{"id":"CVE-2022-0552","published":"2022-04-11T19:38:32Z","modified":"2024-08-02T23:32:46Z","title":"A flaw was found in the original fix for the netty-codec-http CVE-2021-21409, where the OpenShift Logging…","vendor":null,"product":null,"tier":"tail","description":{"text":"A flaw was found in the original fix for the netty-codec-http CVE-2021-21409, where the OpenShift Logging openshift-logging/elasticsearch6-rhel8 container was incomplete. The vulnerable netty-codec-http maven package was not removed from the image content. This flaw affects origin-aggregated-logging versions 3.11.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01176,"percentile":0.67596,"provenance":"source"},"cwes":[{"id":"CWE-444","name":"Inconsistent Interpretation of HTTP Requests"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2052539","tags":["x_refsource_MISC"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21409","tags":["x_refsource_MISC"]},{"url":"https://github.com/openshift/origin-aggregated-logging/commit/d6b72d6c32e7c06b65324294d10406546734004d","tags":["x_refsource_MISC"]}],"priority":{"score":13.5,"factors":[{"name":"EPSS percentile","points":13.52}]},"affectedVersions":[{"vendor":"n/a","product":"origin-aggregated-logging/elasticsearch","versions":["origin-aggregated-logging versions 3.11"]}],"euvd":{"id":"EUVD-2022-15674","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-netty-io-netty-netty-codec-http2-cve-2021-21295","parents":[{"from":"CVE-2021-21409","to":"CVE-2022-0552","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"A flaw was found in the original fix for the netty-codec-http CVE-2021-21409, where the OpenShift Logging openshift-logging/elasticsearch6-rhel8 container was incomplete.","from":"CVE.org","in":"CVE-2022-0552"}]}]}}