https://bugzilla.redhat.com/show_bug.cgi?id=1816216
Yadnyawalk Tale <ytale(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Comment|27 |updated
--- Comment #27 has been edited ---
Statement:
In OpenShift Container Platform end users don't have direct access to send
requests to ElasticSearch. A user could need access to the ElasticSearch
service on the internal cluster network in order to be able to send malicious
requests to it.
Third party scanners flagging Red Hat Satellite due to availability of the
higher version packages in Red Hat AMQ Clients (through errata RHSA-2020:2605)
and the qpid-proton from Satellite Tools repository. qpid-proton dependency
fixed in errata RHSA-2020:2605 was for Red Hat AMQ Clients and it doesn't
necessarily mean that pid-proton from Satellite Tools is affected. These are
two different products with different architecture and code-base. Updating the
packages from any other repository than the Satellite-tools repository is not
recommended for Satellite Customers.
Red Hat Satellite 6.7 and earlier ship affected version of netty, however,
there is no external connection being exposed and it is used by only Artemis to
open an internal connection within the JVM. Since netty does not come into
contact with untrusted data, vulnerability is not exposed in product code and
there is no breach of Confidentiality, Integrity or Availability expected from
this vulnerability. We may update the netty and its dependency in a future
release.
More information regarding Satellite related packages can be found on KCS:
https://access.redhat.com/solutions/5200591
--
You are receiving this mail because:
You are on the CC list for the bug.