RedHat: RHSA-2016-1095:01 Moderate: Red Hat OpenShift Enterprise 3.1
Summary
OpenShift Enterprise by Red Hat is the company's cloud computing
Platform-as-a-Service (PaaS) solution designed for on-premise or private
cloud deployments.
Security Fix(es):
* An origin validation vulnerability was found in OpenShift Enterprise. An
attacker could potentially access API credentials stored in a web browser's
localStorage if anonymous access was granted to a service/proxy or
pod/proxy API for a specific pod, and an authorized access_token was
provided in the query parameter. (CVE-2016-3703)
This issue was discovered by Jordan Liggitt (Red Hat).
This update includes the following images:
openshift3/ose:v3.1.1.6-21
openshift3/ose-deployer:v3.1.1.6-20
openshift3/ose-docker-builder:v3.1.1.6-19
openshift3/ose-docker-registry:v3.1.1.6-9
openshift3/ose-f5-router:v3.1.1.6-20
openshift3/ose-haproxy-router:v3.1.1.6-9
openshift3/ose-keepalived-ipfailover:v3.1.1.6-9
openshift3/ose-pod:v3.1.1.6-9
openshift3/ose-recycler:v3.1.1.6-9
openshift3/ose-sti-builder:v3.1.1.6-19
openshift3/logging-auth-proxy:3.1.1-9
openshift3/logging-deployment:3.1.1-17
openshift3/logging-elasticsearch:3.1.1-11
openshift3/logging-fluentd:3.1.1-11
openshift3/logging-kibana:3.1.1-8
openshift3/metrics-deployer:3.1.1-7
openshift3/metrics-heapster:3.1.1-7
openshift3/node:v3.1.1.6-20
openshift3/openvswitch:v3.1.1.6-10
Summary
Solution
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
References
https://access.redhat.com/security/cve/CVE-2016-3703 https://access.redhat.com/security/updates/classification/#moderate
Package List
Red Hat OpenShift Enterprise 3.1:
Source:
atomic-openshift-3.1.1.6-8.git.64.80b61da.el7aos.src.rpm
x86_64:
atomic-openshift-3.1.1.6-8.git.64.80b61da.el7aos.x86_64.rpm
atomic-openshift-clients-3.1.1.6-8.git.64.80b61da.el7aos.x86_64.rpm
atomic-openshift-clients-redistributable-3.1.1.6-8.git.64.80b61da.el7aos.x86_64.rpm
atomic-openshift-dockerregistry-3.1.1.6-8.git.64.80b61da.el7aos.x86_64.rpm
atomic-openshift-master-3.1.1.6-8.git.64.80b61da.el7aos.x86_64.rpm
atomic-openshift-node-3.1.1.6-8.git.64.80b61da.el7aos.x86_64.rpm
atomic-openshift-pod-3.1.1.6-8.git.64.80b61da.el7aos.x86_64.rpm
atomic-openshift-recycle-3.1.1.6-8.git.64.80b61da.el7aos.x86_64.rpm
atomic-openshift-sdn-ovs-3.1.1.6-8.git.64.80b61da.el7aos.x86_64.rpm
tuned-profiles-atomic-openshift-node-3.1.1.6-8.git.64.80b61da.el7aos.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
Topic
An update for atomic-openshift is now available for Red Hat OpenShiftEnterprise 3.1. In addition, all images have been rebuilt on the new RHEL7.2.4 base image.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.
Topic
Relevant Releases Architectures
Red Hat OpenShift Enterprise 3.1 - x86_64
Bugs Fixed
1330233 - CVE-2016-3703 OpenShift Enterprise 3: Untrusted content loaded via the API proxy can access web console credentials on the same domain