Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 542
Alerts This Week
Warning Icon 1 542

Red Hat OpenShift 3.7 RHSA-2018-1231-01 Critical Path Issue

red hat
Calendar Grey April 29, 2018
Scroller Redhat
Urgent security patch released for Red Hat OpenShift Container Platform 3.7 tackling CVE-2018-1102 along with multiple bug fixes.
An update is now available for Red Hat OpenShift Container Platform 3.7

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

Red Hat OpenShift Container Platform is the company's cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments.
This advisory contains RPM packages for this release. See the following advisory for the container images for this release:
https://access.redhat.com/errata/RHBA-2018:1230
Security Fix(es):
* source-to-image: Improper path sanitization in ExtractTarStreamFromTarReader in tar/tar.go (CVE-2018-1102)
This update also fixes the following bugs:
* Fluentd inserts documents (logs) into Elasticsearch using the bulk insert API, but relies upon Elasticsearch to generate UUIDs for each document. It does not remove successfully indexed documents from the bulk payload when the bulk operation fails. This caused the initial payload to be resubmitted and documents that were successfully indexed to be submitted again, which results in duplicate documents with different UUIDs. This bug fix ensures that document IDs are generated before submitting bulk insert requests. As a result, Elasticsearch will disregard the insertion of documents that already exist in the data store and insert documents that do not. (BZ#1556896)
* A user can set a host name to `localhost`, which confuses the router check to see if the reload completed. This caused the reload to never return success, causing the router to fail. This bug fix changes the health check so that it does not pass the host name `localhost`. As a result, routers can now reload successfully. (BZ#1548102)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Topics%20covered

Topics Covered

security advisory Red Hat update critical path sanitization OpenShift CVE-2018-1102

References

https://access.redhat.com/security/cve/CVE-2018-1102 https://access.redhat.com/security/updates/classification#critical

Package List

Red Hat OpenShift Container Platform 3.7:
Source: apb-1.0.6-1.el7.src.rpm atomic-openshift-3.7.44-1.git.0.6b061d4.el7.src.rpm rubygem-fluent-plugin-elasticsearch-1.14.0-1.el7.src.rpm
noarch: apb-1.0.6-1.el7.noarch.rpm apb-container-scripts-1.0.6-1.el7.noarch.rpm atomic-openshift-docker-excluder-3.7.44-1.git.0.6b061d4.el7.noarch.rpm atomic-openshift-excluder-3.7.44-1.git.0.6b061d4.el7.noarch.rpm rubygem-fluent-plugin-elasticsearch-1.14.0-1.el7.noarch.rpm rubygem-fluent-plugin-elasticsearch-doc-1.14.0-1.el7.noarch.rpm
x86_64: atomic-openshift-3.7.44-1.git.0.6b061d4.el7.x86_64.rpm atomic-openshift-clients-3.7.44-1.git.0.6b061d4.el7.x86_64.rpm atomic-openshift-clients-redistributable-3.7.44-1.git.0.6b061d4.el7.x86_64.rpm atomic-openshift-cluster-capacity-3.7.44-1.git.0.6b061d4.el7.x86_64.rpm atomic-openshift-dockerregistry-3.7.44-1.git.0.6b061d4.el7.x86_64.rpm atomic-openshift-federation-services-3.7.44-1.git.0.6b061d4.el7.x86_64.rpm atomic-openshift-master-3.7.44-1.git.0.6b061d4.el7.x86_64.rpm atomic-openshift-node-3.7.44-1.git.0.6b061d4.el7.x86_64.rpm atomic-openshift-pod-3.7.44-1.git.0.6b061d4.el7.x86_64.rpm atomic-openshift-sdn-ovs-3.7.44-1.git.0.6b061d4.el7.x86_64.rpm atomic-openshift-service-catalog-3.7.44-1.git.0.6b061d4.el7.x86_64.rpm

Read the Full Advisory


Severity
critical
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2018:1231-01
Product: Red Hat OpenShift Enterprise
Advisory URL: https://access.redhat.com/errata/RHSA-2018:1231
Issue date: 2018-04-29

Topic

An update is now available for Red Hat OpenShift Container Platform 3.7.Red Hat Product Security has rated this update as having a security impactof Critical. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory Red Hat update critical path sanitization OpenShift CVE-2018-1102

Relevant Releases Architectures

Red Hat OpenShift Container Platform 3.7 - noarch, x86_64

Bugs Fixed

1505684 - The kibana should use cluster_public_hostname when openshift_logging_master_public_url is not set

1548102 - [3.7] A route with host 'localhost' can freeze router reloads under some circumstances

1553707 - run.sh is missing in curator image

1554865 - [3.7] subpath volume mounts do not work with secret, configmap, projected, or downwardAPI volumes

1556782 - [3.7] Mounting file in a subpath fails if file was created in initContainer

1556896 - Duplicate elasticsearch entries increase as namespaces increase (constant message rate)

1557492 - Task "Wait for master to restart" will break upgrade/install if working through bastion

1559225 - OpenShift installer upgrade playbook doesn't apply latest rpm packages when a git version change

1559671 - [3.7] Fail to update EFK: 'namespace'

1560430 - [CNS][3.7] Installation failed with glusterfs_heketi_route undefined error when enable openshift_storage_glusterfs_registry_block_storageclass with glusterfs_registry group

1562246 - CVE-2018-1102 source-to-image: Improper path sanitization in ExtractTarStreamFromTarReader in tar/tar.go

1562966 - Fresh OCP 3.7 on AWS install fails with "msg": "file not found: /etc/origin/logging/ca.crl.srl"

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.