Stay Secure with the Latest Linux Advisories

security advisoryred hatimportant update

OpenShift Enterprise RHSA-2012:1555-01 Critical CSRF Security Update

An updated openshift-console package that fixes one security issue is now available for OpenShift Enterprise. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS). -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Important: openshift-console security update Advisory ID: RHSA-2012:1555-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2012:1555.html Issue date: 2012-12-10 CVE Names: CVE-2012-5622 ==================================================================== 1. Summary: An updated openshift-console package that fixes one security issue is now available for OpenShift Enterprise. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: RedHat OpenShift Enterprise Infrastructure - noarch 3. Description: The OpenShift Management Console provides a web interface for managing OpenShift Enterprise. It was found that the OpenShift Management Console did not protect against Cross-Site Request Forgery (CSRF) attacks. If a remote attacker could trick a user, who was logged into the OpenShift Management Console, into visiting an attacker controlled web page, the attacker could make changes to applications hosted within OpenShift Enterprise with the privileges of the victim which may lead to arbitrary code execution in the OpenShift Enterprise hosted applications. (CVE-2012-5622) This issue was discovered by Red Hat. All users of the OpenShift Management Console are advised to upgrade to this updated package, which corrects this issue. Before installing the updated package, stop theopenshift-console service. After the package has been installed, start the openshift-console service. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 5. Bugs fixed (http://bugzilla.redhat.com/): 883227 - CVE-2012-5622 OpenShift-Enterprise: openshift-console CSRF attack 6. Package List: RedHat OpenShift Enterprise Infrastructure: Source: noarch: openshift-console-0.0.5-3.el6.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://access.redhat.com/security/cve/CVE-2012-5622 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2012 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFQxk7lXlSAg2UNWIIRAo/wAKCJYt+EDRH/PsMxTj0ENJLK0DS2NgCeIVbp MS44+5biCgUr4NuSG2AJFUg=g1f3 -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . A vital security patch for OpenShift Dashboard tackles severe CSRF vulnerabilities affecting user services. Update immediately.. OpenShift Console, CSRF Attack Fix, Red Hat Security Advisory, Important Update. . Severity: Important. LinuxSecurity.com Team

Dec 10, 2012 •Important Red Hat