[RHSA-2016:1038-01] Moderate: openshift security update

[news 28]

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

 

=====================================================================

Red Hat Security Advisory

 

Synopsis: Moderate: openshift security update

Advisory ID: RHSA-2016:1038-01

Product: Red Hat OpenShift Enterprise

Advisory URL: https://access.redhat.com/errata/RHSA-2016:1038

Issue date: 2016-05-11

CVE Names: CVE-2016-2142

=====================================================================

 

1. Summary:

 

Updated openshift packages that fix one security issue are now

available for Red Hat OpenShift Enterprise 3.1.

 

Red Hat Product Security has rated this update as having Moderate security

impact. A Common Vulnerability Scoring System (CVSS) base score, which

gives a detailed severity rating, is available from the CVE link in the

References section.

 

2. Relevant releases/architectures:

 

Red Hat OpenShift Enterprise 3.1 - x86_64

 

3. Description:

 

OpenShift Enterprise by Red Hat is the company's cloud computing

Platform-as-a-Service (PaaS) solution designed for on-premise or

private cloud deployments.

 

An access flaw was discovered in OpenShift; the

/etc/origin/master/master-config.yaml configuration file, which could

contain Active Directory credentials, was world-readable. A local user

could exploit this flaw to obtain authentication credentials from the

master-config.yaml file. (CVE-2016-2142)

 

If you believe that the password in this file has been viewed by an

attacker you should reset the password after installing this update.

 

All installations with Active Directory integration are advised to upgrade

to the updated software, which contains a backported patch to correct this

issue.

 

This update includes the following images:

 

openshift3/ose:v3.1.1.6-19

openshift3/ose-deployer:v3.1.1.6-18

openshift3/ose-docker-builder:v3.1.1.6-17

openshift3/ose-f5-router:v3.1.1.6-18

openshift3/ose-sti-builder:v3.1.1.6-17

openshift3/node:v3.1.1.6-18

aep3_beta/aep-deployer:v3.1.1.6-18

aep3_beta/aep-f5-router:v3.1.1.6-18

aep3_beta/aep:v3.1.1.6-19

aep3_beta/node:v3.1.1.6-18

 

4. Solution:

 

Before applying this update, make sure all previously released errata

relevant to your system have been applied.

 

For details on how to apply this update, refer to:

 

https://access.redhat.com/articles/11258

 

5. Bugs fixed (https://bugzilla.redhat.com/):

 

1311220 - CVE-2016-2142 openshift: Bind password for AD account is stored in world readable file

1331038 - Pods are stuck in pending state due to failed image pulling

 

6. Package List:

 

Red Hat OpenShift Enterprise 3.1:

 

Source:

atomic-openshift-3.1.1.6-6.git.43.f583589.el7aos.src.rpm

 

x86_64:

atomic-openshift-3.1.1.6-6.git.43.f583589.el7aos.x86_64.rpm

atomic-openshift-clients-3.1.1.6-6.git.43.f583589.el7aos.x86_64.rpm

atomic-openshift-clients-redistributable-3.1.1.6-6.git.43.f583589.el7aos.x86_64.rpm

atomic-openshift-dockerregistry-3.1.1.6-6.git.43.f583589.el7aos.x86_64.rpm

atomic-openshift-master-3.1.1.6-6.git.43.f583589.el7aos.x86_64.rpm

atomic-openshift-node-3.1.1.6-6.git.43.f583589.el7aos.x86_64.rpm

atomic-openshift-pod-3.1.1.6-6.git.43.f583589.el7aos.x86_64.rpm

atomic-openshift-recycle-3.1.1.6-6.git.43.f583589.el7aos.x86_64.rpm

atomic-openshift-sdn-ovs-3.1.1.6-6.git.43.f583589.el7aos.x86_64.rpm

tuned-profiles-atomic-openshift-node-3.1.1.6-6.git.43.f583589.el7aos.x86_64.rpm

 

These packages are GPG signed by Red Hat for security. Our key and

details on how to verify the signature are available from

https://access.redhat.com/security/team/key/

 

7. References:

 

https://access.redhat.com/security/cve/CVE-2016-2142

https://access.redhat.com/security/updates/classification/#moderate

 

8. Contact:

 

The Red Hat security contact is . More contact

details at https://access.redhat.com/security/team/contact/

 

Copyright 2016 Red Hat, Inc.

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1

 

iD8DBQFXM0FOXlSAg2UNWIIRAqqJAJ9E1zDpzlT5nMsTwpSBncZYM2o8VgCgo2pc

EXXV6Tmgem7x8LlUs7YzT3k=

=jW5m

-----END PGP SIGNATURE-----

 

 

--