5b4eba0b85c1e01e21e30fc6a2740ab2d?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/kibana6-rhel8\u0026tag=v6.8.1-109"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:6c544de84925d0e3883a5d091c17a33362a0138271bbbda6663eb1407f98e0c5_s390x",
                "product": {
                  "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:6c544de84925d0e3883a5d091c17a33362a0138271bbbda6663eb1407f98e0c5_s390x",
                  "product_id": "openshift-logging/cluster-logging-rhel8-operator@sha256:6c544de84925d0e3883a5d091c17a33362a0138271bbbda6663eb1407f98e0c5_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cluster-logging-rhel8-operator@sha256:6c544de84925d0e3883a5d091c17a33362a0138271bbbda6663eb1407f98e0c5?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel8-operator\u0026tag=v5.3.3-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:f7e2c329f04793173ae4412aa096cf86ce7225c94b059c56d8c9e7dbe71b9a19_s390x",
                "product": {
                  "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:f7e2c329f04793173ae4412aa096cf86ce7225c94b059c56d8c9e7dbe71b9a19_s390x",
                  "product_id": "openshift-logging/elasticsearch-rhel8-operator@sha256:f7e2c329f04793173ae4412aa096cf86ce7225c94b059c56d8c9e7dbe71b9a19_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-rhel8-operator@sha256:f7e2c329f04793173ae4412aa096cf86ce7225c94b059c56d8c9e7dbe71b9a19?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-rhel8-operator\u0026tag=v5.3.3-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:1d7fe3558d416cf1ce9cd59e68f71ac3123b1cb8a3435001d2fa356198ea821c_s390x",
                "product": {
                  "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:1d7fe3558d416cf1ce9cd59e68f71ac3123b1cb8a3435001d2fa356198ea821c_s390x",
                  "product_id": "openshift-logging/elasticsearch-proxy-rhel8@sha256:1d7fe3558d416cf1ce9cd59e68f71ac3123b1cb8a3435001d2fa356198ea821c_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-proxy-rhel8@sha256:1d7fe3558d416cf1ce9cd59e68f71ac3123b1cb8a3435001d2fa356198ea821c?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-proxy-rhel8\u0026tag=v1.0.0-103"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:fd70baba0ba7a59a994ca33527ecb2575ab199daeb4ecd34581cccf0db246c59_s390x",
                "product": {
                  "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:fd70baba0ba7a59a994ca33527ecb2575ab199daeb4ecd34581cccf0db246c59_s390x",
                  "product_id": "openshift-logging/log-file-metric-exporter-rhel8@sha256:fd70baba0ba7a59a994ca33527ecb2575ab199daeb4ecd34581cccf0db246c59_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/log-file-metric-exporter-rhel8@sha256:fd70baba0ba7a59a994ca33527ecb2575ab199daeb4ecd34581cccf0db246c59?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel8\u0026tag=v1.0.0-70"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/logging-curator5-rhel8@sha256:1d900ee34e14094e24b855acfbeec3f2f3c82f3fcc07d3b4cebe5e92ea1a8fde_s390x",
                "product": {
                  "name": "openshift-logging/logging-curator5-rhel8@sha256:1d900ee34e14094e24b855acfbeec3f2f3c82f3fcc07d3b4cebe5e92ea1a8fde_s390x",
                  "product_id": "openshift-logging/logging-curator5-rhel8@sha256:1d900ee34e14094e24b855acfbeec3f2f3c82f3fcc07d3b4cebe5e92ea1a8fde_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/logging-curator5-rhel8@sha256:1d900ee34e14094e24b855acfbeec3f2f3c82f3fcc07d3b4cebe5e92ea1a8fde?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/logging-curator5-rhel8\u0026tag=v5.8.1-72"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch6-rhel8@sha256:ac206b3da24eb8df95e2e3b0bec234e84b8e5ef7000234f069855b73de77d846_s390x",
                "product": {
                  "name": "openshift-logging/elasticsearch6-rhel8@sha256:ac206b3da24eb8df95e2e3b0bec234e84b8e5ef7000234f069855b73de77d846_s390x",
                  "product_id": "openshift-logging/elasticsearch6-rhel8@sha256:ac206b3da24eb8df95e2e3b0bec234e84b8e5ef7000234f069855b73de77d846_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch6-rhel8@sha256:ac206b3da24eb8df95e2e3b0bec234e84b8e5ef7000234f069855b73de77d846?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch6-rhel8\u0026tag=v6.8.1-99"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/eventrouter-rhel8@sha256:440473f04ef4cfd1d016063daabf011eb2ba6b9acea96312a72f215277333e53_s390x",
                "product": {
                  "name": "openshift-logging/eventrouter-rhel8@sha256:440473f04ef4cfd1d016063daabf011eb2ba6b9acea96312a72f215277333e53_s390x",
                  "product_id": "openshift-logging/eventrouter-rhel8@sha256:440473f04ef4cfd1d016063daabf011eb2ba6b9acea96312a72f215277333e53_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/eventrouter-rhel8@sha256:440473f04ef4cfd1d016063daabf011eb2ba6b9acea96312a72f215277333e53?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel8\u0026tag=v0.3.0-98"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/fluentd-rhel8@sha256:4b114196ac78f93575475437a794c881fe79126f3e73fed1fe5ea9f89fcdb6c1_s390x",
                "product": {
                  "name": "openshift-logging/fluentd-rhel8@sha256:4b114196ac78f93575475437a794c881fe79126f3e73fed1fe5ea9f89fcdb6c1_s390x",
                  "product_id": "openshift-logging/fluentd-rhel8@sha256:4b114196ac78f93575475437a794c881fe79126f3e73fed1fe5ea9f89fcdb6c1_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/fluentd-rhel8@sha256:4b114196ac78f93575475437a794c881fe79126f3e73fed1fe5ea9f89fcdb6c1?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/fluentd-rhel8\u0026tag=v1.7.4-103"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/kibana6-rhel8@sha256:61a6311f2ca53f6e600007bd9ffc90c7183f81db8fee8d839991565d82be5f2e_s390x",
                "product": {
                  "name": "openshift-logging/kibana6-rhel8@sha256:61a6311f2ca53f6e600007bd9ffc90c7183f81db8fee8d839991565d82be5f2e_s390x",
                  "product_id": "openshift-logging/kibana6-rhel8@sha256:61a6311f2ca53f6e600007bd9ffc90c7183f81db8fee8d839991565d82be5f2e_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kibana6-rhel8@sha256:61a6311f2ca53f6e600007bd9ffc90c7183f81db8fee8d839991565d82be5f2e?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/kibana6-rhel8\u0026tag=v6.8.1-109"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:9f622b5daa152e2b8d94fa12defc3c08d93fddb34b1b4edbf841da5f00d7918d_ppc64le",
                "product": {
                  "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:9f622b5daa152e2b8d94fa12defc3c08d93fddb34b1b4edbf841da5f00d7918d_ppc64le",
                  "product_id": "openshift-logging/cluster-logging-rhel8-operator@sha256:9f622b5daa152e2b8d94fa12defc3c08d93fddb34b1b4edbf841da5f00d7918d_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cluster-logging-rhel8-operator@sha256:9f622b5daa152e2b8d94fa12defc3c08d93fddb34b1b4edbf841da5f00d7918d?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel8-operator\u0026tag=v5.3.3-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:1209bca75d71152af832b0e11dfee461f4c6fdbeda6b91743e637ce453702f3c_ppc64le",
                "product": {
                  "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:1209bca75d71152af832b0e11dfee461f4c6fdbeda6b91743e637ce453702f3c_ppc64le",
                  "product_id": "openshift-logging/elasticsearch-rhel8-operator@sha256:1209bca75d71152af832b0e11dfee461f4c6fdbeda6b91743e637ce453702f3c_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-rhel8-operator@sha256:1209bca75d71152af832b0e11dfee461f4c6fdbeda6b91743e637ce453702f3c?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-rhel8-operator\u0026tag=v5.3.3-3"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:183da02fcaa5915a0552e5c4c4716b521cb5a698590fc1f58e0cede837f52b49_ppc64le",
                "product": {
                  "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:183da02fcaa5915a0552e5c4c4716b521cb5a698590fc1f58e0cede837f52b49_ppc64le",
                  "product_id": "openshift-logging/elasticsearch-proxy-rhel8@sha256:183da02fcaa5915a0552e5c4c4716b521cb5a698590fc1f58e0cede837f52b49_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-proxy-rhel8@sha256:183da02fcaa5915a0552e5c4c4716b521cb5a698590fc1f58e0cede837f52b49?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-proxy-rhel8\u0026tag=v1.0.0-103"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:ce82cceec1ccb2e951cc54fbc6bd1109a616034f9462b19f13dffa35902e0cef_ppc64le",
                "product": {
                  "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:ce82cceec1ccb2e951cc54fbc6bd1109a616034f9462b19f13dffa35902e0cef_ppc64le",
                  "product_id": "openshift-logging/log-file-metric-exporter-rhel8@sha256:ce82cceec1ccb2e951cc54fbc6bd1109a616034f9462b19f13dffa35902e0cef_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/log-file-metric-exporter-rhel8@sha256:ce82cceec1ccb2e951cc54fbc6bd1109a616034f9462b19f13dffa35902e0cef?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel8\u0026tag=v1.0.0-70"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/logging-curator5-rhel8@sha256:04cb0712418289fc446752a0c274d1036886312b7a63b54ebbeeab1421c10924_ppc64le",
                "product": {
                  "name": "openshift-logging/logging-curator5-rhel8@sha256:04cb0712418289fc446752a0c274d1036886312b7a63b54ebbeeab1421c10924_ppc64le",
                  "product_id": "openshift-logging/logging-curator5-rhel8@sha256:04cb0712418289fc446752a0c274d1036886312b7a63b54ebbeeab1421c10924_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/logging-curator5-rhel8@sha256:04cb0712418289fc446752a0c274d1036886312b7a63b54ebbeeab1421c10924?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/logging-curator5-rhel8\u0026tag=v5.8.1-72"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch6-rhel8@sha256:a8942268c538c264d5a7950f91106c44b1a431262a7af31ed02bed79f1c22d93_ppc64le",
                "product": {
                  "name": "openshift-logging/elasticsearch6-rhel8@sha256:a8942268c538c264d5a7950f91106c44b1a431262a7af31ed02bed79f1c22d93_ppc64le",
                  "product_id": "openshift-logging/elasticsearch6-rhel8@sha256:a8942268c538c264d5a7950f91106c44b1a431262a7af31ed02bed79f1c22d93_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch6-rhel8@sha256:a8942268c538c264d5a7950f91106c44b1a431262a7af31ed02bed79f1c22d93?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch6-rhel8\u0026tag=v6.8.1-99"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/eventrouter-rhel8@sha256:b1b03c78595d10ae30b5a35983784eaea11f1f9763944b2f9938117149bdd511_ppc64le",
                "product": {
                  "name": "openshift-logging/eventrouter-rhel8@sha256:b1b03c78595d10ae30b5a35983784eaea11f1f9763944b2f9938117149bdd511_ppc64le",
                  "product_id": "openshift-logging/eventrouter-rhel8@sha256:b1b03c78595d10ae30b5a35983784eaea11f1f9763944b2f9938117149bdd511_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/eventrouter-rhel8@sha256:b1b03c78595d10ae30b5a35983784eaea11f1f9763944b2f9938117149bdd511?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel8\u0026tag=v0.3.0-98"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/fluentd-rhel8@sha256:4cf7cc86ccb8059ee5083d6e68a413e1db804ff45e126a9f87b1d52e8dd82855_ppc64le",
                "product": {
                  "name": "openshift-logging/fluentd-rhel8@sha256:4cf7cc86ccb8059ee5083d6e68a413e1db804ff45e126a9f87b1d52e8dd82855_ppc64le",
                  "product_id": "openshift-logging/fluentd-rhel8@sha256:4cf7cc86ccb8059ee5083d6e68a413e1db804ff45e126a9f87b1d52e8dd82855_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/fluentd-rhel8@sha256:4cf7cc86ccb8059ee5083d6e68a413e1db804ff45e126a9f87b1d52e8dd82855?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/fluentd-rhel8\u0026tag=v1.7.4-103"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/kibana6-rhel8@sha256:278eb4ecec21f235a26693b3f6c1b0cdfab5635f5a5ac51dd0540c6ab69c1316_ppc64le",
                "product": {
                  "name": "openshift-logging/kibana6-rhel8@sha256:278eb4ecec21f235a26693b3f6c1b0cdfab5635f5a5ac51dd0540c6ab69c1316_ppc64le",
                  "product_id": "openshift-logging/kibana6-rhel8@sha256:278eb4ecec21f235a26693b3f6c1b0cdfab5635f5a5ac51dd0540c6ab69c1316_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kibana6-rhel8@sha256:278eb4ecec21f235a26693b3f6c1b0cdfab5635f5a5ac51dd0540c6ab69c1316?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/kibana6-rhel8\u0026tag=v6.8.1-109"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/cluster-logging-operator-bundle@sha256:1eab02e25f64839b15747d2bb8e0e6f8c3f632e9372a5ee926cde2c1e5cbc998_amd64 as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-operator-bundle@sha256:1eab02e25f64839b15747d2bb8e0e6f8c3f632e9372a5ee926cde2c1e5cbc998_amd64"
        },
        "product_reference": "openshift-logging/cluster-logging-operator-bundle@sha256:1eab02e25f64839b15747d2bb8e0e6f8c3f632e9372a5ee926cde2c1e5cbc998_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:6c544de84925d0e3883a5d091c17a33362a0138271bbbda6663eb1407f98e0c5_s390x as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:6c544de84925d0e3883a5d091c17a33362a0138271bbbda6663eb1407f98e0c5_s390x"
        },
        "product_reference": "openshift-logging/cluster-logging-rhel8-operator@sha256:6c544de84925d0e3883a5d091c17a33362a0138271bbbda6663eb1407f98e0c5_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:74e4ae6c04abc489b90cab07c40f24f68ab7f92e366d3661ba3130ca6fa205c9_amd64 as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:74e4ae6c04abc489b90cab07c40f24f68ab7f92e366d3661ba3130ca6fa205c9_amd64"
        },
        "product_reference": "openshift-logging/cluster-logging-rhel8-operator@sha256:74e4ae6c04abc489b90cab07c40f24f68ab7f92e366d3661ba3130ca6fa205c9_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:9f622b5daa152e2b8d94fa12defc3c08d93fddb34b1b4edbf841da5f00d7918d_ppc64le as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:9f622b5daa152e2b8d94fa12defc3c08d93fddb34b1b4edbf841da5f00d7918d_ppc64le"
        },
        "product_reference": "openshift-logging/cluster-logging-rhel8-operator@sha256:9f622b5daa152e2b8d94fa12defc3c08d93fddb34b1b4edbf841da5f00d7918d_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-operator-bundle@sha256:eec91dbe056a85b3a8b61c5ce4d9383e182440f5ea496fac64a22cd7920daf5f_amd64 as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-operator-bundle@sha256:eec91dbe056a85b3a8b61c5ce4d9383e182440f5ea496fac64a22cd7920daf5f_amd64"
        },
        "product_reference": "openshift-logging/elasticsearch-operator-bundle@sha256:eec91dbe056a85b3a8b61c5ce4d9383e182440f5ea496fac64a22cd7920daf5f_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:183da02fcaa5915a0552e5c4c4716b521cb5a698590fc1f58e0cede837f52b49_ppc64le as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:183da02fcaa5915a0552e5c4c4716b521cb5a698590fc1f58e0cede837f52b49_ppc64le"
        },
        "product_reference": "openshift-logging/elasticsearch-proxy-rhel8@sha256:183da02fcaa5915a0552e5c4c4716b521cb5a698590fc1f58e0cede837f52b49_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:1d7fe3558d416cf1ce9cd59e68f71ac3123b1cb8a3435001d2fa356198ea821c_s390x as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:1d7fe3558d416cf1ce9cd59e68f71ac3123b1cb8a3435001d2fa356198ea821c_s390x"
        },
        "product_reference": "openshift-logging/elasticsearch-proxy-rhel8@sha256:1d7fe3558d416cf1ce9cd59e68f71ac3123b1cb8a3435001d2fa356198ea821c_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:37eda3069f8fb47a90b0adef38e93df074dbe57821e3c306da03e2c1e267e9ed_amd64 as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:37eda3069f8fb47a90b0adef38e93df074dbe57821e3c306da03e2c1e267e9ed_amd64"
        },
        "product_reference": "openshift-logging/elasticsearch-proxy-rhel8@sha256:37eda3069f8fb47a90b0adef38e93df074dbe57821e3c306da03e2c1e267e9ed_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:1209bca75d71152af832b0e11dfee461f4c6fdbeda6b91743e637ce453702f3c_ppc64le as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:1209bca75d71152af832b0e11dfee461f4c6fdbeda6b91743e637ce453702f3c_ppc64le"
        },
        "product_reference": "openshift-logging/elasticsearch-rhel8-operator@sha256:1209bca75d71152af832b0e11dfee461f4c6fdbeda6b91743e637ce453702f3c_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:1e342d10db70e1b160f906c65e6caa25aa64c519dd7ae7e8233fe2fe65121207_amd64 as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:1e342d10db70e1b160f906c65e6caa25aa64c519dd7ae7e8233fe2fe65121207_amd64"
        },
        "product_reference": "openshift-logging/elasticsearch-rhel8-operator@sha256:1e342d10db70e1b160f906c65e6caa25aa64c519dd7ae7e8233fe2fe65121207_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:f7e2c329f04793173ae4412aa096cf86ce7225c94b059c56d8c9e7dbe71b9a19_s390x as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:f7e2c329f04793173ae4412aa096cf86ce7225c94b059c56d8c9e7dbe71b9a19_s390x"
        },
        "product_reference": "openshift-logging/elasticsearch-rhel8-operator@sha256:f7e2c329f04793173ae4412aa096cf86ce7225c94b059c56d8c9e7dbe71b9a19_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch6-rhel8@sha256:5e2d853cc71ec673ce0f6bcc14628c2fd650a9153b8d7e5f8cd1a1b2ef36093e_amd64 as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:5e2d853cc71ec673ce0f6bcc14628c2fd650a9153b8d7e5f8cd1a1b2ef36093e_amd64"
        },
        "product_reference": "openshift-logging/elasticsearch6-rhel8@sha256:5e2d853cc71ec673ce0f6bcc14628c2fd650a9153b8d7e5f8cd1a1b2ef36093e_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch6-rhel8@sha256:a8942268c538c264d5a7950f91106c44b1a431262a7af31ed02bed79f1c22d93_ppc64le as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:a8942268c538c264d5a7950f91106c44b1a431262a7af31ed02bed79f1c22d93_ppc64le"
        },
        "product_reference": "openshift-logging/elasticsearch6-rhel8@sha256:a8942268c538c264d5a7950f91106c44b1a431262a7af31ed02bed79f1c22d93_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch6-rhel8@sha256:ac206b3da24eb8df95e2e3b0bec234e84b8e5ef7000234f069855b73de77d846_s390x as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:ac206b3da24eb8df95e2e3b0bec234e84b8e5ef7000234f069855b73de77d846_s390x"
        },
        "product_reference": "openshift-logging/elasticsearch6-rhel8@sha256:ac206b3da24eb8df95e2e3b0bec234e84b8e5ef7000234f069855b73de77d846_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/eventrouter-rhel8@sha256:440473f04ef4cfd1d016063daabf011eb2ba6b9acea96312a72f215277333e53_s390x as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:440473f04ef4cfd1d016063daabf011eb2ba6b9acea96312a72f215277333e53_s390x"
        },
        "product_reference": "openshift-logging/eventrouter-rhel8@sha256:440473f04ef4cfd1d016063daabf011eb2ba6b9acea96312a72f215277333e53_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/eventrouter-rhel8@sha256:956fb983f6ca0991c2d2a03f7054bd2c9881c03883e44d7b695dba475df62a29_amd64 as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:956fb983f6ca0991c2d2a03f7054bd2c9881c03883e44d7b695dba475df62a29_amd64"
        },
        "product_reference": "openshift-logging/eventrouter-rhel8@sha256:956fb983f6ca0991c2d2a03f7054bd2c9881c03883e44d7b695dba475df62a29_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/eventrouter-rhel8@sha256:b1b03c78595d10ae30b5a35983784eaea11f1f9763944b2f9938117149bdd511_ppc64le as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:b1b03c78595d10ae30b5a35983784eaea11f1f9763944b2f9938117149bdd511_ppc64le"
        },
        "product_reference": "openshift-logging/eventrouter-rhel8@sha256:b1b03c78595d10ae30b5a35983784eaea11f1f9763944b2f9938117149bdd511_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/fluentd-rhel8@sha256:4b114196ac78f93575475437a794c881fe79126f3e73fed1fe5ea9f89fcdb6c1_s390x as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:4b114196ac78f93575475437a794c881fe79126f3e73fed1fe5ea9f89fcdb6c1_s390x"
        },
        "product_reference": "openshift-logging/fluentd-rhel8@sha256:4b114196ac78f93575475437a794c881fe79126f3e73fed1fe5ea9f89fcdb6c1_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/fluentd-rhel8@sha256:4cf7cc86ccb8059ee5083d6e68a413e1db804ff45e126a9f87b1d52e8dd82855_ppc64le as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:4cf7cc86ccb8059ee5083d6e68a413e1db804ff45e126a9f87b1d52e8dd82855_ppc64le"
        },
        "product_reference": "openshift-logging/fluentd-rhel8@sha256:4cf7cc86ccb8059ee5083d6e68a413e1db804ff45e126a9f87b1d52e8dd82855_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/fluentd-rhel8@sha256:ae0cf89749b44739b6f2560c3f6527cee2606b67388a7d965dd76644a25420f5_amd64 as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:ae0cf89749b44739b6f2560c3f6527cee2606b67388a7d965dd76644a25420f5_amd64"
        },
        "product_reference": "openshift-logging/fluentd-rhel8@sha256:ae0cf89749b44739b6f2560c3f6527cee2606b67388a7d965dd76644a25420f5_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/kibana6-rhel8@sha256:278eb4ecec21f235a26693b3f6c1b0cdfab5635f5a5ac51dd0540c6ab69c1316_ppc64le as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:278eb4ecec21f235a26693b3f6c1b0cdfab5635f5a5ac51dd0540c6ab69c1316_ppc64le"
        },
        "product_reference": "openshift-logging/kibana6-rhel8@sha256:278eb4ecec21f235a26693b3f6c1b0cdfab5635f5a5ac51dd0540c6ab69c1316_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/kibana6-rhel8@sha256:61a6311f2ca53f6e600007bd9ffc90c7183f81db8fee8d839991565d82be5f2e_s390x as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:61a6311f2ca53f6e600007bd9ffc90c7183f81db8fee8d839991565d82be5f2e_s390x"
        },
        "product_reference": "openshift-logging/kibana6-rhel8@sha256:61a6311f2ca53f6e600007bd9ffc90c7183f81db8fee8d839991565d82be5f2e_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/kibana6-rhel8@sha256:680c44946a899270de101bca06b22ed5b4eba0b85c1e01e21e30fc6a2740ab2d_amd64 as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:680c44946a899270de101bca06b22ed5b4eba0b85c1e01e21e30fc6a2740ab2d_amd64"
        },
        "product_reference": "openshift-logging/kibana6-rhel8@sha256:680c44946a899270de101bca06b22ed5b4eba0b85c1e01e21e30fc6a2740ab2d_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:25f94f0e27668fe254b7ff74731d39b7ed9f6c278c52dcf759893d9a1abe4895_amd64 as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:25f94f0e27668fe254b7ff74731d39b7ed9f6c278c52dcf759893d9a1abe4895_amd64"
        },
        "product_reference": "openshift-logging/log-file-metric-exporter-rhel8@sha256:25f94f0e27668fe254b7ff74731d39b7ed9f6c278c52dcf759893d9a1abe4895_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:ce82cceec1ccb2e951cc54fbc6bd1109a616034f9462b19f13dffa35902e0cef_ppc64le as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:ce82cceec1ccb2e951cc54fbc6bd1109a616034f9462b19f13dffa35902e0cef_ppc64le"
        },
        "product_reference": "openshift-logging/log-file-metric-exporter-rhel8@sha256:ce82cceec1ccb2e951cc54fbc6bd1109a616034f9462b19f13dffa35902e0cef_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:fd70baba0ba7a59a994ca33527ecb2575ab199daeb4ecd34581cccf0db246c59_s390x as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:fd70baba0ba7a59a994ca33527ecb2575ab199daeb4ecd34581cccf0db246c59_s390x"
        },
        "product_reference": "openshift-logging/log-file-metric-exporter-rhel8@sha256:fd70baba0ba7a59a994ca33527ecb2575ab199daeb4ecd34581cccf0db246c59_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/logging-curator5-rhel8@sha256:04cb0712418289fc446752a0c274d1036886312b7a63b54ebbeeab1421c10924_ppc64le as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:04cb0712418289fc446752a0c274d1036886312b7a63b54ebbeeab1421c10924_ppc64le"
        },
        "product_reference": "openshift-logging/logging-curator5-rhel8@sha256:04cb0712418289fc446752a0c274d1036886312b7a63b54ebbeeab1421c10924_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/logging-curator5-rhel8@sha256:1d900ee34e14094e24b855acfbeec3f2f3c82f3fcc07d3b4cebe5e92ea1a8fde_s390x as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:1d900ee34e14094e24b855acfbeec3f2f3c82f3fcc07d3b4cebe5e92ea1a8fde_s390x"
        },
        "product_reference": "openshift-logging/logging-curator5-rhel8@sha256:1d900ee34e14094e24b855acfbeec3f2f3c82f3fcc07d3b4cebe5e92ea1a8fde_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/logging-curator5-rhel8@sha256:b722f8982018f215a0a1566a561d742f1f7d99a2b507b8a7e874f6db1a6fef08_amd64 as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:b722f8982018f215a0a1566a561d742f1f7d99a2b507b8a7e874f6db1a6fef08_amd64"
        },
        "product_reference": "openshift-logging/logging-curator5-rhel8@sha256:b722f8982018f215a0a1566a561d742f1f7d99a2b507b8a7e874f6db1a6fef08_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-27292",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2021-03-17T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-operator-bundle@sha256:1eab02e25f64839b15747d2bb8e0e6f8c3f632e9372a5ee926cde2c1e5cbc998_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:6c544de84925d0e3883a5d091c17a33362a0138271bbbda6663eb1407f98e0c5_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:74e4ae6c04abc489b90cab07c40f24f68ab7f92e366d3661ba3130ca6fa205c9_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:9f622b5daa152e2b8d94fa12defc3c08d93fddb34b1b4edbf841da5f00d7918d_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-operator-bundle@sha256:eec91dbe056a85b3a8b61c5ce4d9383e182440f5ea496fac64a22cd7920daf5f_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:183da02fcaa5915a0552e5c4c4716b521cb5a698590fc1f58e0cede837f52b49_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:1d7fe3558d416cf1ce9cd59e68f71ac3123b1cb8a3435001d2fa356198ea821c_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:37eda3069f8fb47a90b0adef38e93df074dbe57821e3c306da03e2c1e267e9ed_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:1209bca75d71152af832b0e11dfee461f4c6fdbeda6b91743e637ce453702f3c_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:1e342d10db70e1b160f906c65e6caa25aa64c519dd7ae7e8233fe2fe65121207_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:f7e2c329f04793173ae4412aa096cf86ce7225c94b059c56d8c9e7dbe71b9a19_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:5e2d853cc71ec673ce0f6bcc14628c2fd650a9153b8d7e5f8cd1a1b2ef36093e_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:a8942268c538c264d5a7950f91106c44b1a431262a7af31ed02bed79f1c22d93_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:ac206b3da24eb8df95e2e3b0bec234e84b8e5ef7000234f069855b73de77d846_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:440473f04ef4cfd1d016063daabf011eb2ba6b9acea96312a72f215277333e53_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:956fb983f6ca0991c2d2a03f7054bd2c9881c03883e44d7b695dba475df62a29_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:b1b03c78595d10ae30b5a35983784eaea11f1f9763944b2f9938117149bdd511_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:4b114196ac78f93575475437a794c881fe79126f3e73fed1fe5ea9f89fcdb6c1_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:4cf7cc86ccb8059ee5083d6e68a413e1db804ff45e126a9f87b1d52e8dd82855_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:ae0cf89749b44739b6f2560c3f6527cee2606b67388a7d965dd76644a25420f5_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:25f94f0e27668fe254b7ff74731d39b7ed9f6c278c52dcf759893d9a1abe4895_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:ce82cceec1ccb2e951cc54fbc6bd1109a616034f9462b19f13dffa35902e0cef_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:fd70baba0ba7a59a994ca33527ecb2575ab199daeb4ecd34581cccf0db246c59_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:04cb0712418289fc446752a0c274d1036886312b7a63b54ebbeeab1421c10924_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:1d900ee34e14094e24b855acfbeec3f2f3c82f3fcc07d3b4cebe5e92ea1a8fde_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:b722f8982018f215a0a1566a561d742f1f7d99a2b507b8a7e874f6db1a6fef08_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1940613"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A regular expression denial of service (ReDoS) vulnerability was found in the npm library `ua-parser-js`. If a supplied user agent matches the `Noble` string and contains many spaces then the regex will conduct backtracking, taking an ever increasing amount of time depending on the number of spaces supplied. An attacker can use this vulnerability to potentially craft a malicious user agent resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs-ua-parser-js: ReDoS via malicious User-Agent header",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "While some components do package a vulnerable version of ua-parser-js, access to them requires OpenShift OAuth credentials and hence have been marked with a Low impact. This applies to the following products:\n  - OpenShift Container Platform (OCP)\n  - OpenShift ServiceMesh (OSSM) \n  - Red Hat OpenShift Jaeger (RHOSJ)\n  - Red Hat OpenShift Logging\n\nThe OCP presto-container does ship the vulnerable component, however since OCP 4.6 the Metering product has been deprecated [1], set as wont-fix and may be fixed in a future release.\n\nRed Hat Advanced Cluster Management for Kubernetes (RHACM) ships graphql-tools that pulls 0.7.23 version of ua-parser-js that uses the affected code.\n\n[1] - https://access.redhat.com/solutions/5707561",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:278eb4ecec21f235a26693b3f6c1b0cdfab5635f5a5ac51dd0540c6ab69c1316_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:61a6311f2ca53f6e600007bd9ffc90c7183f81db8fee8d839991565d82be5f2e_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:680c44946a899270de101bca06b22ed5b4eba0b85c1e01e21e30fc6a2740ab2d_amd64"
        ],
        "known_not_affected": [
          "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-operator-bundle@sha256:1eab02e25f64839b15747d2bb8e0e6f8c3f632e9372a5ee926cde2c1e5cbc998_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:6c544de84925d0e3883a5d091c17a33362a0138271bbbda6663eb1407f98e0c5_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:74e4ae6c04abc489b90cab07c40f24f68ab7f92e366d3661ba3130ca6fa205c9_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:9f622b5daa152e2b8d94fa12defc3c08d93fddb34b1b4edbf841da5f00d7918d_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-operator-bundle@sha256:eec91dbe056a85b3a8b61c5ce4d9383e182440f5ea496fac64a22cd7920daf5f_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:183da02fcaa5915a0552e5c4c4716b521cb5a698590fc1f58e0cede837f52b49_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:1d7fe3558d416cf1ce9cd59e68f71ac3123b1cb8a3435001d2fa356198ea821c_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:37eda3069f8fb47a90b0adef38e93df074dbe57821e3c306da03e2c1e267e9ed_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:1209bca75d71152af832b0e11dfee461f4c6fdbeda6b91743e637ce453702f3c_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:1e342d10db70e1b160f906c65e6caa25aa64c519dd7ae7e8233fe2fe65121207_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:f7e2c329f04793173ae4412aa096cf86ce7225c94b059c56d8c9e7dbe71b9a19_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:5e2d853cc71ec673ce0f6bcc14628c2fd650a9153b8d7e5f8cd1a1b2ef36093e_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:a8942268c538c264d5a7950f91106c44b1a431262a7af31ed02bed79f1c22d93_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:ac206b3da24eb8df95e2e3b0bec234e84b8e5ef7000234f069855b73de77d846_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:440473f04ef4cfd1d016063daabf011eb2ba6b9acea96312a72f215277333e53_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:956fb983f6ca0991c2d2a03f7054bd2c9881c03883e44d7b695dba475df62a29_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:b1b03c78595d10ae30b5a35983784eaea11f1f9763944b2f9938117149bdd511_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:4b114196ac78f93575475437a794c881fe79126f3e73fed1fe5ea9f89fcdb6c1_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:4cf7cc86ccb8059ee5083d6e68a413e1db804ff45e126a9f87b1d52e8dd82855_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:ae0cf89749b44739b6f2560c3f6527cee2606b67388a7d965dd76644a25420f5_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:25f94f0e27668fe254b7ff74731d39b7ed9f6c278c52dcf759893d9a1abe4895_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:ce82cceec1ccb2e951cc54fbc6bd1109a616034f9462b19f13dffa35902e0cef_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:fd70baba0ba7a59a994ca33527ecb2575ab199daeb4ecd34581cccf0db246c59_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:04cb0712418289fc446752a0c274d1036886312b7a63b54ebbeeab1421c10924_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:1d900ee34e14094e24b855acfbeec3f2f3c82f3fcc07d3b4cebe5e92ea1a8fde_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:b722f8982018f215a0a1566a561d742f1f7d99a2b507b8a7e874f6db1a6fef08_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-27292"
        },
        {
          "category": "external",
          "summary": "RHBZ#1940613",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1940613"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-27292",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-27292"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-27292",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27292"
        },
        {
          "category": "external",
          "summary": "https://gist.github.com/b-c-ds/6941d80d6b4e694df4bc269493b7be76",
          "url": "https://gist.github.com/b-c-ds/6941d80d6b4e694df4bc269493b7be76"
        }
      ],
      "release_date": "2021-02-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-01-20T21:40:25+00:00",
          "details": "For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html\n\nFor Red Hat OpenShift Logging 5.3, see the following instructions to apply this update:\n\nhttps://docs.openshift.com/container-platform/4.7/logging/cluster-logging-upgrading.html",
          "product_ids": [
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:278eb4ecec21f235a26693b3f6c1b0cdfab5635f5a5ac51dd0540c6ab69c1316_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:61a6311f2ca53f6e600007bd9ffc90c7183f81db8fee8d839991565d82be5f2e_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:680c44946a899270de101bca06b22ed5b4eba0b85c1e01e21e30fc6a2740ab2d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0227"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-operator-bundle@sha256:1eab02e25f64839b15747d2bb8e0e6f8c3f632e9372a5ee926cde2c1e5cbc998_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:6c544de84925d0e3883a5d091c17a33362a0138271bbbda6663eb1407f98e0c5_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:74e4ae6c04abc489b90cab07c40f24f68ab7f92e366d3661ba3130ca6fa205c9_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:9f622b5daa152e2b8d94fa12defc3c08d93fddb34b1b4edbf841da5f00d7918d_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-operator-bundle@sha256:eec91dbe056a85b3a8b61c5ce4d9383e182440f5ea496fac64a22cd7920daf5f_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:183da02fcaa5915a0552e5c4c4716b521cb5a698590fc1f58e0cede837f52b49_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:1d7fe3558d416cf1ce9cd59e68f71ac3123b1cb8a3435001d2fa356198ea821c_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:37eda3069f8fb47a90b0adef38e93df074dbe57821e3c306da03e2c1e267e9ed_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:1209bca75d71152af832b0e11dfee461f4c6fdbeda6b91743e637ce453702f3c_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:1e342d10db70e1b160f906c65e6caa25aa64c519dd7ae7e8233fe2fe65121207_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:f7e2c329f04793173ae4412aa096cf86ce7225c94b059c56d8c9e7dbe71b9a19_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:5e2d853cc71ec673ce0f6bcc14628c2fd650a9153b8d7e5f8cd1a1b2ef36093e_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:a8942268c538c264d5a7950f91106c44b1a431262a7af31ed02bed79f1c22d93_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:ac206b3da24eb8df95e2e3b0bec234e84b8e5ef7000234f069855b73de77d846_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:440473f04ef4cfd1d016063daabf011eb2ba6b9acea96312a72f215277333e53_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:956fb983f6ca0991c2d2a03f7054bd2c9881c03883e44d7b695dba475df62a29_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:b1b03c78595d10ae30b5a35983784eaea11f1f9763944b2f9938117149bdd511_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:4b114196ac78f93575475437a794c881fe79126f3e73fed1fe5ea9f89fcdb6c1_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:4cf7cc86ccb8059ee5083d6e68a413e1db804ff45e126a9f87b1d52e8dd82855_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:ae0cf89749b44739b6f2560c3f6527cee2606b67388a7d965dd76644a25420f5_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:278eb4ecec21f235a26693b3f6c1b0cdfab5635f5a5ac51dd0540c6ab69c1316_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:61a6311f2ca53f6e600007bd9ffc90c7183f81db8fee8d839991565d82be5f2e_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:680c44946a899270de101bca06b22ed5b4eba0b85c1e01e21e30fc6a2740ab2d_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:25f94f0e27668fe254b7ff74731d39b7ed9f6c278c52dcf759893d9a1abe4895_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:ce82cceec1ccb2e951cc54fbc6bd1109a616034f9462b19f13dffa35902e0cef_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:fd70baba0ba7a59a994ca33527ecb2575ab199daeb4ecd34581cccf0db246c59_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:04cb0712418289fc446752a0c274d1036886312b7a63b54ebbeeab1421c10924_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:1d900ee34e14094e24b855acfbeec3f2f3c82f3fcc07d3b4cebe5e92ea1a8fde_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:b722f8982018f215a0a1566a561d742f1f7d99a2b507b8a7e874f6db1a6fef08_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "nodejs-ua-parser-js: ReDoS via malicious User-Agent header"
    },
    {
      "cve": "CVE-2021-44832",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2021-12-28T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-operator-bundle@sha256:1eab02e25f64839b15747d2bb8e0e6f8c3f632e9372a5ee926cde2c1e5cbc998_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:6c544de84925d0e3883a5d091c17a33362a0138271bbbda6663eb1407f98e0c5_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:74e4ae6c04abc489b90cab07c40f24f68ab7f92e366d3661ba3130ca6fa205c9_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:9f622b5daa152e2b8d94fa12defc3c08d93fddb34b1b4edbf841da5f00d7918d_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-operator-bundle@sha256:eec91dbe056a85b3a8b61c5ce4d9383e182440f5ea496fac64a22cd7920daf5f_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:183da02fcaa5915a0552e5c4c4716b521cb5a698590fc1f58e0cede837f52b49_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:1d7fe3558d416cf1ce9cd59e68f71ac3123b1cb8a3435001d2fa356198ea821c_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:37eda3069f8fb47a90b0adef38e93df074dbe57821e3c306da03e2c1e267e9ed_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:1209bca75d71152af832b0e11dfee461f4c6fdbeda6b91743e637ce453702f3c_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:1e342d10db70e1b160f906c65e6caa25aa64c519dd7ae7e8233fe2fe65121207_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:f7e2c329f04793173ae4412aa096cf86ce7225c94b059c56d8c9e7dbe71b9a19_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:440473f04ef4cfd1d016063daabf011eb2ba6b9acea96312a72f215277333e53_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:956fb983f6ca0991c2d2a03f7054bd2c9881c03883e44d7b695dba475df62a29_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:b1b03c78595d10ae30b5a35983784eaea11f1f9763944b2f9938117149bdd511_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:4b114196ac78f93575475437a794c881fe79126f3e73fed1fe5ea9f89fcdb6c1_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:4cf7cc86ccb8059ee5083d6e68a413e1db804ff45e126a9f87b1d52e8dd82855_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:ae0cf89749b44739b6f2560c3f6527cee2606b67388a7d965dd76644a25420f5_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:278eb4ecec21f235a26693b3f6c1b0cdfab5635f5a5ac51dd0540c6ab69c1316_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:61a6311f2ca53f6e600007bd9ffc90c7183f81db8fee8d839991565d82be5f2e_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:680c44946a899270de101bca06b22ed5b4eba0b85c1e01e21e30fc6a2740ab2d_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:25f94f0e27668fe254b7ff74731d39b7ed9f6c278c52dcf759893d9a1abe4895_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:ce82cceec1ccb2e951cc54fbc6bd1109a616034f9462b19f13dffa35902e0cef_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:fd70baba0ba7a59a994ca33527ecb2575ab199daeb4ecd34581cccf0db246c59_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:04cb0712418289fc446752a0c274d1036886312b7a63b54ebbeeab1421c10924_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:1d900ee34e14094e24b855acfbeec3f2f3c82f3fcc07d3b4cebe5e92ea1a8fde_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:b722f8982018f215a0a1566a561d742f1f7d99a2b507b8a7e874f6db1a6fef08_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2035951"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j-core: remote code execution via JDBC Appender",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Log4j 1.x is not impacted by this vulnerability. Therefore versions of log4j shipped with Red Hat Enterprise Linux are NOT affected by this flaw.\n\nFor Elasticsearch, as shipped in OpenShift Container Platform and OpenShift Logging, access to the log4j2.properties configuration is limited only to the cluster administrators and exploitation requires cluster logging changes, what reduced the impact of this vulnerability significantly [0].\n\n[0] https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476#update-jan-6-5",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:5e2d853cc71ec673ce0f6bcc14628c2fd650a9153b8d7e5f8cd1a1b2ef36093e_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:a8942268c538c264d5a7950f91106c44b1a431262a7af31ed02bed79f1c22d93_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:ac206b3da24eb8df95e2e3b0bec234e84b8e5ef7000234f069855b73de77d846_s390x"
        ],
        "known_not_affected": [
          "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-operator-bundle@sha256:1eab02e25f64839b15747d2bb8e0e6f8c3f632e9372a5ee926cde2c1e5cbc998_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:6c544de84925d0e3883a5d091c17a33362a0138271bbbda6663eb1407f98e0c5_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:74e4ae6c04abc489b90cab07c40f24f68ab7f92e366d3661ba3130ca6fa205c9_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:9f622b5daa152e2b8d94fa12defc3c08d93fddb34b1b4edbf841da5f00d7918d_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-operator-bundle@sha256:eec91dbe056a85b3a8b61c5ce4d9383e182440f5ea496fac64a22cd7920daf5f_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:183da02fcaa5915a0552e5c4c4716b521cb5a698590fc1f58e0cede837f52b49_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:1d7fe3558d416cf1ce9cd59e68f71ac3123b1cb8a3435001d2fa356198ea821c_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:37eda3069f8fb47a90b0adef38e93df074dbe57821e3c306da03e2c1e267e9ed_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:1209bca75d71152af832b0e11dfee461f4c6fdbeda6b91743e637ce453702f3c_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:1e342d10db70e1b160f906c65e6caa25aa64c519dd7ae7e8233fe2fe65121207_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:f7e2c329f04793173ae4412aa096cf86ce7225c94b059c56d8c9e7dbe71b9a19_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:440473f04ef4cfd1d016063daabf011eb2ba6b9acea96312a72f215277333e53_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:956fb983f6ca0991c2d2a03f7054bd2c9881c03883e44d7b695dba475df62a29_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:b1b03c78595d10ae30b5a35983784eaea11f1f9763944b2f9938117149bdd511_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:4b114196ac78f93575475437a794c881fe79126f3e73fed1fe5ea9f89fcdb6c1_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:4cf7cc86ccb8059ee5083d6e68a413e1db804ff45e126a9f87b1d52e8dd82855_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:ae0cf89749b44739b6f2560c3f6527cee2606b67388a7d965dd76644a25420f5_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:278eb4ecec21f235a26693b3f6c1b0cdfab5635f5a5ac51dd0540c6ab69c1316_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:61a6311f2ca53f6e600007bd9ffc90c7183f81db8fee8d839991565d82be5f2e_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:680c44946a899270de101bca06b22ed5b4eba0b85c1e01e21e30fc6a2740ab2d_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:25f94f0e27668fe254b7ff74731d39b7ed9f6c278c52dcf759893d9a1abe4895_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:ce82cceec1ccb2e951cc54fbc6bd1109a616034f9462b19f13dffa35902e0cef_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:fd70baba0ba7a59a994ca33527ecb2575ab199daeb4ecd34581cccf0db246c59_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:04cb0712418289fc446752a0c274d1036886312b7a63b54ebbeeab1421c10924_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:1d900ee34e14094e24b855acfbeec3f2f3c82f3fcc07d3b4cebe5e92ea1a8fde_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:b722f8982018f215a0a1566a561d742f1f7d99a2b507b8a7e874f6db1a6fef08_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-44832"
        },
        {
          "category": "external",
          "summary": "RHBZ#2035951",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2035951"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44832",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-44832"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44832",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44832"
        },
        {
          "category": "external",
          "summary": "https://issues.apache.org/jira/browse/LOG4J2-3293",
          "url": "https://issues.apache.org/jira/browse/LOG4J2-3293"
        }
      ],
      "release_date": "2021-12-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-01-20T21:40:25+00:00",
          "details": "For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html\n\nFor Red Hat OpenShift Logging 5.3, see the following instructions to apply this update:\n\nhttps://docs.openshift.com/container-platform/4.7/logging/cluster-logging-upgrading.html",
          "product_ids": [
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:5e2d853cc71ec673ce0f6bcc14628c2fd650a9153b8d7e5f8cd1a1b2ef36093e_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:a8942268c538c264d5a7950f91106c44b1a431262a7af31ed02bed79f1c22d93_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:ac206b3da24eb8df95e2e3b0bec234e84b8e5ef7000234f069855b73de77d846_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0227"
        },
        {
          "category": "workaround",
          "details": "As per upstream:\n- In prior releases confirm that if the JDBC Appender is being used it is not configured to use any protocol other than Java.\n- Note that only the log4j-core JAR file is impacted by this vulnerability. Applications using only the log4j-api JAR file without the log4j-core JAR file are not impacted by this vulnerability.",
          "product_ids": [
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-operator-bundle@sha256:1eab02e25f64839b15747d2bb8e0e6f8c3f632e9372a5ee926cde2c1e5cbc998_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:6c544de84925d0e3883a5d091c17a33362a0138271bbbda6663eb1407f98e0c5_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:74e4ae6c04abc489b90cab07c40f24f68ab7f92e366d3661ba3130ca6fa205c9_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:9f622b5daa152e2b8d94fa12defc3c08d93fddb34b1b4edbf841da5f00d7918d_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-operator-bundle@sha256:eec91dbe056a85b3a8b61c5ce4d9383e182440f5ea496fac64a22cd7920daf5f_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:183da02fcaa5915a0552e5c4c4716b521cb5a698590fc1f58e0cede837f52b49_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:1d7fe3558d416cf1ce9cd59e68f71ac3123b1cb8a3435001d2fa356198ea821c_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:37eda3069f8fb47a90b0adef38e93df074dbe57821e3c306da03e2c1e267e9ed_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:1209bca75d71152af832b0e11dfee461f4c6fdbeda6b91743e637ce453702f3c_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:1e342d10db70e1b160f906c65e6caa25aa64c519dd7ae7e8233fe2fe65121207_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:f7e2c329f04793173ae4412aa096cf86ce7225c94b059c56d8c9e7dbe71b9a19_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:5e2d853cc71ec673ce0f6bcc14628c2fd650a9153b8d7e5f8cd1a1b2ef36093e_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:a8942268c538c264d5a7950f91106c44b1a431262a7af31ed02bed79f1c22d93_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:ac206b3da24eb8df95e2e3b0bec234e84b8e5ef7000234f069855b73de77d846_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:440473f04ef4cfd1d016063daabf011eb2ba6b9acea96312a72f215277333e53_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:956fb983f6ca0991c2d2a03f7054bd2c9881c03883e44d7b695dba475df62a29_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:b1b03c78595d10ae30b5a35983784eaea11f1f9763944b2f9938117149bdd511_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:4b114196ac78f93575475437a794c881fe79126f3e73fed1fe5ea9f89fcdb6c1_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:4cf7cc86ccb8059ee5083d6e68a413e1db804ff45e126a9f87b1d52e8dd82855_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:ae0cf89749b44739b6f2560c3f6527cee2606b67388a7d965dd76644a25420f5_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:278eb4ecec21f235a26693b3f6c1b0cdfab5635f5a5ac51dd0540c6ab69c1316_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:61a6311f2ca53f6e600007bd9ffc90c7183f81db8fee8d839991565d82be5f2e_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:680c44946a899270de101bca06b22ed5b4eba0b85c1e01e21e30fc6a2740ab2d_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:25f94f0e27668fe254b7ff74731d39b7ed9f6c278c52dcf759893d9a1abe4895_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:ce82cceec1ccb2e951cc54fbc6bd1109a616034f9462b19f13dffa35902e0cef_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:fd70baba0ba7a59a994ca33527ecb2575ab199daeb4ecd34581cccf0db246c59_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:04cb0712418289fc446752a0c274d1036886312b7a63b54ebbeeab1421c10924_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:1d900ee34e14094e24b855acfbeec3f2f3c82f3fcc07d3b4cebe5e92ea1a8fde_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:b722f8982018f215a0a1566a561d742f1f7d99a2b507b8a7e874f6db1a6fef08_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-operator-bundle@sha256:1eab02e25f64839b15747d2bb8e0e6f8c3f632e9372a5ee926cde2c1e5cbc998_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:6c544de84925d0e3883a5d091c17a33362a0138271bbbda6663eb1407f98e0c5_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:74e4ae6c04abc489b90cab07c40f24f68ab7f92e366d3661ba3130ca6fa205c9_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:9f622b5daa152e2b8d94fa12defc3c08d93fddb34b1b4edbf841da5f00d7918d_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-operator-bundle@sha256:eec91dbe056a85b3a8b61c5ce4d9383e182440f5ea496fac64a22cd7920daf5f_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:183da02fcaa5915a0552e5c4c4716b521cb5a698590fc1f58e0cede837f52b49_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:1d7fe3558d416cf1ce9cd59e68f71ac3123b1cb8a3435001d2fa356198ea821c_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:37eda3069f8fb47a90b0adef38e93df074dbe57821e3c306da03e2c1e267e9ed_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:1209bca75d71152af832b0e11dfee461f4c6fdbeda6b91743e637ce453702f3c_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:1e342d10db70e1b160f906c65e6caa25aa64c519dd7ae7e8233fe2fe65121207_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:f7e2c329f04793173ae4412aa096cf86ce7225c94b059c56d8c9e7dbe71b9a19_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:5e2d853cc71ec673ce0f6bcc14628c2fd650a9153b8d7e5f8cd1a1b2ef36093e_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:a8942268c538c264d5a7950f91106c44b1a431262a7af31ed02bed79f1c22d93_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:ac206b3da24eb8df95e2e3b0bec234e84b8e5ef7000234f069855b73de77d846_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:440473f04ef4cfd1d016063daabf011eb2ba6b9acea96312a72f215277333e53_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:956fb983f6ca0991c2d2a03f7054bd2c9881c03883e44d7b695dba475df62a29_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:b1b03c78595d10ae30b5a35983784eaea11f1f9763944b2f9938117149bdd511_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:4b114196ac78f93575475437a794c881fe79126f3e73fed1fe5ea9f89fcdb6c1_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:4cf7cc86ccb8059ee5083d6e68a413e1db804ff45e126a9f87b1d52e8dd82855_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:ae0cf89749b44739b6f2560c3f6527cee2606b67388a7d965dd76644a25420f5_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:278eb4ecec21f235a26693b3f6c1b0cdfab5635f5a5ac51dd0540c6ab69c1316_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:61a6311f2ca53f6e600007bd9ffc90c7183f81db8fee8d839991565d82be5f2e_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:680c44946a899270de101bca06b22ed5b4eba0b85c1e01e21e30fc6a2740ab2d_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:25f94f0e27668fe254b7ff74731d39b7ed9f6c278c52dcf759893d9a1abe4895_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:ce82cceec1ccb2e951cc54fbc6bd1109a616034f9462b19f13dffa35902e0cef_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:fd70baba0ba7a59a994ca33527ecb2575ab199daeb4ecd34581cccf0db246c59_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:04cb0712418289fc446752a0c274d1036886312b7a63b54ebbeeab1421c10924_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:1d900ee34e14094e24b855acfbeec3f2f3c82f3fcc07d3b4cebe5e92ea1a8fde_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:b722f8982018f215a0a1566a561d742f1f7d99a2b507b8a7e874f6db1a6fef08_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "log4j-core: remote code execution via JDBC Appender"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for OpenShift Logging (5.2.6)\n\nRed Hat Product Security has rated this update as having a security impact of\nModerate. A Common Vulnerability Scoring System (CVSS) base score, which gives\na detailed severity rating, is available for each vulnerability from the CVE\nlink(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "OpenShift Logging Bug Fix Release (5.2.6)\n\nSecurity Fix(es):\n\n* nodejs-ua-parser-js: ReDoS via malicious User-Agent header (CVE-2021-27292)\n\n* log4j-core: remote code execution via JDBC Appender (CVE-2021-44832)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2022:0230",
        "url": "https://access.redhat.com/errata/RHSA-2022:0230"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "1940613",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1940613"
      },
      {
        "category": "external",
        "summary": "2035951",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2035951"
      },
      {
        "category": "external",
        "summary": "LOG-2104",
        "url": "https://issues.redhat.com/browse/LOG-2104"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0230.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat OpenShift Enterprise Logging bug fix and security update (5.2.6)",
    "tracking": {
      "current_release_date": "2026-05-29T20:04:08+00:00",
      "generator": {
        "date": "2026-05-29T20:04:08+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.1"
        }
      },
      "id": "RHSA-2022:0230",
      "initial_release_date": "2022-01-21T19:04:46+00:00",
      "revision_history": [
        {
          "date": "2022-01-21T19:04:46+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2022-01-21T19:04:46+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-29T20:04:08+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "OpenShift Logging 5.2",
                "product": {
                  "name": "OpenShift Logging 5.2",
                  "product_id": "8Base-OSE-LOGGING-5.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:logging:5.2::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Enterprise"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:3fa8f9590e009139c5d3c7f104d3bfee279e6a4a648b9f76defad60fa0a32954_s390x",
                "product": {
                  "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:3fa8f9590e009139c5d3c7f104d3bfee279e6a4a648b9f76defad60fa0a32954_s390x",
                  "product_id": "openshift-logging/cluster-logging-rhel8-operator@sha256:3fa8f9590e009139c5d3c7f104d3bfee279e6a4a648b9f76defad60fa0a32954_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cluster-logging-rhel8-operator@sha256:3fa8f9590e009139c5d3c7f104d3bfee279e6a4a648b9f76defad60fa0a32954?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel8-operator\u0026tag=v5.2.6-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:c4029eab5cf3ef8e00f774a04b786003e31073c85a585f50689009110d2a5f76_s390x",
                "product": {
                  "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:c4029eab5cf3ef8e00f774a04b786003e31073c85a585f50689009110d2a5f76_s390x",
                  "product_id": "openshift-logging/elasticsearch-rhel8-operator@sha256:c4029eab5cf3ef8e00f774a04b786003e31073c85a585f50689009110d2a5f76_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-rhel8-operator@sha256:c4029eab5cf3ef8e00f774a04b786003e31073c85a585f50689009110d2a5f76?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-rhel8-operator\u0026tag=v5.2.6-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:1738c1f613bc80f825795bba194000dd354e15aa05e881ef103e63ce4c905ac8_s390x",
                "product": {
                  "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:1738c1f613bc80f825795bba194000dd354e15aa05e881ef103e63ce4c905ac8_s390x",
                  "product_id": "openshift-logging/elasticsearch-proxy-rhel8@sha256:1738c1f613bc80f825795bba194000dd354e15aa05e881ef103e63ce4c905ac8_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-proxy-rhel8@sha256:1738c1f613bc80f825795bba194000dd354e15aa05e881ef103e63ce4c905ac8?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-proxy-rhel8\u0026tag=v1.0.0-104"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:c442371d189720167dd3de9deaab587dad8ab810977040da26f3457cfd6eb10e_s390x",
                "product": {
                  "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:c442371d189720167dd3de9deaab587dad8ab810977040da26f3457cfd6eb10e_s390x",
                  "product_id": "openshift-logging/log-file-metric-exporter-rhel8@sha256:c442371d189720167dd3de9deaab587dad8ab810977040da26f3457cfd6eb10e_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/log-file-metric-exporter-rhel8@sha256:c442371d189720167dd3de9deaab587dad8ab810977040da26f3457cfd6eb10e?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel8\u0026tag=v1.0.0-71"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/logging-curator5-rhel8@sha256:640ff6c8d8c3c16ba43f87f4d323e93d7d8cdae1df44d7220c79083e8284ebd6_s390x",
                "product": {
                  "name": "openshift-logging/logging-curator5-rhel8@sha256:640ff6c8d8c3c16ba43f87f4d323e93d7d8cdae1df44d7220c79083e8284ebd6_s390x",
                  "product_id": "openshift-logging/logging-curator5-rhel8@sha256:640ff6c8d8c3c16ba43f87f4d323e93d7d8cdae1df44d7220c79083e8284ebd6_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/logging-curator5-rhel8@sha256:640ff6c8d8c3c16ba43f87f4d323e93d7d8cdae1df44d7220c79083e8284ebd6?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/logging-curator5-rhel8\u0026tag=v5.8.1-73"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch6-rhel8@sha256:be1dd8dfaf204fa739a202ac7ddfcf3ed4441c97d05fa914cbbff34d5467bd76_s390x",
                "product": {
                  "name": "openshift-logging/elasticsearch6-rhel8@sha256:be1dd8dfaf204fa739a202ac7ddfcf3ed4441c97d05fa914cbbff34d5467bd76_s390x",
                  "product_id": "openshift-logging/elasticsearch6-rhel8@sha256:be1dd8dfaf204fa739a202ac7ddfcf3ed4441c97d05fa914cbbff34d5467bd76_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch6-rhel8@sha256:be1dd8dfaf204fa739a202ac7ddfcf3ed4441c97d05fa914cbbff34d5467bd76?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch6-rhel8\u0026tag=v6.8.1-100"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/eventrouter-rhel8@sha256:d5ae1f16eec322d9c9fb5604641cb038a831a0c7de331feb2999775e7958ed55_s390x",
                "product": {
                  "name": "openshift-logging/eventrouter-rhel8@sha256:d5ae1f16eec322d9c9fb5604641cb038a831a0c7de331feb2999775e7958ed55_s390x",
                  "product_id": "openshift-logging/eventrouter-rhel8@sha256:d5ae1f16eec322d9c9fb5604641cb038a831a0c7de331feb2999775e7958ed55_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/eventrouter-rhel8@sha256:d5ae1f16eec322d9c9fb5604641cb038a831a0c7de331feb2999775e7958ed55?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel8\u0026tag=v0.3.0-99"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/fluentd-rhel8@sha256:a1f3ef5cafecc311f1c206ea40fda0f53badc8a520d30ad4461a25a2177cc393_s390x",
                "product": {
                  "name": "openshift-logging/fluentd-rhel8@sha256:a1f3ef5cafecc311f1c206ea40fda0f53badc8a520d30ad4461a25a2177cc393_s390x",
                  "product_id": "openshift-logging/fluentd-rhel8@sha256:a1f3ef5cafecc311f1c206ea40fda0f53badc8a520d30ad4461a25a2177cc393_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/fluentd-rhel8@sha256:a1f3ef5cafecc311f1c206ea40fda0f53badc8a520d30ad4461a25a2177cc393?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/fluentd-rhel8\u0026tag=v1.7.4-104"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/kibana6-rhel8@sha256:5ec68bc1aa764552cb1471a1844708747fced656c031b8c8428deecd3137eb3a_s390x",
                "product": {
                  "name": "openshift-logging/kibana6-rhel8@sha256:5ec68bc1aa764552cb1471a1844708747fced656c031b8c8428deecd3137eb3a_s390x",
                  "product_id": "openshift-logging/kibana6-rhel8@sha256:5ec68bc1aa764552cb1471a1844708747fced656c031b8c8428deecd3137eb3a_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kibana6-rhel8@sha256:5ec68bc1aa764552cb1471a1844708747fced656c031b8c8428deecd3137eb3a?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/kibana6-rhel8\u0026tag=v6.8.1-110"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:ec5a23b5aabdf0103bfe6a19abbf5ff8911b8d0b48b72167517506b53cd32e71_amd64",
                "product": {
                  "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:ec5a23b5aabdf0103bfe6a19abbf5ff8911b8d0b48b72167517506b53cd32e71_amd64",
                  "product_id": "openshift-logging/cluster-logging-rhel8-operator@sha256:ec5a23b5aabdf0103bfe6a19abbf5ff8911b8d0b48b72167517506b53cd32e71_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cluster-logging-rhel8-operator@sha256:ec5a23b5aabdf0103bfe6a19abbf5ff8911b8d0b48b72167517506b53cd32e71?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel8-operator\u0026tag=v5.2.6-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/cluster-logging-operator-bundle@sha256:f4834508c179ac8ec28747587ea9a5c581e66b8a43dbc484e0b471ec44c5e7a8_amd64",
                "product": {
                  "name": "openshift-logging/cluster-logging-operator-bundle@sha256:f4834508c179ac8ec28747587ea9a5c581e66b8a43dbc484e0b471ec44c5e7a8_amd64",
                  "product_id": "openshift-logging/cluster-logging-operator-bundle@sha256:f4834508c179ac8ec28747587ea9a5c581e66b8a43dbc484e0b471ec44c5e7a8_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cluster-logging-operator-bundle@sha256:f4834508c179ac8ec28747587ea9a5c581e66b8a43dbc484e0b471ec44c5e7a8?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-operator-bundle\u0026tag=v5.2.6-6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:2f7f3178fff00f6096e340392dfe2e005f7fa6553eae194cb765dd026432d010_amd64",
                "product": {
                  "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:2f7f3178fff00f6096e340392dfe2e005f7fa6553eae194cb765dd026432d010_amd64",
                  "product_id": "openshift-logging/elasticsearch-rhel8-operator@sha256:2f7f3178fff00f6096e340392dfe2e005f7fa6553eae194cb765dd026432d010_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-rhel8-operator@sha256:2f7f3178fff00f6096e340392dfe2e005f7fa6553eae194cb765dd026432d010?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-rhel8-operator\u0026tag=v5.2.6-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-operator-bundle@sha256:e33d3f89fa14cef83be2bf1d15cf5bb1df57ffd9258902613a2a1309cbc11981_amd64",
                "product": {
                  "name": "openshift-logging/elasticsearch-operator-bundle@sha256:e33d3f89fa14cef83be2bf1d15cf5bb1df57ffd9258902613a2a1309cbc11981_amd64",
                  "product_id": "openshift-logging/elasticsearch-operator-bundle@sha256:e33d3f89fa14cef83be2bf1d15cf5bb1df57ffd9258902613a2a1309cbc11981_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-operator-bundle@sha256:e33d3f89fa14cef83be2bf1d15cf5bb1df57ffd9258902613a2a1309cbc11981?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-operator-bundle\u0026tag=v5.2.6-6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:bda4a51803d41c805074962d4207f0c56a4248d50d09bcd01017d55ea974166f_amd64",
                "product": {
                  "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:bda4a51803d41c805074962d4207f0c56a4248d50d09bcd01017d55ea974166f_amd64",
                  "product_id": "openshift-logging/elasticsearch-proxy-rhel8@sha256:bda4a51803d41c805074962d4207f0c56a4248d50d09bcd01017d55ea974166f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-proxy-rhel8@sha256:bda4a51803d41c805074962d4207f0c56a4248d50d09bcd01017d55ea974166f?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-proxy-rhel8\u0026tag=v1.0.0-104"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:59abfdea0e2fbafa7355967f3dc43700b82907aeaea520a10a87d4a77adc5963_amd64",
                "product": {
                  "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:59abfdea0e2fbafa7355967f3dc43700b82907aeaea520a10a87d4a77adc5963_amd64",
                  "product_id": "openshift-logging/log-file-metric-exporter-rhel8@sha256:59abfdea0e2fbafa7355967f3dc43700b82907aeaea520a10a87d4a77adc5963_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/log-file-metric-exporter-rhel8@sha256:59abfdea0e2fbafa7355967f3dc43700b82907aeaea520a10a87d4a77adc5963?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel8\u0026tag=v1.0.0-71"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/logging-curator5-rhel8@sha256:3dbc18048c93b6281f14b3472ed538a20b12b7e6c0524d61afda291b5bf11541_amd64",
                "product": {
                  "name": "openshift-logging/logging-curator5-rhel8@sha256:3dbc18048c93b6281f14b3472ed538a20b12b7e6c0524d61afda291b5bf11541_amd64",
                  "product_id": "openshift-logging/logging-curator5-rhel8@sha256:3dbc18048c93b6281f14b3472ed538a20b12b7e6c0524d61afda291b5bf11541_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/logging-curator5-rhel8@sha256:3dbc18048c93b6281f14b3472ed538a20b12b7e6c0524d61afda291b5bf11541?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/logging-curator5-rhel8\u0026tag=v5.8.1-73"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch6-rhel8@sha256:d78003468c5d530a8dddd9841ecd23921b6987187ef09a0b97eeda0e7e914c94_amd64",
                "product": {
                  "name": "openshift-logging/elasticsearch6-rhel8@sha256:d78003468c5d530a8dddd9841ecd23921b6987187ef09a0b97eeda0e7e914c94_amd64",
                  "product_id": "openshift-logging/elasticsearch6-rhel8@sha256:d78003468c5d530a8dddd9841ecd23921b6987187ef09a0b97eeda0e7e914c94_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch6-rhel8@sha256:d78003468c5d530a8dddd9841ecd23921b6987187ef09a0b97eeda0e7e914c94?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch6-rhel8\u0026tag=v6.8.1-100"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/eventrouter-rhel8@sha256:a0a4983317c397185b3c3dfda4f3399cad0b53daebe68a553991558fed8657cd_amd64",
                "product": {
                  "name": "openshift-logging/eventrouter-rhel8@sha256:a0a4983317c397185b3c3dfda4f3399cad0b53daebe68a553991558fed8657cd_amd64",
                  "product_id": "openshift-logging/eventrouter-rhel8@sha256:a0a4983317c397185b3c3dfda4f3399cad0b53daebe68a553991558fed8657cd_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/eventrouter-rhel8@sha256:a0a4983317c397185b3c3dfda4f3399cad0b53daebe68a553991558fed8657cd?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel8\u0026tag=v0.3.0-99"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/fluentd-rhel8@sha256:2ce16348308819fb21fa98c69ca56eb70b62cf36fb1c233d1928764b393dd3f0_amd64",
                "product": {
                  "name": "openshift-logging/fluentd-rhel8@sha256:2ce16348308819fb21fa98c69ca56eb70b62cf36fb1c233d1928764b393dd3f0_amd64",
                  "product_id": "openshift-logging/fluentd-rhel8@sha256:2ce16348308819fb21fa98c69ca56eb70b62cf36fb1c233d1928764b393dd3f0_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/fluentd-rhel8@sha256:2ce16348308819fb21fa98c69ca56eb70b62cf36fb1c233d1928764b393dd3f0?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/fluentd-rhel8\u0026tag=v1.7.4-104"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/kibana6-rhel8@sha256:8da444779bc4d8fefb85fe2a373d4f4280db9c41198e321e74b6cab05aed6922_amd64",
                "product": {
                  "name": "openshift-logging/kibana6-rhel8@sha256:8da444779bc4d8fefb85fe2a373d4f4280db9c41198e321e74b6cab05aed6922_amd64",
                  "product_id": "openshift-logging/kibana6-rhel8@sha256:8da444779bc4d8fefb85fe2a373d4f4280db9c41198e321e74b6cab05aed6922_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kibana6-rhel8@sha256:8da444779bc4d8fefb85fe2a373d4f4280db9c41198e321e74b6cab05aed6922?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/kibana6-rhel8\u0026tag=v6.8.1-110"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:34c1103c3d1fa2f4edc3629c5708ec29828627101eb57dd7256a91d247f30fde_ppc64le",
                "product": {
                  "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:34c1103c3d1fa2f4edc3629c5708ec29828627101eb57dd7256a91d247f30fde_ppc64le",
                  "product_id": "openshift-logging/cluster-logging-rhel8-operator@sha256:34c1103c3d1fa2f4edc3629c5708ec29828627101eb57dd7256a91d247f30fde_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cluster-logging-rhel8-operator@sha256:34c1103c3d1fa2f4edc3629c5708ec29828627101eb57dd7256a91d247f30fde?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel8-operator\u0026tag=v5.2.6-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:48b2b1685ae38774ec04f860f11a246838f8925be0b5adc0ec60bbde57419fb1_ppc64le",
                "product": {
                  "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:48b2b1685ae38774ec04f860f11a246838f8925be0b5adc0ec60bbde57419fb1_ppc64le",
                  "product_id": "openshift-logging/elasticsearch-rhel8-operator@sha256:48b2b1685ae38774ec04f860f11a246838f8925be0b5adc0ec60bbde57419fb1_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-rhel8-operator@sha256:48b2b1685ae38774ec04f860f11a246838f8925be0b5adc0ec60bbde57419fb1?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-rhel8-operator\u0026tag=v5.2.6-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:26e82e33639172e754d954c2de492f7ec0bff4760c7284fe85231d74e83da3cc_ppc64le",
                "product": {
                  "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:26e82e33639172e754d954c2de492f7ec0bff4760c7284fe85231d74e83da3cc_ppc64le",
                  "product_id": "openshift-logging/elasticsearch-proxy-rhel8@sha256:26e82e33639172e754d954c2de492f7ec0bff4760c7284fe85231d74e83da3cc_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-proxy-rhel8@sha256:26e82e33639172e754d954c2de492f7ec0bff4760c7284fe85231d74e83da3cc?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-proxy-rhel8\u0026tag=v1.0.0-104"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:c347e82a481d60f52e5fc9cfd0634dd69e82db309de5e1eedf12832461f2e399_ppc64le",
                "product": {
                  "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:c347e82a481d60f52e5fc9cfd0634dd69e82db309de5e1eedf12832461f2e399_ppc64le",
                  "product_id": "openshift-logging/log-file-metric-exporter-rhel8@sha256:c347e82a481d60f52e5fc9cfd0634dd69e82db309de5e1eedf12832461f2e399_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/log-file-metric-exporter-rhel8@sha256:c347e82a481d60f52e5fc9cfd0634dd69e82db309de5e1eedf12832461f2e399?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel8\u0026tag=v1.0.0-71"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/logging-curator5-rhel8@sha256:c93eef1216995a01b8a76d547798b4a327d8fd2be746c40cf4e3b6cc84cea56c_ppc64le",
                "product": {
                  "name": "openshift-logging/logging-curator5-rhel8@sha256:c93eef1216995a01b8a76d547798b4a327d8fd2be746c40cf4e3b6cc84cea56c_ppc64le",
                  "product_id": "openshift-logging/logging-curator5-rhel8@sha256:c93eef1216995a01b8a76d547798b4a327d8fd2be746c40cf4e3b6cc84cea56c_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/logging-curator5-rhel8@sha256:c93eef1216995a01b8a76d547798b4a327d8fd2be746c40cf4e3b6cc84cea56c?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/logging-curator5-rhel8\u0026tag=v5.8.1-73"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch6-rhel8@sha256:42925c7c419dd52bf611e6860b3c989ba396f9e5f1d9a459f5db6b958f932552_ppc64le",
                "product": {
                  "name": "openshift-logging/elasticsearch6-rhel8@sha256:42925c7c419dd52bf611e6860b3c989ba396f9e5f1d9a459f5db6b958f932552_ppc64le",
                  "product_id": "openshift-logging/elasticsearch6-rhel8@sha256:42925c7c419dd52bf611e6860b3c989ba396f9e5f1d9a459f5db6b958f932552_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch6-rhel8@sha256:42925c7c419dd52bf611e6860b3c989ba396f9e5f1d9a459f5db6b958f932552?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch6-rhel8\u0026tag=v6.8.1-100"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/eventrouter-rhel8@sha256:5bfaebca00db5b6ae5acb4a929be36f40704ac5a64806a13561c05b2409ed264_ppc64le",
                "product": {
                  "name": "openshift-logging/eventrouter-rhel8@sha256:5bfaebca00db5b6ae5acb4a929be36f40704ac5a64806a13561c05b2409ed264_ppc64le",
                  "product_id": "openshift-logging/eventrouter-rhel8@sha256:5bfaebca00db5b6ae5acb4a929be36f40704ac5a64806a13561c05b2409ed264_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/eventrouter-rhel8@sha256:5bfaebca00db5b6ae5acb4a929be36f40704ac5a64806a13561c05b2409ed264?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel8\u0026tag=v0.3.0-99"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/fluentd-rhel8@sha256:ac04d56e69fa742413b95177b2298502b8f9108be6bceb96b8ea4f9afbed5f74_ppc64le",
                "product": {
                  "name": "openshift-logging/fluentd-rhel8@sha256:ac04d56e69fa742413b95177b2298502b8f9108be6bceb96b8ea4f9afbed5f74_ppc64le",
                  "product_id": "openshift-logging/fluentd-rhel8@sha256:ac04d56e69fa742413b95177b2298502b8f9108be6bceb96b8ea4f9afbed5f74_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/fluentd-rhel8@sha256:ac04d56e69fa742413b95177b2298502b8f9108be6bceb96b8ea4f9afbed5f74?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/fluentd-rhel8\u0026tag=v1.7.4-104"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/kibana6-rhel8@sha256:e29a5cc022aa302459cff0ba435c24164ea5578d4f1468ab6bdfea0011220406_ppc64le",
                "product": {
                  "name": "openshift-logging/kibana6-rhel8@sha256:e29a5cc022aa302459cff0ba435c24164ea5578d4f1468ab6bdfea0011220406_ppc64le",
                  "product_id": "openshift-logging/kibana6-rhel8@sha256:e29a5cc022aa302459cff0ba435c24164ea5578d4f1468ab6bdfea0011220406_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kibana6-rhel8@sha256:e29a5cc022aa302459cff0ba435c24164ea5578d4f1468ab6bdfea0011220406?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/kibana6-rhel8\u0026tag=v6.8.1-110"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/cluster-logging-operator-bundle@sha256:f4834508c179ac8ec28747587ea9a5c581e66b8a43dbc484e0b471ec44c5e7a8_amd64 as a component of OpenShift Logging 5.2",
          "product_id": "8Base-OSE-LOGGING-5.2:openshift-logging/cluster-logging-operator-bundle@sha256:f4834508c179ac8ec28747587ea9a5c581e66b8a43dbc484e0b471ec44c5e7a8_amd64"
        },
        "product_reference": "openshift-logging/cluster-logging-operator-bundle@sha256:f4834508c179ac8ec28747587ea9a5c581e66b8a43dbc484e0b471ec44c5e7a8_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:34c1103c3d1fa2f4edc3629c5708ec29828627101eb57dd7256a91d247f30fde_ppc64le as a component of OpenShift Logging 5.2",
          "product_id": "8Base-OSE-LOGGING-5.2:openshift-logging/cluster-logging-rhel8-operator@sha256:34c1103c3d1fa2f4edc3629c5708ec29828627101eb57dd7256a91d247f30fde_ppc64le"
        },
        "product_reference": "openshift-logging/cluster-logging-rhel8-operator@sha256:34c1103c3d1fa2f4edc3629c5708ec29828627101eb57dd7256a91d247f30fde_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:3fa8f9590e009139c5d3c7f104d3bfee279e6a4a648b9f76defad60fa0a32954_s390x as a component of OpenShift Logging 5.2",
          "product_id": "8Base-OSE-LOGGING-5.2:openshift-logging/cluster-logging-rhel8-operator@sha256:3fa8f9590e009139c5d3c7f104d3bfee279e6a4a648b9f76defad60fa0a32954_s390x"
        },
        "product_reference": "openshift-logging/cluster-logging-rhel8-operator@sha256:3fa8f9590e009139c5d3c7f104d3bfee279e6a4a648b9f76defad60fa0a32954_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:ec5a23b5aabdf0103bfe6a19abbf5ff8911b8d0b48b72167517506b53cd32e71_amd64 as a component of OpenShift Logging 5.2",
          "product_id": "8Base-OSE-LOGGING-5.2:openshift-logging/cluster-logging-rhel8-operator@sha256:ec5a23b5aabdf0103bfe6a19abbf5ff8911b8d0b48b72167517506b53cd32e71_amd64"
        },
        "product_reference": "openshift-logging/cluster-logging-rhel8-operator@sha256:ec5a23b5aabdf0103bfe6a19abbf5ff8911b8d0b48b72167517506b53cd32e71_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-operator-bundle@sha256:e33d3f89fa14cef83be2bf1d15cf5bb1df57ffd9258902613a2a1309cbc11981_amd64 as a component of OpenShift Logging 5.2",
          "product_id": "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-operator-bundle@sha256:e33d3f89fa14cef83be2bf1d15cf5bb1df57ffd9258902613a2a1309cbc11981_amd64"
        },
        "product_reference": "openshift-logging/elasticsearch-operator-bundle@sha256:e33d3f89fa14cef83be2bf1d15cf5bb1df57ffd9258902613a2a1309cbc11981_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:1738c1f613bc80f825795bba194000dd354e15aa05e881ef103e63ce4c905ac8_s390x as a component of OpenShift Logging 5.2",
          "product_id": "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-proxy-rhel8@sha256:1738c1f613bc80f825795bba194000dd354e15aa05e881ef103e63ce4c905ac8_s390x"
        },
        "product_reference": "openshift-logging/elasticsearch-proxy-rhel8@sha256:1738c1f613bc80f825795bba194000dd354e15aa05e881ef103e63ce4c905ac8_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:26e82e33639172e754d954c2de492f7ec0bff4760c7284fe85231d74e83da3cc_ppc64le as a component of OpenShift Logging 5.2",
          "product_id": "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-proxy-rhel8@sha256:26e82e33639172e754d954c2de492f7ec0bff4760c7284fe85231d74e83da3cc_ppc64le"
        },
        "product_reference": "openshift-logging/elasticsearch-proxy-rhel8@sha256:26e82e33639172e754d954c2de492f7ec0bff4760c7284fe85231d74e83da3cc_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:bda4a51803d41c805074962d4207f0c56a4248d50d09bcd01017d55ea974166f_amd64 as a component of OpenShift Logging 5.2",
          "product_id": "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-proxy-rhel8@sha256:bda4a51803d41c805074962d4207f0c56a4248d50d09bcd01017d55ea974166f_amd64"
        },
        "product_reference": "openshift-logging/elasticsearch-proxy-rhel8@sha256:bda4a51803d41c805074962d4207f0c56a4248d50d09bcd01017d55ea974166f_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:2f7f3178fff00f6096e340392dfe2e005f7fa6553eae194cb765dd026432d010_amd64 as a component of OpenShift Logging 5.2",
          "product_id": "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-rhel8-operator@sha256:2f7f3178fff00f6096e340392dfe2e005f7fa6553eae194cb765dd026432d010_amd64"
        },
        "product_reference": "openshift-logging/elasticsearch-rhel8-operator@sha256:2f7f3178fff00f6096e340392dfe2e005f7fa6553eae194cb765dd026432d010_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:48b2b1685ae38774ec04f860f11a246838f8925be0b5adc0ec60bbde57419fb1_ppc64le as a component of OpenShift Logging 5.2",
          "product_id": "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-rhel8-operator@sha256:48b2b1685ae38774ec04f860f11a246838f8925be0b5adc0ec60bbde57419fb1_ppc64le"
        },
        "product_reference": "openshift-logging/elasticsearch-rhel8-operator@sha256:48b2b1685ae38774ec04f860f11a246838f8925be0b5adc0ec60bbde57419fb1_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:c4029eab5cf3ef8e00f774a04b786003e31073c85a585f50689009110d2a5f76_s390x as a component of OpenShift Logging 5.2",
          "product_id": "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-rhel8-operator@sha256:c4029eab5cf3ef8e00f774a04b786003e31073c85a585f50689009110d2a5f76_s390x"
        },
        "product_reference": "openshift-logging/elasticsearch-rhel8-operator@sha256:c4029eab5cf3ef8e00f774a04b786003e31073c85a585f50689009110d2a5f76_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch6-rhel8@sha256:42925c7c419dd52bf611e6860b3c989ba396f9e5f1d9a459f5db6b958f932552_ppc64le as a component of OpenShift Logging 5.2",
          "product_id": "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch6-rhel8@sha256:42925c7c419dd52bf611e6860b3c989ba396f9e5f1d9a459f5db6b958f932552_ppc64le"
        },
        "product_reference": "openshift-logging/elasticsearch6-rhel8@sha256:42925c7c419dd52bf611e6860b3c989ba396f9e5f1d9a459f5db6b958f932552_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch6-rhel8@sha256:be1dd8dfaf204fa739a202ac7ddfcf3ed4441c97d05fa914cbbff34d5467bd76_s390x as a component of OpenShift Logging 5.2",
          "product_id": "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch6-rhel8@sha256:be1dd8dfaf204fa739a202ac7ddfcf3ed4441c97d05fa914cbbff34d5467bd76_s390x"
        },
        "product_reference": "openshift-logging/elasticsearch6-rhel8@sha256:be1dd8dfaf204fa739a202ac7ddfcf3ed4441c97d05fa914cbbff34d5467bd76_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch6-rhel8@sha256:d78003468c5d530a8dddd9841ecd23921b6987187ef09a0b97eeda0e7e914c94_amd64 as a component of OpenShift Logging 5.2",
          "product_id": "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch6-rhel8@sha256:d78003468c5d530a8dddd9841ecd23921b6987187ef09a0b97eeda0e7e914c94_amd64"
        },
        "product_reference": "openshift-logging/elasticsearch6-rhel8@sha256:d78003468c5d530a8dddd9841ecd23921b6987187ef09a0b97eeda0e7e914c94_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/eventrouter-rhel8@sha256:5bfaebca00db5b6ae5acb4a929be36f40704ac5a64806a13561c05b2409ed264_ppc64le as a component of OpenShift Logging 5.2",
          "product_id": "8Base-OSE-LOGGING-5.2:openshift-logging/eventrouter-rhel8@sha256:5bfaebca00db5b6ae5acb4a929be36f40704ac5a64806a13561c05b2409ed264_ppc64le"
        },
        "product_reference": "openshift-logging/eventrouter-rhel8@sha256:5bfaebca00db5b6ae5acb4a929be36f40704ac5a64806a13561c05b2409ed264_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/eventrouter-rhel8@sha256:a0a4983317c397185b3c3dfda4f3399cad0b53daebe68a553991558fed8657cd_amd64 as a component of OpenShift Logging 5.2",
          "product_id": "8Base-OSE-LOGGING-5.2:openshift-logging/eventrouter-rhel8@sha256:a0a4983317c397185b3c3dfda4f3399cad0b53daebe68a553991558fed8657cd_amd64"
        },
        "product_reference": "openshift-logging/eventrouter-rhel8@sha256:a0a4983317c397185b3c3dfda4f3399cad0b53daebe68a553991558fed8657cd_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/eventrouter-rhel8@sha256:d5ae1f16eec322d9c9fb5604641cb038a831a0c7de331feb2999775e7958ed55_s390x as a component of OpenShift Logging 5.2",
          "product_id": "8Base-OSE-LOGGING-5.2:openshift-logging/eventrouter-rhel8@sha256:d5ae1f16eec322d9c9fb5604641cb038a831a0c7de331feb2999775e7958ed55_s390x"
        },
        "product_reference": "openshift-logging/eventrouter-rhel8@sha256:d5ae1f16eec322d9c9fb5604641cb038a831a0c7de331feb2999775e7958ed55_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/fluentd-rhel8@sha256:2ce16348308819fb21fa98c69ca56eb70b62cf36fb1c233d1928764b393dd3f0_amd64 as a component of OpenShift Logging 5.2",
          "product_id": "8Base-OSE-LOGGING-5.2:openshift-logging/fluentd-rhel8@sha256:2ce16348308819fb21fa98c69ca56eb70b62cf36fb1c233d1928764b393dd3f0_amd64"
        },
        "product_reference": "openshift-logging/fluentd-rhel8@sha256:2ce16348308819fb21fa98c69ca56eb70b62cf36fb1c233d1928764b393dd3f0_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/fluentd-rhel8@sha256:a1f3ef5cafecc311f1c206ea40fda0f53badc8a520d30ad4461a25a2177cc393_s390x as a component of OpenShift Logging 5.2",
          "product_id": "8Base-OSE-LOGGING-5.2:openshift-logging/fluentd-rhel8@sha256:a1f3ef5cafecc311f1c206ea40fda0f53badc8a520d30ad4461a25a2177cc393_s390x"
        },
        "product_reference": "openshift-logging/fluentd-rhel8@sha256:a1f3ef5cafecc311f1c206ea40fda0f53badc8a520d30ad4461a25a2177cc393_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/fluentd-rhel8@sha256:ac04d56e69fa742413b95177b2298502b8f9108be6bceb96b8ea4f9afbed5f74_ppc64le as a component of OpenShift Logging 5.2",
          "product_id": "8Base-OSE-LOGGING-5.2:openshift-logging/fluentd-rhel8@sha256:ac04d56e69fa742413b95177b2298502b8f9108be6bceb96b8ea4f9afbed5f74_ppc64le"
        },
        "product_reference": "openshift-logging/fluentd-rhel8@sha256:ac04d56e69fa742413b95177b2298502b8f9108be6bceb96b8ea4f9afbed5f74_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/kibana6-rhel8@sha256:5ec68bc1aa764552cb1471a1844708747fced656c031b8c8428deecd3137eb3a_s390x as a component of OpenShift Logging 5.2",
          "product_id": "8Base-OSE-LOGGING-5.2:openshift-logging/kibana6-rhel8@sha256:5ec68bc1aa764552cb1471a1844708747fced656c031b8c8428deecd3137eb3a_s390x"
        },
        "product_reference": "openshift-logging/kibana6-rhel8@sha256:5ec68bc1aa764552cb1471a1844708747fced656c031b8c8428deecd3137eb3a_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/kibana6-rhel8@sha256:8da444779bc4d8fefb85fe2a373d4f4280db9c41198e321e74b6cab05aed6922_amd64 as a component of OpenShift Logging 5.2",
          "product_id": "8Base-OSE-LOGGING-5.2:openshift-logging/kibana6-rhel8@sha256:8da444779bc4d8fefb85fe2a373d4f4280db9c41198e321e74b6cab05aed6922_amd64"
        },
        "product_reference": "openshift-logging/kibana6-rhel8@sha256:8da444779bc4d8fefb85fe2a373d4f4280db9c41198e321e74b6cab05aed6922_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/kibana6-rhel8@sha256:e29a5cc022aa302459cff0ba435c24164ea5578d4f1468ab6bdfea0011220406_ppc64le as a component of OpenShift Logging 5.2",
          "product_id": "8Base-OSE-LOGGING-5.2:openshift-logging/kibana6-rhel8@sha256:e29a5cc022aa302459cff0ba435c24164ea5578d4f1468ab6bdfea0011220406_ppc64le"
        },
        "product_reference": "openshift-logging/kibana6-rhel8@sha256:e29a5cc022aa302459cff0ba435c24164ea5578d4f1468ab6bdfea0011220406_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:59abfdea0e2fbafa7355967f3dc43700b82907aeaea520a10a87d4a77adc5963_amd64 as a component of OpenShift Logging 5.2",
          "product_id": "8Base-OSE-LOGGING-5.2:openshift-logging/log-file-metric-exporter-rhel8@sha256:59abfdea0e2fbafa7355967f3dc43700b82907aeaea520a10a87d4a77adc5963_amd64"
        },
        "product_reference": "openshift-logging/log-file-metric-exporter-rhel8@sha256:59abfdea0e2fbafa7355967f3dc43700b82907aeaea520a10a87d4a77adc5963_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:c347e82a481d60f52e5fc9cfd0634dd69e82db309de5e1eedf12832461f2e399_ppc64le as a component of OpenShift Logging 5.2",
          "product_id": "8Base-OSE-LOGGING-5.2:openshift-logging/log-file-metric-exporter-rhel8@sha256:c347e82a481d60f52e5fc9cfd0634dd69e82db309de5e1eedf12832461f2e399_ppc64le"
        },
        "product_reference": "openshift-logging/log-file-metric-exporter-rhel8@sha256:c347e82a481d60f52e5fc9cfd0634dd69e82db309de5e1eedf12832461f2e399_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:c442371d189720167dd3de9deaab587dad8ab810977040da26f3457cfd6eb10e_s390x as a component of OpenShift Logging 5.2",
          "product_id": "8Base-OSE-LOGGING-5.2:openshift-logging/log-file-metric-exporter-rhel8@sha256:c442371d189720167dd3de9deaab587dad8ab810977040da26f3457cfd6eb10e_s390x"
        },
        "product_reference": "openshift-logging/log-file-metric-exporter-rhel8@sha256:c442371d189720167dd3de9deaab587dad8ab810977040da26f3457cfd6eb10e_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/logging-curator5-rhel8@sha256:3dbc18048c93b6281f14b3472ed538a20b12b7e6c0524d61afda291b5bf11541_amd64 as a component of OpenShift Logging 5.2",
          "product_id": "8Base-OSE-LOGGING-5.2:openshift-logging/logging-curator5-rhel8@sha256:3dbc18048c93b6281f14b3472ed538a20b12b7e6c0524d61afda291b5bf11541_amd64"
        },
        "product_reference": "openshift-logging/logging-curator5-rhel8@sha256:3dbc18048c93b6281f14b3472ed538a20b12b7e6c0524d61afda291b5bf11541_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/logging-curator5-rhel8@sha256:640ff6c8d8c3c16ba43f87f4d323e93d7d8cdae1df44d7220c79083e8284ebd6_s390x as a component of OpenShift Logging 5.2",
          "product_id": "8Base-OSE-LOGGING-5.2:openshift-logging/logging-curator5-rhel8@sha256:640ff6c8d8c3c16ba43f87f4d323e93d7d8cdae1df44d7220c79083e8284ebd6_s390x"
        },
        "product_reference": "openshift-logging/logging-curator5-rhel8@sha256:640ff6c8d8c3c16ba43f87f4d323e93d7d8cdae1df44d7220c79083e8284ebd6_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/logging-curator5-rhel8@sha256:c93eef1216995a01b8a76d547798b4a327d8fd2be746c40cf4e3b6cc84cea56c_ppc64le as a component of OpenShift Logging 5.2",
          "product_id": "8Base-OSE-LOGGING-5.2:openshift-logging/logging-curator5-rhel8@sha256:c93eef1216995a01b8a76d547798b4a327d8fd2be746c40cf4e3b6cc84cea56c_ppc64le"
        },
        "product_reference": "openshift-logging/logging-curator5-rhel8@sha256:c93eef1216995a01b8a76d547798b4a327d8fd2be746c40cf4e3b6cc84cea56c_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-27292",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2021-03-17T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-OSE-LOGGING-5.2:openshift-logging/cluster-logging-operator-bundle@sha256:f4834508c179ac8ec28747587ea9a5c581e66b8a43dbc484e0b471ec44c5e7a8_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/cluster-logging-rhel8-operator@sha256:34c1103c3d1fa2f4edc3629c5708ec29828627101eb57dd7256a91d247f30fde_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/cluster-logging-rhel8-operator@sha256:3fa8f9590e009139c5d3c7f104d3bfee279e6a4a648b9f76defad60fa0a32954_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/cluster-logging-rhel8-operator@sha256:ec5a23b5aabdf0103bfe6a19abbf5ff8911b8d0b48b72167517506b53cd32e71_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-operator-bundle@sha256:e33d3f89fa14cef83be2bf1d15cf5bb1df57ffd9258902613a2a1309cbc11981_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-proxy-rhel8@sha256:1738c1f613bc80f825795bba194000dd354e15aa05e881ef103e63ce4c905ac8_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-proxy-rhel8@sha256:26e82e33639172e754d954c2de492f7ec0bff4760c7284fe85231d74e83da3cc_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-proxy-rhel8@sha256:bda4a51803d41c805074962d4207f0c56a4248d50d09bcd01017d55ea974166f_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-rhel8-operator@sha256:2f7f3178fff00f6096e340392dfe2e005f7fa6553eae194cb765dd026432d010_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-rhel8-operator@sha256:48b2b1685ae38774ec04f860f11a246838f8925be0b5adc0ec60bbde57419fb1_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-rhel8-operator@sha256:c4029eab5cf3ef8e00f774a04b786003e31073c85a585f50689009110d2a5f76_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch6-rhel8@sha256:42925c7c419dd52bf611e6860b3c989ba396f9e5f1d9a459f5db6b958f932552_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch6-rhel8@sha256:be1dd8dfaf204fa739a202ac7ddfcf3ed4441c97d05fa914cbbff34d5467bd76_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch6-rhel8@sha256:d78003468c5d530a8dddd9841ecd23921b6987187ef09a0b97eeda0e7e914c94_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/eventrouter-rhel8@sha256:5bfaebca00db5b6ae5acb4a929be36f40704ac5a64806a13561c05b2409ed264_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/eventrouter-rhel8@sha256:a0a4983317c397185b3c3dfda4f3399cad0b53daebe68a553991558fed8657cd_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/eventrouter-rhel8@sha256:d5ae1f16eec322d9c9fb5604641cb038a831a0c7de331feb2999775e7958ed55_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/fluentd-rhel8@sha256:2ce16348308819fb21fa98c69ca56eb70b62cf36fb1c233d1928764b393dd3f0_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/fluentd-rhel8@sha256:a1f3ef5cafecc311f1c206ea40fda0f53badc8a520d30ad4461a25a2177cc393_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/fluentd-rhel8@sha256:ac04d56e69fa742413b95177b2298502b8f9108be6bceb96b8ea4f9afbed5f74_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/log-file-metric-exporter-rhel8@sha256:59abfdea0e2fbafa7355967f3dc43700b82907aeaea520a10a87d4a77adc5963_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/log-file-metric-exporter-rhel8@sha256:c347e82a481d60f52e5fc9cfd0634dd69e82db309de5e1eedf12832461f2e399_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/log-file-metric-exporter-rhel8@sha256:c442371d189720167dd3de9deaab587dad8ab810977040da26f3457cfd6eb10e_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/logging-curator5-rhel8@sha256:3dbc18048c93b6281f14b3472ed538a20b12b7e6c0524d61afda291b5bf11541_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/logging-curator5-rhel8@sha256:640ff6c8d8c3c16ba43f87f4d323e93d7d8cdae1df44d7220c79083e8284ebd6_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/logging-curator5-rhel8@sha256:c93eef1216995a01b8a76d547798b4a327d8fd2be746c40cf4e3b6cc84cea56c_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1940613"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A regular expression denial of service (ReDoS) vulnerability was found in the npm library `ua-parser-js`. If a supplied user agent matches the `Noble` string and contains many spaces then the regex will conduct backtracking, taking an ever increasing amount of time depending on the number of spaces supplied. An attacker can use this vulnerability to potentially craft a malicious user agent resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs-ua-parser-js: ReDoS via malicious User-Agent header",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "While some components do package a vulnerable version of ua-parser-js, access to them requires OpenShift OAuth credentials and hence have been marked with a Low impact. This applies to the following products:\n  - OpenShift Container Platform (OCP)\n  - OpenShift ServiceMesh (OSSM) \n  - Red Hat OpenShift Jaeger (RHOSJ)\n  - Red Hat OpenShift Logging\n\nThe OCP presto-container does ship the vulnerable component, however since OCP 4.6 the Metering product has been deprecated [1], set as wont-fix and may be fixed in a future release.\n\nRed Hat Advanced Cluster Management for Kubernetes (RHACM) ships graphql-tools that pulls 0.7.23 version of ua-parser-js that uses the affected code.\n\n[1] - https://access.redhat.com/solutions/5707561",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-OSE-LOGGING-5.2:openshift-logging/kibana6-rhel8@sha256:5ec68bc1aa764552cb1471a1844708747fced656c031b8c8428deecd3137eb3a_s390x",
          "8Base-OSE-LOGGING-5.2:openshift-logging/kibana6-rhel8@sha256:8da444779bc4d8fefb85fe2a373d4f4280db9c41198e321e74b6cab05aed6922_amd64",
          "8Base-OSE-LOGGING-5.2:openshift-logging/kibana6-rhel8@sha256:e29a5cc022aa302459cff0ba435c24164ea5578d4f1468ab6bdfea0011220406_ppc64le"
        ],
        "known_not_affected": [
          "8Base-OSE-LOGGING-5.2:openshift-logging/cluster-logging-operator-bundle@sha256:f4834508c179ac8ec28747587ea9a5c581e66b8a43dbc484e0b471ec44c5e7a8_amd64",
          "8Base-OSE-LOGGING-5.2:openshift-logging/cluster-logging-rhel8-operator@sha256:34c1103c3d1fa2f4edc3629c5708ec29828627101eb57dd7256a91d247f30fde_ppc64le",
          "8Base-OSE-LOGGING-5.2:openshift-logging/cluster-logging-rhel8-operator@sha256:3fa8f9590e009139c5d3c7f104d3bfee279e6a4a648b9f76defad60fa0a32954_s390x",
          "8Base-OSE-LOGGING-5.2:openshift-logging/cluster-logging-rhel8-operator@sha256:ec5a23b5aabdf0103bfe6a19abbf5ff8911b8d0b48b72167517506b53cd32e71_amd64",
          "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-operator-bundle@sha256:e33d3f89fa14cef83be2bf1d15cf5bb1df57ffd9258902613a2a1309cbc11981_amd64",
          "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-proxy-rhel8@sha256:1738c1f613bc80f825795bba194000dd354e15aa05e881ef103e63ce4c905ac8_s390x",
          "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-proxy-rhel8@sha256:26e82e33639172e754d954c2de492f7ec0bff4760c7284fe85231d74e83da3cc_ppc64le",
          "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-proxy-rhel8@sha256:bda4a51803d41c805074962d4207f0c56a4248d50d09bcd01017d55ea974166f_amd64",
          "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-rhel8-operator@sha256:2f7f3178fff00f6096e340392dfe2e005f7fa6553eae194cb765dd026432d010_amd64",
          "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-rhel8-operator@sha256:48b2b1685ae38774ec04f860f11a246838f8925be0b5adc0ec60bbde57419fb1_ppc64le",
          "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-rhel8-operator@sha256:c4029eab5cf3ef8e00f774a04b786003e31073c85a585f50689009110d2a5f76_s390x",
          "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch6-rhel8@sha256:42925c7c419dd52bf611e6860b3c989ba396f9e5f1d9a459f5db6b958f932552_ppc64le",
          "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch6-rhel8@sha256:be1dd8dfaf204fa739a202ac7ddfcf3ed4441c97d05fa914cbbff34d5467bd76_s390x",
          "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch6-rhel8@sha256:d78003468c5d530a8dddd9841ecd23921b6987187ef09a0b97eeda0e7e914c94_amd64",
          "8Base-OSE-LOGGING-5.2:openshift-logging/eventrouter-rhel8@sha256:5bfaebca00db5b6ae5acb4a929be36f40704ac5a64806a13561c05b2409ed264_ppc64le",
          "8Base-OSE-LOGGING-5.2:openshift-logging/eventrouter-rhel8@sha256:a0a4983317c397185b3c3dfda4f3399cad0b53daebe68a553991558fed8657cd_amd64",
          "8Base-OSE-LOGGING-5.2:openshift-logging/eventrouter-rhel8@sha256:d5ae1f16eec322d9c9fb5604641cb038a831a0c7de331feb2999775e7958ed55_s390x",
          "8Base-OSE-LOGGING-5.2:openshift-logging/fluentd-rhel8@sha256:2ce16348308819fb21fa98c69ca56eb70b62cf36fb1c233d1928764b393dd3f0_amd64",
          "8Base-OSE-LOGGING-5.2:openshift-logging/fluentd-rhel8@sha256:a1f3ef5cafecc311f1c206ea40fda0f53badc8a520d30ad4461a25a2177cc393_s390x",
          "8Base-OSE-LOGGING-5.2:openshift-logging/fluentd-rhel8@sha256:ac04d56e69fa742413b95177b2298502b8f9108be6bceb96b8ea4f9afbed5f74_ppc64le",
          "8Base-OSE-LOGGING-5.2:openshift-logging/log-file-metric-exporter-rhel8@sha256:59abfdea0e2fbafa7355967f3dc43700b82907aeaea520a10a87d4a77adc5963_amd64",
          "8Base-OSE-LOGGING-5.2:openshift-logging/log-file-metric-exporter-rhel8@sha256:c347e82a481d60f52e5fc9cfd0634dd69e82db309de5e1eedf12832461f2e399_ppc64le",
          "8Base-OSE-LOGGING-5.2:openshift-logging/log-file-metric-exporter-rhel8@sha256:c442371d189720167dd3de9deaab587dad8ab810977040da26f3457cfd6eb10e_s390x",
          "8Base-OSE-LOGGING-5.2:openshift-logging/logging-curator5-rhel8@sha256:3dbc18048c93b6281f14b3472ed538a20b12b7e6c0524d61afda291b5bf11541_amd64",
          "8Base-OSE-LOGGING-5.2:openshift-logging/logging-curator5-rhel8@sha256:640ff6c8d8c3c16ba43f87f4d323e93d7d8cdae1df44d7220c79083e8284ebd6_s390x",
          "8Base-OSE-LOGGING-5.2:openshift-logging/logging-curator5-rhel8@sha256:c93eef1216995a01b8a76d547798b4a327d8fd2be746c40cf4e3b6cc84cea56c_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-27292"
        },
        {
          "category": "external",
          "summary": "RHBZ#1940613",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1940613"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-27292",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-27292"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-27292",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27292"
        },
        {
          "category": "external",
          "summary": "https://gist.github.com/b-c-ds/6941d80d6b4e694df4bc269493b7be76",
          "url": "https://gist.github.com/b-c-ds/6941d80d6b4e694df4bc269493b7be76"
        }
      ],
      "release_date": "2021-02-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-01-21T19:04:46+00:00",
          "details": "For OpenShift Container Platform 4.8 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nFor Red Hat OpenShift Logging 5.2, see the following instructions to apply this update:\n\nhttps://docs.openshift.com/container-platform/4.7/logging/cluster-logging-upgrading.html",
          "product_ids": [
            "8Base-OSE-LOGGING-5.2:openshift-logging/kibana6-rhel8@sha256:5ec68bc1aa764552cb1471a1844708747fced656c031b8c8428deecd3137eb3a_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/kibana6-rhel8@sha256:8da444779bc4d8fefb85fe2a373d4f4280db9c41198e321e74b6cab05aed6922_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/kibana6-rhel8@sha256:e29a5cc022aa302459cff0ba435c24164ea5578d4f1468ab6bdfea0011220406_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0230"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-OSE-LOGGING-5.2:openshift-logging/cluster-logging-operator-bundle@sha256:f4834508c179ac8ec28747587ea9a5c581e66b8a43dbc484e0b471ec44c5e7a8_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/cluster-logging-rhel8-operator@sha256:34c1103c3d1fa2f4edc3629c5708ec29828627101eb57dd7256a91d247f30fde_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/cluster-logging-rhel8-operator@sha256:3fa8f9590e009139c5d3c7f104d3bfee279e6a4a648b9f76defad60fa0a32954_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/cluster-logging-rhel8-operator@sha256:ec5a23b5aabdf0103bfe6a19abbf5ff8911b8d0b48b72167517506b53cd32e71_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-operator-bundle@sha256:e33d3f89fa14cef83be2bf1d15cf5bb1df57ffd9258902613a2a1309cbc11981_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-proxy-rhel8@sha256:1738c1f613bc80f825795bba194000dd354e15aa05e881ef103e63ce4c905ac8_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-proxy-rhel8@sha256:26e82e33639172e754d954c2de492f7ec0bff4760c7284fe85231d74e83da3cc_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-proxy-rhel8@sha256:bda4a51803d41c805074962d4207f0c56a4248d50d09bcd01017d55ea974166f_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-rhel8-operator@sha256:2f7f3178fff00f6096e340392dfe2e005f7fa6553eae194cb765dd026432d010_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-rhel8-operator@sha256:48b2b1685ae38774ec04f860f11a246838f8925be0b5adc0ec60bbde57419fb1_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-rhel8-operator@sha256:c4029eab5cf3ef8e00f774a04b786003e31073c85a585f50689009110d2a5f76_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch6-rhel8@sha256:42925c7c419dd52bf611e6860b3c989ba396f9e5f1d9a459f5db6b958f932552_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch6-rhel8@sha256:be1dd8dfaf204fa739a202ac7ddfcf3ed4441c97d05fa914cbbff34d5467bd76_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch6-rhel8@sha256:d78003468c5d530a8dddd9841ecd23921b6987187ef09a0b97eeda0e7e914c94_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/eventrouter-rhel8@sha256:5bfaebca00db5b6ae5acb4a929be36f40704ac5a64806a13561c05b2409ed264_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/eventrouter-rhel8@sha256:a0a4983317c397185b3c3dfda4f3399cad0b53daebe68a553991558fed8657cd_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/eventrouter-rhel8@sha256:d5ae1f16eec322d9c9fb5604641cb038a831a0c7de331feb2999775e7958ed55_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/fluentd-rhel8@sha256:2ce16348308819fb21fa98c69ca56eb70b62cf36fb1c233d1928764b393dd3f0_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/fluentd-rhel8@sha256:a1f3ef5cafecc311f1c206ea40fda0f53badc8a520d30ad4461a25a2177cc393_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/fluentd-rhel8@sha256:ac04d56e69fa742413b95177b2298502b8f9108be6bceb96b8ea4f9afbed5f74_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/kibana6-rhel8@sha256:5ec68bc1aa764552cb1471a1844708747fced656c031b8c8428deecd3137eb3a_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/kibana6-rhel8@sha256:8da444779bc4d8fefb85fe2a373d4f4280db9c41198e321e74b6cab05aed6922_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/kibana6-rhel8@sha256:e29a5cc022aa302459cff0ba435c24164ea5578d4f1468ab6bdfea0011220406_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/log-file-metric-exporter-rhel8@sha256:59abfdea0e2fbafa7355967f3dc43700b82907aeaea520a10a87d4a77adc5963_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/log-file-metric-exporter-rhel8@sha256:c347e82a481d60f52e5fc9cfd0634dd69e82db309de5e1eedf12832461f2e399_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/log-file-metric-exporter-rhel8@sha256:c442371d189720167dd3de9deaab587dad8ab810977040da26f3457cfd6eb10e_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/logging-curator5-rhel8@sha256:3dbc18048c93b6281f14b3472ed538a20b12b7e6c0524d61afda291b5bf11541_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/logging-curator5-rhel8@sha256:640ff6c8d8c3c16ba43f87f4d323e93d7d8cdae1df44d7220c79083e8284ebd6_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/logging-curator5-rhel8@sha256:c93eef1216995a01b8a76d547798b4a327d8fd2be746c40cf4e3b6cc84cea56c_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "nodejs-ua-parser-js: ReDoS via malicious User-Agent header"
    },
    {
      "cve": "CVE-2021-44832",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2021-12-28T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-OSE-LOGGING-5.2:openshift-logging/cluster-logging-operator-bundle@sha256:f4834508c179ac8ec28747587ea9a5c581e66b8a43dbc484e0b471ec44c5e7a8_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/cluster-logging-rhel8-operator@sha256:34c1103c3d1fa2f4edc3629c5708ec29828627101eb57dd7256a91d247f30fde_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/cluster-logging-rhel8-operator@sha256:3fa8f9590e009139c5d3c7f104d3bfee279e6a4a648b9f76defad60fa0a32954_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/cluster-logging-rhel8-operator@sha256:ec5a23b5aabdf0103bfe6a19abbf5ff8911b8d0b48b72167517506b53cd32e71_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-operator-bundle@sha256:e33d3f89fa14cef83be2bf1d15cf5bb1df57ffd9258902613a2a1309cbc11981_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-proxy-rhel8@sha256:1738c1f613bc80f825795bba194000dd354e15aa05e881ef103e63ce4c905ac8_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-proxy-rhel8@sha256:26e82e33639172e754d954c2de492f7ec0bff4760c7284fe85231d74e83da3cc_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-proxy-rhel8@sha256:bda4a51803d41c805074962d4207f0c56a4248d50d09bcd01017d55ea974166f_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-rhel8-operator@sha256:2f7f3178fff00f6096e340392dfe2e005f7fa6553eae194cb765dd026432d010_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-rhel8-operator@sha256:48b2b1685ae38774ec04f860f11a246838f8925be0b5adc0ec60bbde57419fb1_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-rhel8-operator@sha256:c4029eab5cf3ef8e00f774a04b786003e31073c85a585f50689009110d2a5f76_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/eventrouter-rhel8@sha256:5bfaebca00db5b6ae5acb4a929be36f40704ac5a64806a13561c05b2409ed264_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/eventrouter-rhel8@sha256:a0a4983317c397185b3c3dfda4f3399cad0b53daebe68a553991558fed8657cd_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/eventrouter-rhel8@sha256:d5ae1f16eec322d9c9fb5604641cb038a831a0c7de331feb2999775e7958ed55_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/fluentd-rhel8@sha256:2ce16348308819fb21fa98c69ca56eb70b62cf36fb1c233d1928764b393dd3f0_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/fluentd-rhel8@sha256:a1f3ef5cafecc311f1c206ea40fda0f53badc8a520d30ad4461a25a2177cc393_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/fluentd-rhel8@sha256:ac04d56e69fa742413b95177b2298502b8f9108be6bceb96b8ea4f9afbed5f74_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/kibana6-rhel8@sha256:5ec68bc1aa764552cb1471a1844708747fced656c031b8c8428deecd3137eb3a_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/kibana6-rhel8@sha256:8da444779bc4d8fefb85fe2a373d4f4280db9c41198e321e74b6cab05aed6922_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/kibana6-rhel8@sha256:e29a5cc022aa302459cff0ba435c24164ea5578d4f1468ab6bdfea0011220406_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/log-file-metric-exporter-rhel8@sha256:59abfdea0e2fbafa7355967f3dc43700b82907aeaea520a10a87d4a77adc5963_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/log-file-metric-exporter-rhel8@sha256:c347e82a481d60f52e5fc9cfd0634dd69e82db309de5e1eedf12832461f2e399_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/log-file-metric-exporter-rhel8@sha256:c442371d189720167dd3de9deaab587dad8ab810977040da26f3457cfd6eb10e_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/logging-curator5-rhel8@sha256:3dbc18048c93b6281f14b3472ed538a20b12b7e6c0524d61afda291b5bf11541_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/logging-curator5-rhel8@sha256:640ff6c8d8c3c16ba43f87f4d323e93d7d8cdae1df44d7220c79083e8284ebd6_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/logging-curator5-rhel8@sha256:c93eef1216995a01b8a76d547798b4a327d8fd2be746c40cf4e3b6cc84cea56c_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2035951"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j-core: remote code execution via JDBC Appender",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Log4j 1.x is not impacted by this vulnerability. Therefore versions of log4j shipped with Red Hat Enterprise Linux are NOT affected by this flaw.\n\nFor Elasticsearch, as shipped in OpenShift Container Platform and OpenShift Logging, access to the log4j2.properties configuration is limited only to the cluster administrators and exploitation requires cluster logging changes, what reduced the impact of this vulnerability significantly [0].\n\n[0] https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476#update-jan-6-5",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch6-rhel8@sha256:42925c7c419dd52bf611e6860b3c989ba396f9e5f1d9a459f5db6b958f932552_ppc64le",
          "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch6-rhel8@sha256:be1dd8dfaf204fa739a202ac7ddfcf3ed4441c97d05fa914cbbff34d5467bd76_s390x",
          "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch6-rhel8@sha256:d78003468c5d530a8dddd9841ecd23921b6987187ef09a0b97eeda0e7e914c94_amd64"
        ],
        "known_not_affected": [
          "8Base-OSE-LOGGING-5.2:openshift-logging/cluster-logging-operator-bundle@sha256:f4834508c179ac8ec28747587ea9a5c581e66b8a43dbc484e0b471ec44c5e7a8_amd64",
          "8Base-OSE-LOGGING-5.2:openshift-logging/cluster-logging-rhel8-operator@sha256:34c1103c3d1fa2f4edc3629c5708ec29828627101eb57dd7256a91d247f30fde_ppc64le",
          "8Base-OSE-LOGGING-5.2:openshift-logging/cluster-logging-rhel8-operator@sha256:3fa8f9590e009139c5d3c7f104d3bfee279e6a4a648b9f76defad60fa0a32954_s390x",
          "8Base-OSE-LOGGING-5.2:openshift-logging/cluster-logging-rhel8-operator@sha256:ec5a23b5aabdf0103bfe6a19abbf5ff8911b8d0b48b72167517506b53cd32e71_amd64",
          "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-operator-bundle@sha256:e33d3f89fa14cef83be2bf1d15cf5bb1df57ffd9258902613a2a1309cbc11981_amd64",
          "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-proxy-rhel8@sha256:1738c1f613bc80f825795bba194000dd354e15aa05e881ef103e63ce4c905ac8_s390x",
          "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-proxy-rhel8@sha256:26e82e33639172e754d954c2de492f7ec0bff4760c7284fe85231d74e83da3cc_ppc64le",
          "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-proxy-rhel8@sha256:bda4a51803d41c805074962d4207f0c56a4248d50d09bcd01017d55ea974166f_amd64",
          "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-rhel8-operator@sha256:2f7f3178fff00f6096e340392dfe2e005f7fa6553eae194cb765dd026432d010_amd64",
          "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-rhel8-operator@sha256:48b2b1685ae38774ec04f860f11a246838f8925be0b5adc0ec60bbde57419fb1_ppc64le",
          "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-rhel8-operator@sha256:c4029eab5cf3ef8e00f774a04b786003e31073c85a585f50689009110d2a5f76_s390x",
          "8Base-OSE-LOGGING-5.2:openshift-logging/eventrouter-rhel8@sha256:5bfaebca00db5b6ae5acb4a929be36f40704ac5a64806a13561c05b2409ed264_ppc64le",
          "8Base-OSE-LOGGING-5.2:openshift-logging/eventrouter-rhel8@sha256:a0a4983317c397185b3c3dfda4f3399cad0b53daebe68a553991558fed8657cd_amd64",
          "8Base-OSE-LOGGING-5.2:openshift-logging/eventrouter-rhel8@sha256:d5ae1f16eec322d9c9fb5604641cb038a831a0c7de331feb2999775e7958ed55_s390x",
          "8Base-OSE-LOGGING-5.2:openshift-logging/fluentd-rhel8@sha256:2ce16348308819fb21fa98c69ca56eb70b62cf36fb1c233d1928764b393dd3f0_amd64",
          "8Base-OSE-LOGGING-5.2:openshift-logging/fluentd-rhel8@sha256:a1f3ef5cafecc311f1c206ea40fda0f53badc8a520d30ad4461a25a2177cc393_s390x",
          "8Base-OSE-LOGGING-5.2:openshift-logging/fluentd-rhel8@sha256:ac04d56e69fa742413b95177b2298502b8f9108be6bceb96b8ea4f9afbed5f74_ppc64le",
          "8Base-OSE-LOGGING-5.2:openshift-logging/kibana6-rhel8@sha256:5ec68bc1aa764552cb1471a1844708747fced656c031b8c8428deecd3137eb3a_s390x",
          "8Base-OSE-LOGGING-5.2:openshift-logging/kibana6-rhel8@sha256:8da444779bc4d8fefb85fe2a373d4f4280db9c41198e321e74b6cab05aed6922_amd64",
          "8Base-OSE-LOGGING-5.2:openshift-logging/kibana6-rhel8@sha256:e29a5cc022aa302459cff0ba435c24164ea5578d4f1468ab6bdfea0011220406_ppc64le",
          "8Base-OSE-LOGGING-5.2:openshift-logging/log-file-metric-exporter-rhel8@sha256:59abfdea0e2fbafa7355967f3dc43700b82907aeaea520a10a87d4a77adc5963_amd64",
          "8Base-OSE-LOGGING-5.2:openshift-logging/log-file-metric-exporter-rhel8@sha256:c347e82a481d60f52e5fc9cfd0634dd69e82db309de5e1eedf12832461f2e399_ppc64le",
          "8Base-OSE-LOGGING-5.2:openshift-logging/log-file-metric-exporter-rhel8@sha256:c442371d189720167dd3de9deaab587dad8ab810977040da26f3457cfd6eb10e_s390x",
          "8Base-OSE-LOGGING-5.2:openshift-logging/logging-curator5-rhel8@sha256:3dbc18048c93b6281f14b3472ed538a20b12b7e6c0524d61afda291b5bf11541_amd64",
          "8Base-OSE-LOGGING-5.2:openshift-logging/logging-curator5-rhel8@sha256:640ff6c8d8c3c16ba43f87f4d323e93d7d8cdae1df44d7220c79083e8284ebd6_s390x",
          "8Base-OSE-LOGGING-5.2:openshift-logging/logging-curator5-rhel8@sha256:c93eef1216995a01b8a76d547798b4a327d8fd2be746c40cf4e3b6cc84cea56c_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-44832"
        },
        {
          "category": "external",
          "summary": "RHBZ#2035951",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2035951"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44832",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-44832"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44832",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44832"
        },
        {
          "category": "external",
          "summary": "https://issues.apache.org/jira/browse/LOG4J2-3293",
          "url": "https://issues.apache.org/jira/browse/LOG4J2-3293"
        }
      ],
      "release_date": "2021-12-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-01-21T19:04:46+00:00",
          "details": "For OpenShift Container Platform 4.8 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nFor Red Hat OpenShift Logging 5.2, see the following instructions to apply this update:\n\nhttps://docs.openshift.com/container-platform/4.7/logging/cluster-logging-upgrading.html",
          "product_ids": [
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch6-rhel8@sha256:42925c7c419dd52bf611e6860b3c989ba396f9e5f1d9a459f5db6b958f932552_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch6-rhel8@sha256:be1dd8dfaf204fa739a202ac7ddfcf3ed4441c97d05fa914cbbff34d5467bd76_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch6-rhel8@sha256:d78003468c5d530a8dddd9841ecd23921b6987187ef09a0b97eeda0e7e914c94_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0230"
        },
        {
          "category": "workaround",
          "details": "As per upstream:\n- In prior releases confirm that if the JDBC Appender is being used it is not configured to use any protocol other than Java.\n- Note that only the log4j-core JAR file is impacted by this vulnerability. Applications using only the log4j-api JAR file without the log4j-core JAR file are not impacted by this vulnerability.",
          "product_ids": [
            "8Base-OSE-LOGGING-5.2:openshift-logging/cluster-logging-operator-bundle@sha256:f4834508c179ac8ec28747587ea9a5c581e66b8a43dbc484e0b471ec44c5e7a8_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/cluster-logging-rhel8-operator@sha256:34c1103c3d1fa2f4edc3629c5708ec29828627101eb57dd7256a91d247f30fde_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/cluster-logging-rhel8-operator@sha256:3fa8f9590e009139c5d3c7f104d3bfee279e6a4a648b9f76defad60fa0a32954_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/cluster-logging-rhel8-operator@sha256:ec5a23b5aabdf0103bfe6a19abbf5ff8911b8d0b48b72167517506b53cd32e71_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-operator-bundle@sha256:e33d3f89fa14cef83be2bf1d15cf5bb1df57ffd9258902613a2a1309cbc11981_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-proxy-rhel8@sha256:1738c1f613bc80f825795bba194000dd354e15aa05e881ef103e63ce4c905ac8_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-proxy-rhel8@sha256:26e82e33639172e754d954c2de492f7ec0bff4760c7284fe85231d74e83da3cc_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-proxy-rhel8@sha256:bda4a51803d41c805074962d4207f0c56a4248d50d09bcd01017d55ea974166f_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-rhel8-operator@sha256:2f7f3178fff00f6096e340392dfe2e005f7fa6553eae194cb765dd026432d010_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-rhel8-operator@sha256:48b2b1685ae38774ec04f860f11a246838f8925be0b5adc0ec60bbde57419fb1_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-rhel8-operator@sha256:c4029eab5cf3ef8e00f774a04b786003e31073c85a585f50689009110d2a5f76_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch6-rhel8@sha256:42925c7c419dd52bf611e6860b3c989ba396f9e5f1d9a459f5db6b958f932552_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch6-rhel8@sha256:be1dd8dfaf204fa739a202ac7ddfcf3ed4441c97d05fa914cbbff34d5467bd76_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch6-rhel8@sha256:d78003468c5d530a8dddd9841ecd23921b6987187ef09a0b97eeda0e7e914c94_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/eventrouter-rhel8@sha256:5bfaebca00db5b6ae5acb4a929be36f40704ac5a64806a13561c05b2409ed264_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/eventrouter-rhel8@sha256:a0a4983317c397185b3c3dfda4f3399cad0b53daebe68a553991558fed8657cd_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/eventrouter-rhel8@sha256:d5ae1f16eec322d9c9fb5604641cb038a831a0c7de331feb2999775e7958ed55_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/fluentd-rhel8@sha256:2ce16348308819fb21fa98c69ca56eb70b62cf36fb1c233d1928764b393dd3f0_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/fluentd-rhel8@sha256:a1f3ef5cafecc311f1c206ea40fda0f53badc8a520d30ad4461a25a2177cc393_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/fluentd-rhel8@sha256:ac04d56e69fa742413b95177b2298502b8f9108be6bceb96b8ea4f9afbed5f74_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/kibana6-rhel8@sha256:5ec68bc1aa764552cb1471a1844708747fced656c031b8c8428deecd3137eb3a_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/kibana6-rhel8@sha256:8da444779bc4d8fefb85fe2a373d4f4280db9c41198e321e74b6cab05aed6922_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/kibana6-rhel8@sha256:e29a5cc022aa302459cff0ba435c24164ea5578d4f1468ab6bdfea0011220406_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/log-file-metric-exporter-rhel8@sha256:59abfdea0e2fbafa7355967f3dc43700b82907aeaea520a10a87d4a77adc5963_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/log-file-metric-exporter-rhel8@sha256:c347e82a481d60f52e5fc9cfd0634dd69e82db309de5e1eedf12832461f2e399_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/log-file-metric-exporter-rhel8@sha256:c442371d189720167dd3de9deaab587dad8ab810977040da26f3457cfd6eb10e_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/logging-curator5-rhel8@sha256:3dbc18048c93b6281f14b3472ed538a20b12b7e6c0524d61afda291b5bf11541_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/logging-curator5-rhel8@sha256:640ff6c8d8c3c16ba43f87f4d323e93d7d8cdae1df44d7220c79083e8284ebd6_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/logging-curator5-rhel8@sha256:c93eef1216995a01b8a76d547798b4a327d8fd2be746c40cf4e3b6cc84cea56c_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-OSE-LOGGING-5.2:openshift-logging/cluster-logging-operator-bundle@sha256:f4834508c179ac8ec28747587ea9a5c581e66b8a43dbc484e0b471ec44c5e7a8_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/cluster-logging-rhel8-operator@sha256:34c1103c3d1fa2f4edc3629c5708ec29828627101eb57dd7256a91d247f30fde_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/cluster-logging-rhel8-operator@sha256:3fa8f9590e009139c5d3c7f104d3bfee279e6a4a648b9f76defad60fa0a32954_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/cluster-logging-rhel8-operator@sha256:ec5a23b5aabdf0103bfe6a19abbf5ff8911b8d0b48b72167517506b53cd32e71_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-operator-bundle@sha256:e33d3f89fa14cef83be2bf1d15cf5bb1df57ffd9258902613a2a1309cbc11981_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-proxy-rhel8@sha256:1738c1f613bc80f825795bba194000dd354e15aa05e881ef103e63ce4c905ac8_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-proxy-rhel8@sha256:26e82e33639172e754d954c2de492f7ec0bff4760c7284fe85231d74e83da3cc_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-proxy-rhel8@sha256:bda4a51803d41c805074962d4207f0c56a4248d50d09bcd01017d55ea974166f_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-rhel8-operator@sha256:2f7f3178fff00f6096e340392dfe2e005f7fa6553eae194cb765dd026432d010_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-rhel8-operator@sha256:48b2b1685ae38774ec04f860f11a246838f8925be0b5adc0ec60bbde57419fb1_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch-rhel8-operator@sha256:c4029eab5cf3ef8e00f774a04b786003e31073c85a585f50689009110d2a5f76_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch6-rhel8@sha256:42925c7c419dd52bf611e6860b3c989ba396f9e5f1d9a459f5db6b958f932552_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch6-rhel8@sha256:be1dd8dfaf204fa739a202ac7ddfcf3ed4441c97d05fa914cbbff34d5467bd76_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/elasticsearch6-rhel8@sha256:d78003468c5d530a8dddd9841ecd23921b6987187ef09a0b97eeda0e7e914c94_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/eventrouter-rhel8@sha256:5bfaebca00db5b6ae5acb4a929be36f40704ac5a64806a13561c05b2409ed264_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/eventrouter-rhel8@sha256:a0a4983317c397185b3c3dfda4f3399cad0b53daebe68a553991558fed8657cd_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/eventrouter-rhel8@sha256:d5ae1f16eec322d9c9fb5604641cb038a831a0c7de331feb2999775e7958ed55_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/fluentd-rhel8@sha256:2ce16348308819fb21fa98c69ca56eb70b62cf36fb1c233d1928764b393dd3f0_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/fluentd-rhel8@sha256:a1f3ef5cafecc311f1c206ea40fda0f53badc8a520d30ad4461a25a2177cc393_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/fluentd-rhel8@sha256:ac04d56e69fa742413b95177b2298502b8f9108be6bceb96b8ea4f9afbed5f74_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/kibana6-rhel8@sha256:5ec68bc1aa764552cb1471a1844708747fced656c031b8c8428deecd3137eb3a_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/kibana6-rhel8@sha256:8da444779bc4d8fefb85fe2a373d4f4280db9c41198e321e74b6cab05aed6922_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/kibana6-rhel8@sha256:e29a5cc022aa302459cff0ba435c24164ea5578d4f1468ab6bdfea0011220406_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/log-file-metric-exporter-rhel8@sha256:59abfdea0e2fbafa7355967f3dc43700b82907aeaea520a10a87d4a77adc5963_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/log-file-metric-exporter-rhel8@sha256:c347e82a481d60f52e5fc9cfd0634dd69e82db309de5e1eedf12832461f2e399_ppc64le",
            "8Base-OSE-LOGGING-5.2:openshift-logging/log-file-metric-exporter-rhel8@sha256:c442371d189720167dd3de9deaab587dad8ab810977040da26f3457cfd6eb10e_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/logging-curator5-rhel8@sha256:3dbc18048c93b6281f14b3472ed538a20b12b7e6c0524d61afda291b5bf11541_amd64",
            "8Base-OSE-LOGGING-5.2:openshift-logging/logging-curator5-rhel8@sha256:640ff6c8d8c3c16ba43f87f4d323e93d7d8cdae1df44d7220c79083e8284ebd6_s390x",
            "8Base-OSE-LOGGING-5.2:openshift-logging/logging-curator5-rhel8@sha256:c93eef1216995a01b8a76d547798b4a327d8fd2be746c40cf4e3b6cc84cea56c_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "log4j-core: remote code execution via JDBC Appender"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat OpenShift Container Platform release 3.11.570 is now available with\nupdates to packages and images that fix several bugs and add enhancements.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nSecurity Fix(es):\n\n* log4j-core: remote code execution via JDBC Appender (CVE-2021-44832)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2022:0236",
        "url": "https://access.redhat.com/errata/RHSA-2022:0236"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2035951",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2035951"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0236.json"
      }
    ],
    "title": "Red Hat Security Advisory: OpenShift Container Platform 3.11.570 security update",
    "tracking": {
      "current_release_date": "2026-05-29T20:04:08+00:00",
      "generator": {
        "date": "2026-05-29T20:04:08+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.1"
        }
      },
      "id": "RHSA-2022:0236",
      "initial_release_date": "2022-01-25T15:25:30+00:00",
      "revision_history": [
        {
          "date": "2022-01-25T15:25:30+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2022-01-25T15:25:30+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-29T20:04:08+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Container Platform 3.11",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 3.11",
                  "product_id": "7Server-RH7-RHOSE-3.11",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:3.11::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Enterprise"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift3/ose-logging-curator5@sha256:615464e77119620f0e248dc8702c790fc12e004393fcef65731b7ab0c8fe51ea_amd64",
                "product": {
                  "name": "openshift3/ose-logging-curator5@sha256:615464e77119620f0e248dc8702c790fc12e004393fcef65731b7ab0c8fe51ea_amd64",
                  "product_id": "openshift3/ose-logging-curator5@sha256:615464e77119620f0e248dc8702c790fc12e004393fcef65731b7ab0c8fe51ea_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/ose-logging-curator5@sha256:615464e77119620f0e248dc8702c790fc12e004393fcef65731b7ab0c8fe51ea?arch=amd64\u0026repository_url=registry.redhat.io/openshift3/ose-logging-curator5\u0026tag=v3.11.570-2.ge84e80c"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift3/ose-logging-elasticsearch5@sha256:730f0aea1c470224fbe8a4c3e2ad0600bb213f39b79aa5b473146bae50a28b4f_amd64",
                "product": {
                  "name": "openshift3/ose-logging-elasticsearch5@sha256:730f0aea1c470224fbe8a4c3e2ad0600bb213f39b79aa5b473146bae50a28b4f_amd64",
                  "product_id": "openshift3/ose-logging-elasticsearch5@sha256:730f0aea1c470224fbe8a4c3e2ad0600bb213f39b79aa5b473146bae50a28b4f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/ose-logging-elasticsearch5@sha256:730f0aea1c470224fbe8a4c3e2ad0600bb213f39b79aa5b473146bae50a28b4f?arch=amd64\u0026repository_url=registry.redhat.io/openshift3/ose-logging-elasticsearch5\u0026tag=v3.11.570-2.ge84e80c"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift3/ose-logging-eventrouter@sha256:cc44602e7ec89f3c145288c4e65f0d3d418454fcf4147aa7a1deafeda9329209_amd64",
                "product": {
                  "name": "openshift3/ose-logging-eventrouter@sha256:cc44602e7ec89f3c145288c4e65f0d3d418454fcf4147aa7a1deafeda9329209_amd64",
                  "product_id": "openshift3/ose-logging-eventrouter@sha256:cc44602e7ec89f3c145288c4e65f0d3d418454fcf4147aa7a1deafeda9329209_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/ose-logging-eventrouter@sha256:cc44602e7ec89f3c145288c4e65f0d3d418454fcf4147aa7a1deafeda9329209?arch=amd64\u0026repository_url=registry.redhat.io/openshift3/ose-logging-eventrouter\u0026tag=v3.11.570-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift3/ose-logging-fluentd@sha256:d8de79c838c86c85fba55880ff3b59cfb8c6f89b0e092d65e13833d10a949012_amd64",
                "product": {
                  "name": "openshift3/ose-logging-fluentd@sha256:d8de79c838c86c85fba55880ff3b59cfb8c6f89b0e092d65e13833d10a949012_amd64",
                  "product_id": "openshift3/ose-logging-fluentd@sha256:d8de79c838c86c85fba55880ff3b59cfb8c6f89b0e092d65e13833d10a949012_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/ose-logging-fluentd@sha256:d8de79c838c86c85fba55880ff3b59cfb8c6f89b0e092d65e13833d10a949012?arch=amd64\u0026repository_url=registry.redhat.io/openshift3/ose-logging-fluentd\u0026tag=v3.11.570-2.ge84e80c"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift3/logging-fluentd@sha256:d8de79c838c86c85fba55880ff3b59cfb8c6f89b0e092d65e13833d10a949012_amd64",
                "product": {
                  "name": "openshift3/logging-fluentd@sha256:d8de79c838c86c85fba55880ff3b59cfb8c6f89b0e092d65e13833d10a949012_amd64",
                  "product_id": "openshift3/logging-fluentd@sha256:d8de79c838c86c85fba55880ff3b59cfb8c6f89b0e092d65e13833d10a949012_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/logging-fluentd@sha256:d8de79c838c86c85fba55880ff3b59cfb8c6f89b0e092d65e13833d10a949012?arch=amd64\u0026repository_url=registry.redhat.io/openshift3/logging-fluentd\u0026tag=v3.11.570-2.ge84e80c"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift3/ose-logging-kibana5@sha256:531d1444a26b4c38316fd7e46e7d619a519e7a2d1b0a78567949160eb0196860_amd64",
                "product": {
                  "name": "openshift3/ose-logging-kibana5@sha256:531d1444a26b4c38316fd7e46e7d619a519e7a2d1b0a78567949160eb0196860_amd64",
                  "product_id": "openshift3/ose-logging-kibana5@sha256:531d1444a26b4c38316fd7e46e7d619a519e7a2d1b0a78567949160eb0196860_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/ose-logging-kibana5@sha256:531d1444a26b4c38316fd7e46e7d619a519e7a2d1b0a78567949160eb0196860?arch=amd64\u0026repository_url=registry.redhat.io/openshift3/ose-logging-kibana5\u0026tag=v3.11.570-2.ge84e80c"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift3/logging-fluentd@sha256:d8de79c838c86c85fba55880ff3b59cfb8c6f89b0e092d65e13833d10a949012_amd64 as a component of Red Hat OpenShift Container Platform 3.11",
          "product_id": "7Server-RH7-RHOSE-3.11:openshift3/logging-fluentd@sha256:d8de79c838c86c85fba55880ff3b59cfb8c6f89b0e092d65e13833d10a949012_amd64"
        },
        "product_reference": "openshift3/logging-fluentd@sha256:d8de79c838c86c85fba55880ff3b59cfb8c6f89b0e092d65e13833d10a949012_amd64",
        "relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift3/ose-logging-curator5@sha256:615464e77119620f0e248dc8702c790fc12e004393fcef65731b7ab0c8fe51ea_amd64 as a component of Red Hat OpenShift Container Platform 3.11",
          "product_id": "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-curator5@sha256:615464e77119620f0e248dc8702c790fc12e004393fcef65731b7ab0c8fe51ea_amd64"
        },
        "product_reference": "openshift3/ose-logging-curator5@sha256:615464e77119620f0e248dc8702c790fc12e004393fcef65731b7ab0c8fe51ea_amd64",
        "relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift3/ose-logging-elasticsearch5@sha256:730f0aea1c470224fbe8a4c3e2ad0600bb213f39b79aa5b473146bae50a28b4f_amd64 as a component of Red Hat OpenShift Container Platform 3.11",
          "product_id": "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:730f0aea1c470224fbe8a4c3e2ad0600bb213f39b79aa5b473146bae50a28b4f_amd64"
        },
        "product_reference": "openshift3/ose-logging-elasticsearch5@sha256:730f0aea1c470224fbe8a4c3e2ad0600bb213f39b79aa5b473146bae50a28b4f_amd64",
        "relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift3/ose-logging-eventrouter@sha256:cc44602e7ec89f3c145288c4e65f0d3d418454fcf4147aa7a1deafeda9329209_amd64 as a component of Red Hat OpenShift Container Platform 3.11",
          "product_id": "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-eventrouter@sha256:cc44602e7ec89f3c145288c4e65f0d3d418454fcf4147aa7a1deafeda9329209_amd64"
        },
        "product_reference": "openshift3/ose-logging-eventrouter@sha256:cc44602e7ec89f3c145288c4e65f0d3d418454fcf4147aa7a1deafeda9329209_amd64",
        "relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift3/ose-logging-fluentd@sha256:d8de79c838c86c85fba55880ff3b59cfb8c6f89b0e092d65e13833d10a949012_amd64 as a component of Red Hat OpenShift Container Platform 3.11",
          "product_id": "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-fluentd@sha256:d8de79c838c86c85fba55880ff3b59cfb8c6f89b0e092d65e13833d10a949012_amd64"
        },
        "product_reference": "openshift3/ose-logging-fluentd@sha256:d8de79c838c86c85fba55880ff3b59cfb8c6f89b0e092d65e13833d10a949012_amd64",
        "relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift3/ose-logging-kibana5@sha256:531d1444a26b4c38316fd7e46e7d619a519e7a2d1b0a78567949160eb0196860_amd64 as a component of Red Hat OpenShift Container Platform 3.11",
          "product_id": "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-kibana5@sha256:531d1444a26b4c38316fd7e46e7d619a519e7a2d1b0a78567949160eb0196860_amd64"
        },
        "product_reference": "openshift3/ose-logging-kibana5@sha256:531d1444a26b4c38316fd7e46e7d619a519e7a2d1b0a78567949160eb0196860_amd64",
        "relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-44832",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2021-12-28T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:openshift3/logging-fluentd@sha256:d8de79c838c86c85fba55880ff3b59cfb8c6f89b0e092d65e13833d10a949012_amd64",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-curator5@sha256:615464e77119620f0e248dc8702c790fc12e004393fcef65731b7ab0c8fe51ea_amd64",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-eventrouter@sha256:cc44602e7ec89f3c145288c4e65f0d3d418454fcf4147aa7a1deafeda9329209_amd64",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-fluentd@sha256:d8de79c838c86c85fba55880ff3b59cfb8c6f89b0e092d65e13833d10a949012_amd64",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-kibana5@sha256:531d1444a26b4c38316fd7e46e7d619a519e7a2d1b0a78567949160eb0196860_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2035951"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j-core: remote code execution via JDBC Appender",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Log4j 1.x is not impacted by this vulnerability. Therefore versions of log4j shipped with Red Hat Enterprise Linux are NOT affected by this flaw.\n\nFor Elasticsearch, as shipped in OpenShift Container Platform and OpenShift Logging, access to the log4j2.properties configuration is limited only to the cluster administrators and exploitation requires cluster logging changes, what reduced the impact of this vulnerability significantly [0].\n\n[0] https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476#update-jan-6-5",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:730f0aea1c470224fbe8a4c3e2ad0600bb213f39b79aa5b473146bae50a28b4f_amd64"
        ],
        "known_not_affected": [
          "7Server-RH7-RHOSE-3.11:openshift3/logging-fluentd@sha256:d8de79c838c86c85fba55880ff3b59cfb8c6f89b0e092d65e13833d10a949012_amd64",
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-curator5@sha256:615464e77119620f0e248dc8702c790fc12e004393fcef65731b7ab0c8fe51ea_amd64",
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-eventrouter@sha256:cc44602e7ec89f3c145288c4e65f0d3d418454fcf4147aa7a1deafeda9329209_amd64",
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-fluentd@sha256:d8de79c838c86c85fba55880ff3b59cfb8c6f89b0e092d65e13833d10a949012_amd64",
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-kibana5@sha256:531d1444a26b4c38316fd7e46e7d619a519e7a2d1b0a78567949160eb0196860_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-44832"
        },
        {
          "category": "external",
          "summary": "RHBZ#2035951",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2035951"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44832",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-44832"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44832",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44832"
        },
        {
          "category": "external",
          "summary": "https://issues.apache.org/jira/browse/LOG4J2-3293",
          "url": "https://issues.apache.org/jira/browse/LOG4J2-3293"
        }
      ],
      "release_date": "2021-12-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-01-25T15:25:30+00:00",
          "details": "For OpenShift Container Platform 3.11 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/3.11/upgrading/index.html",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:730f0aea1c470224fbe8a4c3e2ad0600bb213f39b79aa5b473146bae50a28b4f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0236"
        },
        {
          "category": "workaround",
          "details": "As per upstream:\n- In prior releases confirm that if the JDBC Appender is being used it is not configured to use any protocol other than Java.\n- Note that only the log4j-core JAR file is impacted by this vulnerability. Applications using only the log4j-api JAR file without the log4j-core JAR file are not impacted by this vulnerability.",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:openshift3/logging-fluentd@sha256:d8de79c838c86c85fba55880ff3b59cfb8c6f89b0e092d65e13833d10a949012_amd64",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-curator5@sha256:615464e77119620f0e248dc8702c790fc12e004393fcef65731b7ab0c8fe51ea_amd64",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:730f0aea1c470224fbe8a4c3e2ad0600bb213f39b79aa5b473146bae50a28b4f_amd64",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-eventrouter@sha256:cc44602e7ec89f3c145288c4e65f0d3d418454fcf4147aa7a1deafeda9329209_amd64",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-fluentd@sha256:d8de79c838c86c85fba55880ff3b59cfb8c6f89b0e092d65e13833d10a949012_amd64",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-kibana5@sha256:531d1444a26b4c38316fd7e46e7d619a519e7a2d1b0a78567949160eb0196860_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-RH7-RHOSE-3.11:openshift3/logging-fluentd@sha256:d8de79c838c86c85fba55880ff3b59cfb8c6f89b0e092d65e13833d10a949012_amd64",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-curator5@sha256:615464e77119620f0e248dc8702c790fc12e004393fcef65731b7ab0c8fe51ea_amd64",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:730f0aea1c470224fbe8a4c3e2ad0600bb213f39b79aa5b473146bae50a28b4f_amd64",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-eventrouter@sha256:cc44602e7ec89f3c145288c4e65f0d3d418454fcf4147aa7a1deafeda9329209_amd64",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-fluentd@sha256:d8de79c838c86c85fba55880ff3b59cfb8c6f89b0e092d65e13833d10a949012_amd64",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-kibana5@sha256:531d1444a26b4c38316fd7e46e7d619a519e7a2d1b0a78567949160eb0196860_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "log4j-core: remote code execution via JDBC Appender"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat AMQ Streams 1.6.7 is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat AMQ Streams, based on the Apache Kafka project, offers a distributed backbone that allows microservices and other applications to share data with extremely high throughput and extremely low latency. \n\nThis release of Red Hat AMQ Streams 1.6.7 serves as a replacement for Red Hat AMQ Streams 1.6.6, and includes security and bug fixes, and enhancements. For further information, refer to the release notes linked to in the References section.\n\nSecurity Fix(es):\n\n* log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender (CVE-2022-23305)\n\n* log4j: Unsafe deserialization flaw in Chainsaw log viewer (CVE-2022-23307)\n\n* kubernetes-client: Insecure deserialization in unmarshalYaml method (CVE-2021-4178)\n\n* log4j-core: remote code execution via JDBC Appender (CVE-2021-44832)\n\n* log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink (CVE-2022-23302)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2022:0467",
        "url": "https://access.redhat.com/errata/RHSA-2022:0467"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=jboss.amq.streams\u0026version=1.6.7",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=jboss.amq.streams\u0026version=1.6.7"
      },
      {
        "category": "external",
        "summary": "2034388",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2034388"
      },
      {
        "category": "external",
        "summary": "2035951",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2035951"
      },
      {
        "category": "external",
        "summary": "2041949",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2041949"
      },
      {
        "category": "external",
        "summary": "2041959",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2041959"
      },
      {
        "category": "external",
        "summary": "2041967",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2041967"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0467.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat AMQ Streams 1.6.7 release and security update",
    "tracking": {
      "current_release_date": "2026-05-29T20:04:09+00:00",
      "generator": {
        "date": "2026-05-29T20:04:09+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.1"
        }
      },
      "id": "RHSA-2022:0467",
      "initial_release_date": "2022-02-08T12:52:13+00:00",
      "revision_history": [
        {
          "date": "2022-02-08T12:52:13+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2022-02-08T12:52:13+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-29T20:04:09+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat AMQ Streams 1.6.7",
                "product": {
                  "name": "Red Hat AMQ Streams 1.6.7",
                  "product_id": "Red Hat AMQ Streams 1.6.7",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:amq_streams:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss AMQ"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Jordy Versmissen"
          ]
        }
      ],
      "cve": "CVE-2021-4178",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2021-12-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2034388"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kubernetes-client: Insecure deserialization in unmarshalYaml method",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat CodeReady Studio 12 is not affected by this flaw because it does not ship a vulnerable version of kubernetes-client; the version that it ships does not use SnakeYAML.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AMQ Streams 1.6.7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-4178"
        },
        {
          "category": "external",
          "summary": "RHBZ#2034388",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2034388"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-4178",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-4178"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-4178",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4178"
        }
      ],
      "release_date": "2022-01-05T15:05:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-08T12:52:13+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat AMQ Streams 1.6.7"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0467"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AMQ Streams 1.6.7"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "kubernetes-client: Insecure deserialization in unmarshalYaml method"
    },
    {
      "cve": "CVE-2021-44832",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2021-12-28T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2035951"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j-core: remote code execution via JDBC Appender",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Log4j 1.x is not impacted by this vulnerability. Therefore versions of log4j shipped with Red Hat Enterprise Linux are NOT affected by this flaw.\n\nFor Elasticsearch, as shipped in OpenShift Container Platform and OpenShift Logging, access to the log4j2.properties configuration is limited only to the cluster administrators and exploitation requires cluster logging changes, what reduced the impact of this vulnerability significantly [0].\n\n[0] https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476#update-jan-6-5",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AMQ Streams 1.6.7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-44832"
        },
        {
          "category": "external",
          "summary": "RHBZ#2035951",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2035951"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44832",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-44832"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44832",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44832"
        },
        {
          "category": "external",
          "summary": "https://issues.apache.org/jira/browse/LOG4J2-3293",
          "url": "https://issues.apache.org/jira/browse/LOG4J2-3293"
        }
      ],
      "release_date": "2021-12-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-08T12:52:13+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat AMQ Streams 1.6.7"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0467"
        },
        {
          "category": "workaround",
          "details": "As per upstream:\n- In prior releases confirm that if the JDBC Appender is being used it is not configured to use any protocol other than Java.\n- Note that only the log4j-core JAR file is impacted by this vulnerability. Applications using only the log4j-api JAR file without the log4j-core JAR file are not impacted by this vulnerability.",
          "product_ids": [
            "Red Hat AMQ Streams 1.6.7"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AMQ Streams 1.6.7"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "log4j-core: remote code execution via JDBC Appender"
    },
    {
      "cve": "CVE-2022-23302",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2022-01-18T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2041949"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Java logging library Apache Log4j in version 1.x. JMSSink in Log4j 1.x is vulnerable to deserialization of untrusted data. This allows a remote attacker to execute code on the server if JMSSink is deployed and has been configured to perform JNDI requests.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Note this flaw ONLY affects applications which are specifically configured to use JMSSink, which is not the default, or when the attacker has write access to the Log4j configuration for adding JMSSink to the attacker\u0027s JNDI LDAP endpoint.\n\nRed Hat Satellite bundles log4j-over-slf4j with Candlepin, however, product is not affected as it uses logback framework for logging.\n\nRed Hat Virtualization and OpenShift Container Platform in the OCP Metering stack (the Hive/Presto/Hadoop components) ship a vulnerable version of the log4j package, however JMSSink is not used. Therefore the impact of this vulnerability for these products is rated Low.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AMQ Streams 1.6.7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-23302"
        },
        {
          "category": "external",
          "summary": "RHBZ#2041949",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2041949"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-23302",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-23302"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-23302",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23302"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2022/01/18/3",
          "url": "https://www.openwall.com/lists/oss-security/2022/01/18/3"
        }
      ],
      "release_date": "2022-01-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-08T12:52:13+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat AMQ Streams 1.6.7"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0467"
        },
        {
          "category": "workaround",
          "details": "These are the possible mitigations for this flaw for releases version 1.x:\n\n- Comment out or remove JMSSink in the Log4j configuration if it is used\n- Remove the JMSSink class from the server\u0027s jar files. For example:\n```\nzip -q -d log4j-*.jar org/apache/log4j/net/JMSSink.class\n```\n- Restrict access for the OS user on the platform running the application to prevent modifying the Log4j configuration by the attacker.",
          "product_ids": [
            "Red Hat AMQ Streams 1.6.7"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AMQ Streams 1.6.7"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink"
    },
    {
      "cve": "CVE-2022-23305",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "discovery_date": "2022-01-18T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2041959"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Java logging library Apache Log4j in version 1.x. JDBCAppender in Log4j 1.x is vulnerable to SQL injection in untrusted data. This allows a remote attacker to run SQL statements in the database if the deployed application is configured to use JDBCAppender with certain interpolation tokens.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default.\n\nRed Hat Satellite bundles log4j-over-slf4j with Candlepin, however, product is not affected as it uses logback framework for logging.\n\nRed Hat Virtualization and OpenShift Container Platform in the OCP Metering stack (the Hive/Presto/Hadoop components) ship a vulnerable version of the log4j package, however JDBCAppender is not used. Therefore the impact of this vulnerability for these products is rated Low.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AMQ Streams 1.6.7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-23305"
        },
        {
          "category": "external",
          "summary": "RHBZ#2041959",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2041959"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-23305",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-23305"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-23305",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23305"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2022/01/18/4",
          "url": "https://www.openwall.com/lists/oss-security/2022/01/18/4"
        }
      ],
      "release_date": "2022-01-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-08T12:52:13+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat AMQ Streams 1.6.7"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0467"
        },
        {
          "category": "workaround",
          "details": "These are the possible mitigations for this flaw for releases version 1.x:\n\n- Comment out or remove JDBCAppender in the Log4j configuration if it is used\n- Remove the JDBCAppender class from the server\u0027s jar files. For example:\n```\nzip -q -d log4j-*.jar org/apache/log4j/jdbc/JDBCAppender.class\n```",
          "product_ids": [
            "Red Hat AMQ Streams 1.6.7"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AMQ Streams 1.6.7"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender"
    },
    {
      "cve": "CVE-2022-23307",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2022-01-18T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2041967"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the log4j 1.x chainsaw component, where the contents of certain log entries are deserialized and possibly permit code execution. This flaw allows an attacker to send a malicious request with serialized data to the server to be deserialized when the chainsaw component is run.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "log4j: Unsafe deserialization flaw in Chainsaw log viewer",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Chainsaw is a standalone graphical user interface for viewing log entries in log4j. This flaw may be bypassed by using other available means to access log entries.\n\nRed Hat Satellite bundles log4j-over-slf4j with Candlepin, however, product is not affected as it uses logback framework for logging.\n\nRed Hat Virtualization ships a vulnerable version of the log4j package, however chainsaw is not part of typical use cases. An attacker looking to exploit this would need to not only be able to generate a malicious log entry, but also have the necessary access and permissions to start chainsaw on the engine node. Therefore the impact of this vulnerability for Red Hat Virtualization is rated Low.\n\nSimilar to Red Hat Virtualization in OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack, ship the vulnerable version of log4j package, however vulnerable chainsaw component is not used by default. Therefore the impact to OCP is reduced to Low.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AMQ Streams 1.6.7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-23307"
        },
        {
          "category": "external",
          "summary": "RHBZ#2041967",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2041967"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-23307",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-23307"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-23307",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23307"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2022/01/18/5",
          "url": "https://www.openwall.com/lists/oss-security/2022/01/18/5"
        }
      ],
      "release_date": "2022-01-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-08T12:52:13+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat AMQ Streams 1.6.7"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0467"
        },
        {
          "category": "workaround",
          "details": "These are the mitigations available for this flaw for log4j 1.x:\n- Avoid using Chainsaw to view logs, and instead use some other utility, especially if there is a log view available within the product itself.\n- Remove the Chainsaw classes from the log4j jar files. For example:\n```\nzip -q -d log4j-*.jar org/apache/log4j/chainsaw/*\n```\n(log4j jars may be nested in zip archives within product)",
          "product_ids": [
            "Red Hat AMQ Streams 1.6.7"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AMQ Streams 1.6.7"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "log4j: Unsafe deserialization flaw in Chainsaw log viewer"
    }
  ]
}