CVE-2022-0552: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') (CWE-444)
value: A flaw was found in the original fix for the netty-codec-http CVE-2021-21409, where the OpenShift Logging openshift-logging/elasticsearch6-rhel8 container was incomplete. The vulnerable netty-codec-http maven package was not removed from the image content. This flaw affects origin-aggregated-logging versions 3.11.
CWE description: The product acts as an intermediary HTTP agent
         (such as a proxy or firewall) in the data flow between two
         entities such as a client and server, but it does not
         interpret malformed HTTP requests or responses in ways that
         are consistent with how the messages will be processed by
         those entities that are at the ultimate destination.
CVSS v3 base score: 5.9
Published: 2022-04-11T20:15Z
Repository: https://github.com/openshift/origin-aggregated-logging
Language: Other
Files changed: elasticsearch/Dockerfile, elasticsearch/Dockerfile.in, elasticsearch/fetch-artifacts-koji.yaml
Commit date: 2022-02-03 22:45:08 -0500
Commit message: Update netty to 4.1.63

Diff: diff --git a/elasticsearch/Dockerfile b/elasticsearch/Dockerfile
index 27e53a12..f44637a4 100644
--- a/elasticsearch/Dockerfile
+++ b/elasticsearch/Dockerfile
@@ -19,20 +19,20 @@ ARG OPENDISTRO_URL
 ARG OPENSHIFT_CI
 
 
 ENV ES_PATH_CONF=/etc/elasticsearch/ \
     ES_HOME=/usr/share/elasticsearch \
-    ES_VER=6.8.1.redhat-00018 \
+    ES_VER=6.8.1.redhat-00019 \
     HOME=/opt/app-root/src \
     INSTANCE_RAM=512G \
     JAVA_VER=11 \
     JAVA_HOME=/usr/lib/jvm/jre \
     _JAVA_OPTIONS="-Dcom.redhat.fips=false" \
     NODE_QUORUM=1 \
     PROMETHEUS_EXPORTER_VER=6.8.1.2-redhat-00001 \
     INGEST_PLUGIN_VER=6.8.1.0-redhat-00003 \
-    OPENDISTRO_VER=0.10.1.2-redhat-00006 \
+    OPENDISTRO_VER=0.10.1.2-redhat-00009 \
     PLUGIN_LOGLEVEL=INFO \
     RECOVER_AFTER_NODES=1 \
     RECOVER_EXPECTED_NODES=1 \
     RECOVER_AFTER_TIME=5m \
     DHE_TMP_KEY_SIZE=2048 \
diff --git a/elasticsearch/Dockerfile.in b/elasticsearch/Dockerfile.in
index ade4a345..8905c4e2 100644
--- a/elasticsearch/Dockerfile.in
+++ b/elasticsearch/Dockerfile.in
@@ -34,20 +34,20 @@ ARG OPENDISTRO_URL
 ARG OPENSHIFT_CI
 
 
 ENV ES_PATH_CONF=/etc/elasticsearch/ \
     ES_HOME=/usr/share/elasticsearch \
-    ES_VER=6.8.1.redhat-00018 \
+    ES_VER=6.8.1.redhat-00019 \
     HOME=/opt/app-root/src \
     INSTANCE_RAM=512G \
     JAVA_VER=11 \
     JAVA_HOME=/usr/lib/jvm/jre \
     _JAVA_OPTIONS="-Dcom.redhat.fips=false" \
     NODE_QUORUM=1 \
     PROMETHEUS_EXPORTER_VER=6.8.1.2-redhat-00001 \
     INGEST_PLUGIN_VER=6.8.1.0-redhat-00003 \
-    OPENDISTRO_VER=0.10.1.2-redhat-00006 \
+    OPENDISTRO_VER=0.10.1.2-redhat-00009 \
     PLUGIN_LOGLEVEL=INFO \
     RECOVER_AFTER_NODES=1 \
     RECOVER_EXPECTED_NODES=1 \
     RECOVER_AFTER_TIME=5m \
     DHE_TMP_KEY_SIZE=2048 \
diff --git a/elasticsearch/fetch-artifacts-koji.yaml b/elasticsearch/fetch-artifacts-koji.yaml
index 8d168498..9a33bcde 100644
--- a/elasticsearch/fetch-artifacts-koji.yaml
+++ b/elasticsearch/fetch-artifacts-koji.yaml
@@ -1,4 +1,4 @@
-- nvr: org.elasticsearch-elasticsearch-6.8.1.redhat_00018-1
-- nvr: com.amazon.opendistroforelasticsearch-opendistro_security-0.10.1.2_redhat_00006-1
+- nvr: org.elasticsearch-elasticsearch-6.8.1.redhat_00019-1
+- nvr: com.amazon.opendistroforelasticsearch-opendistro_security-0.10.1.2_redhat_00009-1
 - nvr: org.elasticsearch.plugin.prometheus-prometheus-exporter-6.8.1.2_redhat_00001-1
 - nvr: org.elasticsearch.plugin.ingest-openshift-ingest-plugin-6.8.1.0_redhat_00003-1

Vulnerable code:     ES_VER=6.8.1.redhat-00018 \
    OPENDISTRO_VER=0.10.1.2-redhat-00006 \
    ES_VER=6.8.1.redhat-00018 \
    OPENDISTRO_VER=0.10.1.2-redhat-00006 \
- nvr: org.elasticsearch-elasticsearch-6.8.1.redhat_00018-1
- nvr: com.amazon.opendistroforelasticsearch-opendistro_security-0.10.1.2_redhat_00006-1
Fixed code:     ES_VER=6.8.1.redhat-00019 \
    OPENDISTRO_VER=0.10.1.2-redhat-00009 \
    ES_VER=6.8.1.redhat-00019 \
    OPENDISTRO_VER=0.10.1.2-redhat-00009 \
- nvr: org.elasticsearch-elasticsearch-6.8.1.redhat_00019-1
- nvr: com.amazon.opendistroforelasticsearch-opendistro_security-0.10.1.2_redhat_00009-1