Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 551
Alerts This Week
Warning Icon 1 551

Red Hat OpenShift 1.2.2 RHSA-2013:1137-01 Moderate: SSL Spoofing

red hat
Calendar Grey August 5, 2013
Dist Redhat Esm H88
This patch resolves a significant TLS vulnerability in the ruby193-ruby components for Red Hat OpenShift.
Updated ruby193-ruby packages that fix one security issue are now available for Red Hat OpenShift Enterprise 1.2.2

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258

Summary

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to do system management tasks.
A flaw was found in Ruby's SSL client's hostname identity check when handling certificates that contain hostnames with NULL bytes. An attacker could potentially exploit this flaw to conduct man-in-the-middle attacks to spoof SSL servers. Note that to exploit this issue, an attacker would need to obtain a carefully-crafted certificate signed by an authority that the client trusts. (CVE-2013-4073)
All users of Red Hat OpenShift Enterprise 1.2.2 are advised to upgrade to these updated packages, which resolve this issue.

Topics%20covered

Topics Covered

security advisory Red Hat ruby update OpenShift SSL spoofing

References

https://access.redhat.com/security/cve/CVE-2013-4073 https://access.redhat.com/security/updates/classification/#moderate https://www.ruby-lang.org/en/news/2013/06/27/hostname-check-bypassing-vulnerability-in-openssl-client-cve-2013-4073/

Package List

RHOSE Infrastructure 2.1:
Source:
noarch: ruby193-ruby-irb-1.9.3.448-38.el6.noarch.rpm ruby193-rubygem-rake-0.9.2.2-38.el6.noarch.rpm ruby193-rubygems-1.8.23-38.el6.noarch.rpm ruby193-rubygems-devel-1.8.23-38.el6.noarch.rpm
x86_64: ruby193-ruby-1.9.3.448-38.el6.x86_64.rpm ruby193-ruby-debuginfo-1.9.3.448-38.el6.x86_64.rpm ruby193-ruby-devel-1.9.3.448-38.el6.x86_64.rpm ruby193-ruby-doc-1.9.3.448-38.el6.x86_64.rpm ruby193-ruby-libs-1.9.3.448-38.el6.x86_64.rpm ruby193-ruby-tcltk-1.9.3.448-38.el6.x86_64.rpm ruby193-rubygem-bigdecimal-1.1.0-38.el6.x86_64.rpm ruby193-rubygem-io-console-0.3-38.el6.x86_64.rpm ruby193-rubygem-json-1.5.5-38.el6.x86_64.rpm ruby193-rubygem-rdoc-3.9.5-38.el6.x86_64.rpm
RHOSE Node 1.2:
Source:
noarch: ruby193-ruby-irb-1.9.3.448-38.el6.noarch.rpm ruby193-rubygem-rake-0.9.2.2-38.el6.noarch.rpm ruby193-rubygems-1.8.23-38.el6.noarch.rpm ruby193-rubygems-devel-1.8.23-38.el6.noarch.rpm
x86_64: ruby193-ruby-1.9.3.448-38.el6.x86_64.rpm ruby193-ruby-debuginfo-1.9.3.448-38.el6.x86_64.rpm ruby193-ruby-devel-1.9.3.448-38.el6.x86_64.rpm ruby193-ruby-doc-1.9.3.448-38.el6.x86_64.rpm ruby193-ruby-libs-1.9.3.448-38.el6.x86_64.rpm ruby193-ruby-tcltk-1.9.3.448-38.el6.x86_64.rpm ruby193-rubygem-bigdecimal-1.1.0-38.el6.x86_64.rpm

Read the Full Advisory


Advisory ID: RHSA-2013:1137-01
Product: Red Hat OpenShift Enterprise
Advisory URL: https://access.redhat.com/errata/RHSA-2013:1137.html
Issue date: 2013-08-05

Topic

Updated ruby193-ruby packages that fix one security issue are now availablefor Red Hat OpenShift Enterprise 1.2.2.The Red Hat Security Response Team has rated this update as having moderatesecurity impact. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available from the CVE link inthe References section.

Topics%20covered

Topics Covered

security advisory Red Hat ruby update OpenShift SSL spoofing

Relevant Releases Architectures

RHOSE Infrastructure 2.1 - noarch, x86_64

RHOSE Node 1.2 - noarch, x86_64

Bugs Fixed

979251 - CVE-2013-4073 ruby: hostname check bypassing vulnerability in SSL client

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.