{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_vex", "csaf_version": "2.0", "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "title": "Bzip2Decoder doesn't allow setting size restrictions for decompressed data", "tracking": { "current_release_date": "2026-08-11T14:59:24+00:00", "generator": { "date": "2026-08-11T14:59:24+00:00", "engine": { "name": "CSAF Generator", "version": "3.3.0" } }, "id": "CVE-2021-37136", "initial_release_date": "2021-09-09T00:00:00+00:00", "revision_history": [ { "date": "2026-08-11T14:59:24+00:00", "number": "1", "summary": "Last generated version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "category": "vendor", "name": "Red Hat", "branches": [ { "category": "product_name", "name": "OpenShift Container Platform 4.19", "product": { "name": "OpenShift Container Platform 4.19", "product_id": "openshift-4", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4" } } }, { "category": "product_name", "name": "OpenShift Container Platform 4.12", "product": { "name": "OpenShift Container Platform 4.12", "product_id": "openshift-4.12.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.12" } } }, { "category": "product_name", "name": "OpenShift Container Platform 4.13", "product": { "name": "OpenShift Container Platform 4.13", "product_id": "openshift-4.13.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.13" } } }, { "category": "product_name", "name": "OpenShift Container Platform 4.14", "product": { "name": "OpenShift Container Platform 4.14", "product_id": "openshift-4.14.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.14" } } }, { "category": "product_name", "name": "OpenShift Container Platform 4.15.z", "product": { "name": "OpenShift Container Platform 4.15.z", "product_id": "openshift-4.15.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.15" } } }, { "category": "product_name", "name": "OpenShift Container Platform 4.16.z", "product": { "name": "OpenShift Container Platform 4.16.z", "product_id": "openshift-4.16.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.16" } } }, { "category": "product_name", "name": "OpenShift Container Platform 4.17", "product": { "name": "OpenShift Container Platform 4.17", "product_id": "openshift-4.17", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.17" } } }, { "category": "product_name", "name": "OpenShift Container Platform 4.18", "product": { "name": "OpenShift Container Platform 4.18", "product_id": "openshift-4.18", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.18" } } }, { "category": "product_name", "name": "OpenShift Container Platform 4.19", "product": { "name": "OpenShift Container Platform 4.19", "product_id": "openshift-4.19", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.19" } } }, { "category": "product_name", "name": "OpenShift Container Platform 4.20", "product": { "name": "OpenShift Container Platform 4.20", "product_id": "openshift-4.20", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.20" } } }, { "category": "product_name", "name": "OpenShift Container Platform 5.1", "product": { "name": "OpenShift Container Platform 5.1", "product_id": "openshift-5.1::el8", "product_identification_helper": { "cpe": "cpe:/a:redhat:logging:5.1::el8" } } }, { "category": "product_name", "name": "OpenShift Container Platform 3.11.0", "product": { "name": "OpenShift Container Platform 3.11.0", "product_id": "openshift-enterprise-3.11", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:3" } } }, { "category": "product_name", "name": "OpenShift Container Platform Logging 5.9.z", "product": { "name": "OpenShift Container Platform Logging 5.9.z", "product_id": "openshift-logging-5", "product_identification_helper": { "cpe": "cpe:/a:redhat:logging:5" } } }, { "category": "product_name", "name": "OpenShift Container Platform Logging 5.1.z", "product": { "name": "OpenShift Container Platform Logging 5.1.z", "product_id": "openshift-logging-5.1::el8", "product_identification_helper": { "cpe": "cpe:/a:redhat:logging:5.1::el8" } } }, { "category": "product_name", "name": "OpenShift Container Platform Logging 5.2.z", "product": { "name": "OpenShift Container Platform Logging 5.2.z", "product_id": "openshift-logging-5.2::el8", "product_identification_helper": { "cpe": "cpe:/a:redhat:logging:5.2::el8" } } }, { "category": "product_name", "name": "OpenShift Container Platform Logging 5.3.z", "product": { "name": "OpenShift Container Platform Logging 5.3.z", "product_id": "openshift-logging-5.3::el8", "product_identification_helper": { "cpe": "cpe:/a:redhat:logging:5.3::el8" } } }, { "category": "product_name", "name": "Red Hat OpenStack Platform 10.0 (Newton)", "product": { "name": "Red Hat OpenStack Platform 10.0 (Newton)", "product_id": "openstack-10", "product_identification_helper": { "cpe": "cpe:/a:redhat:openstack:10" } } }, { "category": "product_name", "name": "Red Hat OpenStack Platform rhos-13.0.z", "product": { "name": "Red Hat OpenStack Platform rhos-13.0.z", "product_id": "openstack-13", "product_identification_helper": { "cpe": "cpe:/a:redhat:openstack:13" } } }, { "category": "product_name", "name": "Red Hat Satellite", "product": { "name": "Red Hat Satellite", "product_id": "rhn_satellite_6-default", "product_identification_helper": { "cpe": "cpe:/a:redhat:satellite:6" } } }, { "category": "product_name", "name": "Red Hat Satellite 6.12.0", "product": { "name": "Red Hat Satellite 6.12.0", "product_id": "rhn_satellite_6.12::el8", "product_identification_helper": { "cpe": "cpe:/a:redhat:satellite:6.12::el8" } } }, { "category": "product_version", "name": "candlepin", "product": { "name": "candlepin", "product_id": "candlepin", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin" } } }, { "category": "product_version", "name": "candlepin", "product": { "name": "candlepin", "product_id": "candlepin-0:4.1.15-1.el8sat", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin@4.1.15-1.el8sat?epoch=0" } } }, { "category": "product_version", "name": "candlepin", "product": { "name": "candlepin", "product_id": "candlepin-0:4.1.15-1.el8sat.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin@4.1.15-1.el8sat?arch=src&epoch=0" } } }, { "category": "product_version", "name": "candlepin-selinux", "product": { "name": "candlepin-selinux", "product_id": "candlepin-selinux", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin-selinux" } } }, { "category": "product_version", "name": "candlepin-selinux", "product": { "name": "candlepin-selinux", "product_id": "candlepin-selinux-0:4.1.15-1.el8sat", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin-selinux@4.1.15-1.el8sat?epoch=0" } } }, { "category": "product_version", "name": "candlepin-tomcat", "product": { "name": "candlepin-tomcat", "product_id": "candlepin-tomcat", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin-tomcat" } } }, { "category": "product_version", "name": "candlepin-tomcat6", "product": { "name": "candlepin-tomcat6", "product_id": "candlepin-tomcat6", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin-tomcat6" } } }, { "category": "product_version", "name": "candlepin", "product": { "name": "candlepin", "product_id": "candlepin.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin?arch=src" } } }, { "category": "product_version", "name": "logging-elasticsearch6-container-v6.8.1", "product": { "name": "logging-elasticsearch6-container-v6.8.1", "product_id": "logging-elasticsearch6-container-v6.8.1-0:157", "product_identification_helper": { "purl": "pkg:rpm/redhat/logging-elasticsearch6-container-v6.8.1@157?epoch=0" } } }, { "category": "product_version", "name": "logging-elasticsearch6-container-v6.8.1", "product": { "name": "logging-elasticsearch6-container-v6.8.1", "product_id": "logging-elasticsearch6-container-v6.8.1-0:159", "product_identification_helper": { "purl": "pkg:rpm/redhat/logging-elasticsearch6-container-v6.8.1@159?epoch=0" } } }, { "category": "product_version", "name": "logging-elasticsearch6-container-v6.8.1", "product": { "name": "logging-elasticsearch6-container-v6.8.1", "product_id": "logging-elasticsearch6-container-v6.8.1-0:65", "product_identification_helper": { "purl": "pkg:rpm/redhat/logging-elasticsearch6-container-v6.8.1@65?epoch=0" } } }, { "category": "product_version", "name": "logging-elasticsearch6-container-v6.8.1", "product": { "name": "logging-elasticsearch6-container-v6.8.1", "product_id": "logging-elasticsearch6-container-v6.8.1-0:66", "product_identification_helper": { "purl": "pkg:rpm/redhat/logging-elasticsearch6-container-v6.8.1@66?epoch=0" } } }, { "category": "product_version", "name": "logging-elasticsearch6-container-v6.8.1", "product": { "name": "logging-elasticsearch6-container-v6.8.1", "product_id": "logging-elasticsearch6-container-v6.8.1-0:67", "product_identification_helper": { "purl": "pkg:rpm/redhat/logging-elasticsearch6-container-v6.8.1@67?epoch=0" } } }, { "category": "product_version", "name": "opendaylight", "product": { "name": "opendaylight", "product_id": "opendaylight", "product_identification_helper": { "purl": "pkg:rpm/redhat/opendaylight" } } }, { "category": "product_version", "name": "opendaylight", "product": { "name": "opendaylight", "product_id": "opendaylight.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/opendaylight?arch=src" } } }, { "category": "product_version", "name": "openshift-logging/elasticsearch6-rhel8", "product": { "name": "openshift-logging/elasticsearch6-rhel8", "product_id": "openshift-logging/elasticsearch6-rhel8", "product_identification_helper": { "purl": "pkg:oci/elasticsearch6-rhel8?repository_url=registry.redhat.io/openshift-logging/elasticsearch6-rhel8" } } }, { "category": "product_version", "name": "openshift3/ose-logging-elasticsearch5", "product": { "name": "openshift3/ose-logging-elasticsearch5", "product_id": "openshift3/ose-logging-elasticsearch5", "product_identification_helper": { "purl": "pkg:oci/ose-logging-elasticsearch5?repository_url=registry.redhat.io/openshift3/ose-logging-elasticsearch5" } } }, { "category": "product_version", "name": "openshift4/ose-logging-elasticsearch6", "product": { "name": "openshift4/ose-logging-elasticsearch6", "product_id": "openshift4/ose-logging-elasticsearch6", "product_identification_helper": { "purl": "pkg:oci/ose-logging-elasticsearch6?repository_url=registry.redhat.io/openshift4/ose-logging-elasticsearch6" } } }, { "category": "product_version", "name": "openshift4/ose-metering-hadoop", "product": { "name": "openshift4/ose-metering-hadoop", "product_id": "openshift4/ose-metering-hadoop", "product_identification_helper": { "purl": "pkg:oci/ose-metering-hadoop?repository_url=registry.redhat.io/openshift4/ose-metering-hadoop" } } }, { "category": "product_version", "name": "openshift4/ose-metering-hive", "product": { "name": "openshift4/ose-metering-hive", "product_id": "openshift4/ose-metering-hive", "product_identification_helper": { "purl": "pkg:oci/ose-metering-hive?repository_url=registry.redhat.io/openshift4/ose-metering-hive" } } }, { "category": "product_version", "name": "openshift4/ose-metering-presto", "product": { "name": "openshift4/ose-metering-presto", "product_id": "openshift4/ose-metering-presto", "product_identification_helper": { "purl": "pkg:oci/ose-metering-presto?repository_url=registry.redhat.io/openshift4/ose-metering-presto" } } } ] } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "candlepin as a component of Red Hat Satellite", "product_id": "rhn_satellite_6-default:candlepin" }, "product_reference": "candlepin", "relates_to_product_reference": "rhn_satellite_6-default" }, { "category": "default_component_of", "full_product_name": { "name": "candlepin-0:4.1.15-1.el8sat as a component of Red Hat Satellite 6.12.0", "product_id": "rhn_satellite_6.12::el8:candlepin-0:4.1.15-1.el8sat" }, "product_reference": "candlepin-0:4.1.15-1.el8sat", "relates_to_product_reference": "rhn_satellite_6.12::el8" }, { "category": "default_component_of", "full_product_name": { "name": "candlepin-0:4.1.15-1.el8sat.src as a component of Red Hat Satellite 6.12.0", "product_id": "rhn_satellite_6.12::el8:candlepin-0:4.1.15-1.el8sat.src" }, "product_reference": "candlepin-0:4.1.15-1.el8sat.src", "relates_to_product_reference": "rhn_satellite_6.12::el8" }, { "category": "default_component_of", "full_product_name": { "name": "candlepin-selinux as a component of Red Hat Satellite", "product_id": "rhn_satellite_6-default:candlepin-selinux" }, "product_reference": "candlepin-selinux", "relates_to_product_reference": "rhn_satellite_6-default" }, { "category": "default_component_of", "full_product_name": { "name": "candlepin-selinux-0:4.1.15-1.el8sat as a component of Red Hat Satellite 6.12.0", "product_id": "rhn_satellite_6.12::el8:candlepin-selinux-0:4.1.15-1.el8sat" }, "product_reference": "candlepin-selinux-0:4.1.15-1.el8sat", "relates_to_product_reference": "rhn_satellite_6.12::el8" }, { "category": "default_component_of", "full_product_name": { "name": "candlepin-tomcat as a component of Red Hat Satellite", "product_id": "rhn_satellite_6-default:candlepin-tomcat" }, "product_reference": "candlepin-tomcat", "relates_to_product_reference": "rhn_satellite_6-default" }, { "category": "default_component_of", "full_product_name": { "name": "candlepin-tomcat6 as a component of Red Hat Satellite", "product_id": "rhn_satellite_6-default:candlepin-tomcat6" }, "product_reference": "candlepin-tomcat6", "relates_to_product_reference": "rhn_satellite_6-default" }, { "category": "default_component_of", "full_product_name": { "name": "candlepin.src as a component of Red Hat Satellite", "product_id": "rhn_satellite_6-default:candlepin.src" }, "product_reference": "candlepin.src", "relates_to_product_reference": "rhn_satellite_6-default" }, { "category": "default_component_of", "full_product_name": { "name": "logging-elasticsearch6-container-v6.8.1-0:157 as a component of OpenShift Container Platform Logging 5.2.z", "product_id": "openshift-logging-5.2::el8:logging-elasticsearch6-container-v6.8.1-0:157" }, "product_reference": "logging-elasticsearch6-container-v6.8.1-0:157", "relates_to_product_reference": "openshift-logging-5.2::el8" }, { "category": "default_component_of", "full_product_name": { "name": "logging-elasticsearch6-container-v6.8.1-0:159 as a component of OpenShift Container Platform Logging 5.3.z", "product_id": "openshift-logging-5.3::el8:logging-elasticsearch6-container-v6.8.1-0:159" }, "product_reference": "logging-elasticsearch6-container-v6.8.1-0:159", "relates_to_product_reference": "openshift-logging-5.3::el8" }, { "category": "default_component_of", "full_product_name": { "name": "logging-elasticsearch6-container-v6.8.1-0:65 as a component of OpenShift Container Platform Logging 5.3.z", "product_id": "openshift-logging-5.3::el8:logging-elasticsearch6-container-v6.8.1-0:65" }, "product_reference": "logging-elasticsearch6-container-v6.8.1-0:65", "relates_to_product_reference": "openshift-logging-5.3::el8" }, { "category": "default_component_of", "full_product_name": { "name": "logging-elasticsearch6-container-v6.8.1-0:66 as a component of OpenShift Container Platform Logging 5.2.z", "product_id": "openshift-logging-5.2::el8:logging-elasticsearch6-container-v6.8.1-0:66" }, "product_reference": "logging-elasticsearch6-container-v6.8.1-0:66", "relates_to_product_reference": "openshift-logging-5.2::el8" }, { "category": "default_component_of", "full_product_name": { "name": "logging-elasticsearch6-container-v6.8.1-0:67 as a component of OpenShift Container Platform 5.1", "product_id": "openshift-5.1::el8:logging-elasticsearch6-container-v6.8.1-0:67" }, "product_reference": "logging-elasticsearch6-container-v6.8.1-0:67", "relates_to_product_reference": "openshift-5.1::el8" }, { "category": "default_component_of", "full_product_name": { "name": "logging-elasticsearch6-container-v6.8.1-0:67 as a component of OpenShift Container Platform Logging 5.1.z", "product_id": "openshift-logging-5.1::el8:logging-elasticsearch6-container-v6.8.1-0:67" }, "product_reference": "logging-elasticsearch6-container-v6.8.1-0:67", "relates_to_product_reference": "openshift-logging-5.1::el8" }, { "category": "default_component_of", "full_product_name": { "name": "opendaylight as a component of Red Hat OpenStack Platform 10.0 (Newton)", "product_id": "openstack-10:opendaylight" }, "product_reference": "opendaylight", "relates_to_product_reference": "openstack-10" }, { "category": "default_component_of", "full_product_name": { "name": "opendaylight as a component of Red Hat OpenStack Platform rhos-13.0.z", "product_id": "openstack-13:opendaylight" }, "product_reference": "opendaylight", "relates_to_product_reference": "openstack-13" }, { "category": "default_component_of", "full_product_name": { "name": "opendaylight.src as a component of Red Hat OpenStack Platform 10.0 (Newton)", "product_id": "openstack-10:opendaylight.src" }, "product_reference": "opendaylight.src", "relates_to_product_reference": "openstack-10" }, { "category": "default_component_of", "full_product_name": { "name": "opendaylight.src as a component of Red Hat OpenStack Platform rhos-13.0.z", "product_id": "openstack-13:opendaylight.src" }, "product_reference": "opendaylight.src", "relates_to_product_reference": "openstack-13" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-logging/elasticsearch6-rhel8 as a component of OpenShift Container Platform Logging 5.9.z", "product_id": "openshift-logging-5:openshift-logging/elasticsearch6-rhel8" }, "product_reference": "openshift-logging/elasticsearch6-rhel8", "relates_to_product_reference": "openshift-logging-5" }, { "category": "default_component_of", "full_product_name": { "name": "openshift3/ose-logging-elasticsearch5 as a component of OpenShift Container Platform 3.11.0", "product_id": "openshift-enterprise-3.11:openshift3/ose-logging-elasticsearch5" }, "product_reference": "openshift3/ose-logging-elasticsearch5", "relates_to_product_reference": "openshift-enterprise-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-logging-elasticsearch6 as a component of OpenShift Container Platform 4.18", "product_id": "openshift-4.18:openshift4/ose-logging-elasticsearch6" }, "product_reference": "openshift4/ose-logging-elasticsearch6", "relates_to_product_reference": "openshift-4.18" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-logging-elasticsearch6 as a component of OpenShift Container Platform 4.19", "product_id": "openshift-4.19:openshift4/ose-logging-elasticsearch6" }, "product_reference": "openshift4/ose-logging-elasticsearch6", "relates_to_product_reference": "openshift-4.19" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-logging-elasticsearch6 as a component of OpenShift Container Platform 4.12", "product_id": "openshift-4.12.z:openshift4/ose-logging-elasticsearch6" }, "product_reference": "openshift4/ose-logging-elasticsearch6", "relates_to_product_reference": "openshift-4.12.z" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-logging-elasticsearch6 as a component of OpenShift Container Platform 4.16.z", "product_id": "openshift-4.16.z:openshift4/ose-logging-elasticsearch6" }, "product_reference": "openshift4/ose-logging-elasticsearch6", "relates_to_product_reference": "openshift-4.16.z" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-logging-elasticsearch6 as a component of OpenShift Container Platform 4.17", "product_id": "openshift-4.17:openshift4/ose-logging-elasticsearch6" }, "product_reference": "openshift4/ose-logging-elasticsearch6", "relates_to_product_reference": "openshift-4.17" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-logging-elasticsearch6 as a component of OpenShift Container Platform 4.20", "product_id": "openshift-4.20:openshift4/ose-logging-elasticsearch6" }, "product_reference": "openshift4/ose-logging-elasticsearch6", "relates_to_product_reference": "openshift-4.20" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-logging-elasticsearch6 as a component of OpenShift Container Platform 4.14", "product_id": "openshift-4.14.z:openshift4/ose-logging-elasticsearch6" }, "product_reference": "openshift4/ose-logging-elasticsearch6", "relates_to_product_reference": "openshift-4.14.z" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-logging-elasticsearch6 as a component of OpenShift Container Platform 4.13", "product_id": "openshift-4.13.z:openshift4/ose-logging-elasticsearch6" }, "product_reference": "openshift4/ose-logging-elasticsearch6", "relates_to_product_reference": "openshift-4.13.z" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-logging-elasticsearch6 as a component of OpenShift Container Platform 4.15.z", "product_id": "openshift-4.15.z:openshift4/ose-logging-elasticsearch6" }, "product_reference": "openshift4/ose-logging-elasticsearch6", "relates_to_product_reference": "openshift-4.15.z" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-metering-hadoop as a component of OpenShift Container Platform 4.19", "product_id": "openshift-4:openshift4/ose-metering-hadoop" }, "product_reference": "openshift4/ose-metering-hadoop", "relates_to_product_reference": "openshift-4" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-metering-hive as a component of OpenShift Container Platform 4.12", "product_id": "openshift-4.12.z:openshift4/ose-metering-hive" }, "product_reference": "openshift4/ose-metering-hive", "relates_to_product_reference": "openshift-4.12.z" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-metering-hive as a component of OpenShift Container Platform 4.16.z", "product_id": "openshift-4.16.z:openshift4/ose-metering-hive" }, "product_reference": "openshift4/ose-metering-hive", "relates_to_product_reference": "openshift-4.16.z" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-metering-hive as a component of OpenShift Container Platform 4.17", "product_id": "openshift-4.17:openshift4/ose-metering-hive" }, "product_reference": "openshift4/ose-metering-hive", "relates_to_product_reference": "openshift-4.17" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-metering-hive as a component of OpenShift Container Platform 4.14", "product_id": "openshift-4.14.z:openshift4/ose-metering-hive" }, "product_reference": "openshift4/ose-metering-hive", "relates_to_product_reference": "openshift-4.14.z" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-metering-hive as a component of OpenShift Container Platform 4.13", "product_id": "openshift-4.13.z:openshift4/ose-metering-hive" }, "product_reference": "openshift4/ose-metering-hive", "relates_to_product_reference": "openshift-4.13.z" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-metering-hive as a component of OpenShift Container Platform 4.20", "product_id": "openshift-4.20:openshift4/ose-metering-hive" }, "product_reference": "openshift4/ose-metering-hive", "relates_to_product_reference": "openshift-4.20" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-metering-hive as a component of OpenShift Container Platform 4.15.z", "product_id": "openshift-4.15.z:openshift4/ose-metering-hive" }, "product_reference": "openshift4/ose-metering-hive", "relates_to_product_reference": "openshift-4.15.z" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-metering-hive as a component of OpenShift Container Platform 4.19", "product_id": "openshift-4.19:openshift4/ose-metering-hive" }, "product_reference": "openshift4/ose-metering-hive", "relates_to_product_reference": "openshift-4.19" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-metering-hive as a component of OpenShift Container Platform 4.18", "product_id": "openshift-4.18:openshift4/ose-metering-hive" }, "product_reference": "openshift4/ose-metering-hive", "relates_to_product_reference": "openshift-4.18" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-metering-presto as a component of OpenShift Container Platform 4.19", "product_id": "openshift-4.19:openshift4/ose-metering-presto" }, "product_reference": "openshift4/ose-metering-presto", "relates_to_product_reference": "openshift-4.19" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-metering-presto as a component of OpenShift Container Platform 4.18", "product_id": "openshift-4.18:openshift4/ose-metering-presto" }, "product_reference": "openshift4/ose-metering-presto", "relates_to_product_reference": "openshift-4.18" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-metering-presto as a component of OpenShift Container Platform 4.12", "product_id": "openshift-4.12.z:openshift4/ose-metering-presto" }, "product_reference": "openshift4/ose-metering-presto", "relates_to_product_reference": "openshift-4.12.z" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-metering-presto as a component of OpenShift Container Platform 4.16.z", "product_id": "openshift-4.16.z:openshift4/ose-metering-presto" }, "product_reference": "openshift4/ose-metering-presto", "relates_to_product_reference": "openshift-4.16.z" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-metering-presto as a component of OpenShift Container Platform 4.17", "product_id": "openshift-4.17:openshift4/ose-metering-presto" }, "product_reference": "openshift4/ose-metering-presto", "relates_to_product_reference": "openshift-4.17" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-metering-presto as a component of OpenShift Container Platform 4.20", "product_id": "openshift-4.20:openshift4/ose-metering-presto" }, "product_reference": "openshift4/ose-metering-presto", "relates_to_product_reference": "openshift-4.20" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-metering-presto as a component of OpenShift Container Platform 4.14", "product_id": "openshift-4.14.z:openshift4/ose-metering-presto" }, "product_reference": "openshift4/ose-metering-presto", "relates_to_product_reference": "openshift-4.14.z" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-metering-presto as a component of OpenShift Container Platform 4.13", "product_id": "openshift-4.13.z:openshift4/ose-metering-presto" }, "product_reference": "openshift4/ose-metering-presto", "relates_to_product_reference": "openshift-4.13.z" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-metering-presto as a component of OpenShift Container Platform 4.15.z", "product_id": "openshift-4.15.z:openshift4/ose-metering-presto" }, "product_reference": "openshift4/ose-metering-presto", "relates_to_product_reference": "openshift-4.15.z" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-37136", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2021-09-14T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "openshift-4.12.z:openshift4/ose-metering-hive", "openshift-4.12.z:openshift4/ose-metering-presto", "openshift-4.13.z:openshift4/ose-metering-hive", "openshift-4.13.z:openshift4/ose-metering-presto", "openshift-4.14.z:openshift4/ose-metering-hive", "openshift-4.14.z:openshift4/ose-metering-presto", "openshift-4.15.z:openshift4/ose-metering-hive", "openshift-4.15.z:openshift4/ose-metering-presto", "openshift-4.16.z:openshift4/ose-metering-hive", "openshift-4.16.z:openshift4/ose-metering-presto", "openshift-4.17:openshift4/ose-metering-hive", "openshift-4.17:openshift4/ose-metering-presto", "openshift-4.18:openshift4/ose-metering-hive", "openshift-4.18:openshift4/ose-metering-presto", "openshift-4.19:openshift4/ose-metering-hive", "openshift-4.19:openshift4/ose-metering-presto", "openshift-4.20:openshift4/ose-metering-hive", "openshift-4.20:openshift4/ose-metering-presto" ] } ], "notes": [ { "category": "other", "text": "In the OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack ship the vulnerable version of netty-codec package. Since the release of OCP 4.6, the Metering product has been deprecated [1], so the affected components are marked as wontfix. This may be fixed in the future.\n\nStarting in OCP 4.7, the elasticsearch component is shipping as a part of the OpenShift Logging product (openshift-logging/elasticsearch6-rhel8). The elasticsearch component delivered in OCP 4.6 is marked as `Out of support scope` because these versions are already under Maintenance Phase of the support.\n\n[1] https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html#ocp-4-6-metering-operator-deprecated", "title": "Statement" }, { "category": "description", "text": "A flaw was found in Netty's netty-codec due to size restrictions for decompressed data in the Bzip2Decoder. By sending a specially-crafted input, a remote attacker could cause a denial of service.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "openshift-5.1::el8:logging-elasticsearch6-container-v6.8.1-0:67", "openshift-logging-5.1::el8:logging-elasticsearch6-container-v6.8.1-0:67", "openshift-logging-5.2::el8:logging-elasticsearch6-container-v6.8.1-0:157", "openshift-logging-5.2::el8:logging-elasticsearch6-container-v6.8.1-0:66", "openshift-logging-5.3::el8:logging-elasticsearch6-container-v6.8.1-0:159", "openshift-logging-5.3::el8:logging-elasticsearch6-container-v6.8.1-0:65", "rhn_satellite_6.12::el8:candlepin-0:4.1.15-1.el8sat", "rhn_satellite_6.12::el8:candlepin-0:4.1.15-1.el8sat.src", "rhn_satellite_6.12::el8:candlepin-selinux-0:4.1.15-1.el8sat" ], "known_affected": [ "openshift-4.12.z:openshift4/ose-logging-elasticsearch6", "openshift-4.13.z:openshift4/ose-logging-elasticsearch6", "openshift-4.14.z:openshift4/ose-logging-elasticsearch6", "openshift-4.15.z:openshift4/ose-logging-elasticsearch6", "openshift-4.16.z:openshift4/ose-logging-elasticsearch6", "openshift-4.17:openshift4/ose-logging-elasticsearch6", "openshift-4.18:openshift4/ose-logging-elasticsearch6", "openshift-4.19:openshift4/ose-logging-elasticsearch6", "openshift-4.20:openshift4/ose-logging-elasticsearch6", "openshift-4:openshift4/ose-metering-hadoop", "openshift-enterprise-3.11:openshift3/ose-logging-elasticsearch5", "openshift-logging-5:openshift-logging/elasticsearch6-rhel8", "openstack-10:opendaylight", "openstack-10:opendaylight.src", "openstack-13:opendaylight", "openstack-13:opendaylight.src", "rhn_satellite_6-default:candlepin", "rhn_satellite_6-default:candlepin-selinux", "rhn_satellite_6-default:candlepin-tomcat", "rhn_satellite_6-default:candlepin-tomcat6", "rhn_satellite_6-default:candlepin.src" ], "known_not_affected": [ "openshift-4.12.z:openshift4/ose-metering-hive", "openshift-4.12.z:openshift4/ose-metering-presto", "openshift-4.13.z:openshift4/ose-metering-hive", "openshift-4.13.z:openshift4/ose-metering-presto", "openshift-4.14.z:openshift4/ose-metering-hive", "openshift-4.14.z:openshift4/ose-metering-presto", "openshift-4.15.z:openshift4/ose-metering-hive", "openshift-4.15.z:openshift4/ose-metering-presto", "openshift-4.16.z:openshift4/ose-metering-hive", "openshift-4.16.z:openshift4/ose-metering-presto", "openshift-4.17:openshift4/ose-metering-hive", "openshift-4.17:openshift4/ose-metering-presto", "openshift-4.18:openshift4/ose-metering-hive", "openshift-4.18:openshift4/ose-metering-presto", "openshift-4.19:openshift4/ose-metering-hive", "openshift-4.19:openshift4/ose-metering-presto", "openshift-4.20:openshift4/ose-metering-hive", "openshift-4.20:openshift4/ose-metering-presto" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-37136" }, { "category": "external", "summary": "nvd.nist.gov", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37136" }, { "category": "external", "summary": "www.cve.org", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37136" } ], "remediations": [ { "category": "no_fix_planned", "details": "Out of support scope", "product_ids": [ "openshift-4.12.z:openshift4/ose-logging-elasticsearch6", "openshift-4.13.z:openshift4/ose-logging-elasticsearch6", "openshift-4.14.z:openshift4/ose-logging-elasticsearch6", "openshift-4.15.z:openshift4/ose-logging-elasticsearch6", "openshift-4.16.z:openshift4/ose-logging-elasticsearch6", "openshift-4.17:openshift4/ose-logging-elasticsearch6", "openshift-4.18:openshift4/ose-logging-elasticsearch6", "openshift-4.19:openshift4/ose-logging-elasticsearch6", "openshift-4.20:openshift4/ose-logging-elasticsearch6", "openshift-enterprise-3.11:openshift3/ose-logging-elasticsearch5", "openstack-10:opendaylight", "openstack-10:opendaylight.src", "openstack-13:opendaylight", "openstack-13:opendaylight.src" ] }, { "category": "no_fix_planned", "details": "Will not fix", "product_ids": [ "openshift-4:openshift4/ose-metering-hadoop" ] }, { "category": "none_available", "details": "Affected", "product_ids": [ "openshift-logging-5:openshift-logging/elasticsearch6-rhel8", "rhn_satellite_6-default:candlepin", "rhn_satellite_6-default:candlepin-selinux", "rhn_satellite_6-default:candlepin-tomcat", "rhn_satellite_6-default:candlepin-tomcat6", "rhn_satellite_6-default:candlepin.src" ] }, { "category": "vendor_fix", "date": "2021-12-14T19:37:00+00:00", "details": "Apply advisory RHSA-2021:5129 as per vendors instructions.", "product_ids": [ "openshift-logging-5.3::el8:logging-elasticsearch6-container-v6.8.1-0:65" ], "url": "https://access.redhat.com/errata/RHSA-2021:5129" }, { "category": "vendor_fix", "date": "2021-12-14T18:38:45+00:00", "details": "Apply advisory RHSA-2021:5127 as per vendors instructions.", "product_ids": [ "openshift-logging-5.2::el8:logging-elasticsearch6-container-v6.8.1-0:66" ], "url": "https://access.redhat.com/errata/RHSA-2021:5127" }, { "category": "vendor_fix", "date": "2021-12-14T18:09:12+00:00", "details": "Apply advisory RHSA-2021:5128 as per vendors instructions.", "product_ids": [ "openshift-5.1::el8:logging-elasticsearch6-container-v6.8.1-0:67", "openshift-logging-5.1::el8:logging-elasticsearch6-container-v6.8.1-0:67" ], "url": "https://access.redhat.com/errata/RHSA-2021:5128" }, { "category": "vendor_fix", "date": "2022-05-11T19:51:53+00:00", "details": "Apply advisory RHSA-2022:2218 as per vendors instructions.", "product_ids": [ "openshift-logging-5.2::el8:logging-elasticsearch6-container-v6.8.1-0:157" ], "url": "https://access.redhat.com/errata/RHSA-2022:2218" }, { "category": "vendor_fix", "date": "2022-05-11T20:33:12+00:00", "details": "Apply advisory RHSA-2022:2217 as per vendors instructions.", "product_ids": [ "openshift-logging-5.3::el8:logging-elasticsearch6-container-v6.8.1-0:159" ], "url": "https://access.redhat.com/errata/RHSA-2022:2217" }, { "category": "vendor_fix", "date": "2022-11-16T15:09:28+00:00", "details": "Apply advisory RHSA-2022:8506 as per vendors instructions.", "product_ids": [ "rhn_satellite_6.12::el8:candlepin-0:4.1.15-1.el8sat", "rhn_satellite_6.12::el8:candlepin-0:4.1.15-1.el8sat.src", "rhn_satellite_6.12::el8:candlepin-selinux-0:4.1.15-1.el8sat" ], "url": "https://access.redhat.com/errata/RHSA-2022:8506" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "openshift-4.12.z:openshift4/ose-logging-elasticsearch6", "openshift-4.12.z:openshift4/ose-metering-hive", "openshift-4.12.z:openshift4/ose-metering-presto", "openshift-4.13.z:openshift4/ose-logging-elasticsearch6", "openshift-4.13.z:openshift4/ose-metering-hive", "openshift-4.13.z:openshift4/ose-metering-presto", "openshift-4.14.z:openshift4/ose-logging-elasticsearch6", "openshift-4.14.z:openshift4/ose-metering-hive", "openshift-4.14.z:openshift4/ose-metering-presto", "openshift-4.15.z:openshift4/ose-logging-elasticsearch6", "openshift-4.15.z:openshift4/ose-metering-hive", "openshift-4.15.z:openshift4/ose-metering-presto", "openshift-4.16.z:openshift4/ose-logging-elasticsearch6", "openshift-4.16.z:openshift4/ose-metering-hive", "openshift-4.16.z:openshift4/ose-metering-presto", "openshift-4.17:openshift4/ose-logging-elasticsearch6", "openshift-4.17:openshift4/ose-metering-hive", "openshift-4.17:openshift4/ose-metering-presto", "openshift-4.18:openshift4/ose-logging-elasticsearch6", "openshift-4.18:openshift4/ose-metering-hive", "openshift-4.18:openshift4/ose-metering-presto", "openshift-4.19:openshift4/ose-logging-elasticsearch6", "openshift-4.19:openshift4/ose-metering-hive", "openshift-4.19:openshift4/ose-metering-presto", "openshift-4.20:openshift4/ose-logging-elasticsearch6", "openshift-4.20:openshift4/ose-metering-hive", "openshift-4.20:openshift4/ose-metering-presto", "openshift-4:openshift4/ose-metering-hadoop", "openshift-5.1::el8:logging-elasticsearch6-container-v6.8.1-0:67", "openshift-enterprise-3.11:openshift3/ose-logging-elasticsearch5", "openshift-logging-5.1::el8:logging-elasticsearch6-container-v6.8.1-0:67", "openshift-logging-5.2::el8:logging-elasticsearch6-container-v6.8.1-0:157", "openshift-logging-5.2::el8:logging-elasticsearch6-container-v6.8.1-0:66", "openshift-logging-5.3::el8:logging-elasticsearch6-container-v6.8.1-0:159", "openshift-logging-5.3::el8:logging-elasticsearch6-container-v6.8.1-0:65", "openshift-logging-5:openshift-logging/elasticsearch6-rhel8", "openstack-10:opendaylight", "openstack-10:opendaylight.src", "openstack-13:opendaylight", "openstack-13:opendaylight.src", "rhn_satellite_6-default:candlepin", "rhn_satellite_6-default:candlepin-selinux", "rhn_satellite_6-default:candlepin-tomcat", "rhn_satellite_6-default:candlepin-tomcat6", "rhn_satellite_6-default:candlepin.src", "rhn_satellite_6.12::el8:candlepin-0:4.1.15-1.el8sat", "rhn_satellite_6.12::el8:candlepin-0:4.1.15-1.el8sat.src", "rhn_satellite_6.12::el8:candlepin-selinux-0:4.1.15-1.el8sat" ] } ], "threats": [ { "category": "impact", "details": "Moderate", "product_ids": [ "openshift-4.12.z:openshift4/ose-logging-elasticsearch6", "openshift-4.12.z:openshift4/ose-metering-hive", "openshift-4.12.z:openshift4/ose-metering-presto", "openshift-4.13.z:openshift4/ose-logging-elasticsearch6", "openshift-4.13.z:openshift4/ose-metering-hive", "openshift-4.13.z:openshift4/ose-metering-presto", "openshift-4.14.z:openshift4/ose-logging-elasticsearch6", "openshift-4.14.z:openshift4/ose-metering-hive", "openshift-4.14.z:openshift4/ose-metering-presto", "openshift-4.15.z:openshift4/ose-logging-elasticsearch6", "openshift-4.15.z:openshift4/ose-metering-hive", "openshift-4.15.z:openshift4/ose-metering-presto", "openshift-4.16.z:openshift4/ose-logging-elasticsearch6", "openshift-4.16.z:openshift4/ose-metering-hive", "openshift-4.16.z:openshift4/ose-metering-presto", "openshift-4.17:openshift4/ose-logging-elasticsearch6", "openshift-4.17:openshift4/ose-metering-hive", "openshift-4.17:openshift4/ose-metering-presto", "openshift-4.18:openshift4/ose-logging-elasticsearch6", "openshift-4.18:openshift4/ose-metering-hive", "openshift-4.18:openshift4/ose-metering-presto", "openshift-4.19:openshift4/ose-logging-elasticsearch6", "openshift-4.19:openshift4/ose-metering-hive", "openshift-4.19:openshift4/ose-metering-presto", "openshift-4.20:openshift4/ose-logging-elasticsearch6", "openshift-4.20:openshift4/ose-metering-hive", "openshift-4.20:openshift4/ose-metering-presto", "openshift-4:openshift4/ose-metering-hadoop", "openshift-5.1::el8:logging-elasticsearch6-container-v6.8.1-0:67", "openshift-enterprise-3.11:openshift3/ose-logging-elasticsearch5", "openshift-logging-5.1::el8:logging-elasticsearch6-container-v6.8.1-0:67", "openshift-logging-5.2::el8:logging-elasticsearch6-container-v6.8.1-0:157", "openshift-logging-5.2::el8:logging-elasticsearch6-container-v6.8.1-0:66", "openshift-logging-5.3::el8:logging-elasticsearch6-container-v6.8.1-0:159", "openshift-logging-5.3::el8:logging-elasticsearch6-container-v6.8.1-0:65", "openshift-logging-5:openshift-logging/elasticsearch6-rhel8", "openstack-10:opendaylight", "openstack-10:opendaylight.src", "openstack-13:opendaylight", "openstack-13:opendaylight.src", "rhn_satellite_6.12::el8:candlepin-0:4.1.15-1.el8sat", "rhn_satellite_6.12::el8:candlepin-0:4.1.15-1.el8sat.src", "rhn_satellite_6.12::el8:candlepin-selinux-0:4.1.15-1.el8sat" ] }, { "category": "impact", "details": "Low", "product_ids": [ "rhn_satellite_6-default:candlepin", "rhn_satellite_6-default:candlepin-selinux", "rhn_satellite_6-default:candlepin-tomcat", "rhn_satellite_6-default:candlepin-tomcat6", "rhn_satellite_6-default:candlepin.src" ] } ], "title": "Bzip2Decoder doesn't allow setting size restrictions for decompressed data" } ] }