Red Hat OpenShift 3.5 RHSA-2017-1244 Important Security Fixes

Red Hat OpenShift Container Platform is the company's cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments.
Ansible is a SSH-based configuration management, deployment, and task execution system. The openshift-ansible packages contain Ansible code and playbooks for installing and upgrading OpenShift Container Platform 3.
Security Fix(es):
* An input validation vulnerability was found in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible, and the ability to send facts back to the Ansible server, could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges. (CVE-2017-7466)
* Ansible fails to properly mark lookup() results as unsafe, if an attacker can control the results of lookup() calls they can inject unicode strings which may then be parsed by the jinja2 templating system resulting in code execution. (CVE-2017-7481)
This update also fixes the following bugs:
* The installer could fail to add iptables rules if other iptables rules were being updated at the same time. This bug fix updates the installer to wait to obtain a lock when updating iptables rules, ensuring that rules are properly created. (BZ#1445194, BZ#1445282)
* In multi-master environments, if `ansible_host` and `openshift_hostname` values differ and Ansible sorts one of the lists differently from the other, then the CA host may be the first master but it was still signing the initial certificates with the host names of the first master. By ensuring that the host names of the CA host are used when creating the certificate authority, this bug fix ensures that the certificates are signed with the correct host names. (BZ#1447399, BZ#1440309, BZ#1447398)
* Running Ansible via `batch` systems like the `nohup` command caused Ansible to leak file descriptors and abort playbooks whenever the maximum number of open file descriptors was reached. Ansible 2.2.3.0 includes a fix for this problem, and OCP channels have been updated to include this version. (BZ#1439277)
* The OCP 3.4 logging stack upgraded the schema to use the common standard logging data model. However, some of the Elasticsearch and Kibana configuration to use this schema was missing. This caused Kibana to show an error message upon startup. This bug fix adds the correct Elasticsearch and Kibana configuration to the logging stack, including during upgrade from OCP 3.3 to 3.4, and from 3.4.x to 3.4.y. As a result, Kibana works correctly with the new logging data schema. (BZ#1444106)
* Because the upgrade playbooks upgraded packages in a serial manner rather than all at once, yum dependency resolution would have installed the latest version available in the enabled repositories rather than the requested version. This bug fix updates the playbooks to upgrade all packages to the requested version at once, which prevents yum from potentially upgrading to the latest version. (BZ#1391325, BZ#1449220, BZ#1449221)
* In an environment utilizing mixed containerized and RPM based installation methods, the installer would fail to gather facts when a master and node used different installation methods. This bug fix updates the installer to ensure mixed installations work properly. (BZ#1408663)
* Previously, if `enable_excluders=false` was set the playbooks would still install and upgrade the excluders during the config.yml playbook even if the excluders were never previously installed. With this bug fix, if the excluders were not previously installed, the playbooks will avoid installing them. (BZ#1434679)
* Previously, the playbooks would abort if a namespace had non-ASCII characters in their descriptions. This bug fix updates the playbooks to properly decode unicode characters ensuring that upgrades to OCP 3.5 work as expected. (BZ#1444806)
All OpenShift Container Platform users are advised to upgrade to these updated packages.