Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title Red Hat OpenShift Enterprise 2.2.9 security, bug fix, and enhancement update
Informations
Name RHSA-2016:0489 First vendor Publication 2016-03-22
Vendor RedHat Last vendor Modification 2016-03-22
Severity (Vendor) N/A Revision 01

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:H/Au:N/C:C/I:C/A:C)
Cvss Base Score 7.6 Attack Range Network
Cvss Impact Score 10 Attack Complexity High
Cvss Expoit Score 4.9 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

Red Hat OpenShift Enterprise release 2.2.9, which fixes several security issues, several bugs, and introduces feature enhancements, is now available.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

2. Relevant releases/architectures:

Red Hat OpenShift Enterprise Client 2.2 - noarch Red Hat OpenShift Enterprise Infrastructure 2.2 - noarch, x86_64 Red Hat OpenShift Enterprise Node 2.2 - noarch, x86_64

3. Description:

OpenShift Enterprise by Red Hat is the company's cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments.

The following security issue is addressed with this release:

It was found that ActiveMQ did not safely handle user supplied data when deserializing objects. A remote attacker could use this flaw to execute arbitrary code with the permissions of the ActiveMQ application. (CVE-2015-5254)

An update for Jenkins Continuous Integration Server that addresses a large number of security issues including XSS, CSRF, information disclosure and code execution have been addressed as well. (CVE-2015-5317, CVE-2015-5318, CVE-2015-5319, CVE-2015-5320, CVE-2015-5321, CVE-2015-5322, CVE-2015-5323, CVE-2015-5324, CVE-2015-5325, CVE-2015-5326, CVE-2015-7537, CVE-2015-7538, CVE-2015-7539, CVE-2015-8103)

Space precludes documenting all of the bug fixes in this advisory. See the OpenShift Enterprise Technical Notes, which will be updated shortly for release 2.2.9, for details about these changes:

https://access.redhat.com/documentation/en-US/OpenShift_Enterprise/2/html-s ingle/Technical_Notes/index.html

All OpenShift Enterprise 2 users are advised to upgrade to these updated packages.

4. Solution:

Before applying this update, make sure all previously released errata relevant to your system have been applied.

See the OpenShift Enterprise 2.2 Release Notes, which will be updated shortly for release 2.2.9, for important instructions on how to fully apply this asynchronous errata update:

https://access.redhat.com/documentation/en-US/OpenShift_Enterprise/2/html-s ingle/2.2_Release_Notes/index.html#chap-Asynchronous_Errata_Updates

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at: https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1111456 - jenkin app will be created as default small gear size when user create app with --enable-jenkins and non-default gear-size 1140816 - oo-admin-ctl-district missing documentation for listing districts 1160934 - "oo-admin-ctl-gears stopgear" failed to stop idled gear 1168480 - Should prompt correct information when execute oo-admin-ctl-user --addgearsize $invalid value 1169690 - Webconsole should show warning info when add cartridge as quota used up to QUOTA_WARNING_PERCENT 1265423 - .gitconfig is not configurable for application create 1265811 - oo-accept-node reports a quota failures when a loop device is used. 1279584 - Users have nil value for resulting in failed oo-admin-repair 1282359 - CVE-2015-5317 jenkins: Project name disclosure via fingerprints (SECURITY-153) 1282361 - CVE-2015-5318 jenkins: Public value used for CSRF protection salt (SECURITY-169) 1282362 - CVE-2015-5319 jenkins: XXE injection into job configurations via CLI (SECURITY-173) 1282363 - CVE-2015-5320 jenkins: Secret key not verified when connecting a slave (SECURITY-184) 1282364 - CVE-2015-5321 jenkins: Information disclosure via sidepanel (SECURITY-192) 1282365 - CVE-2015-5322 jenkins: Local file inclusion vulnerability (SECURITY-195) 1282366 - CVE-2015-5323 jenkins: API tokens of other users available to admins (SECURITY-200) 1282367 - CVE-2015-5324 jenkins: Queue API did show items not visible to the current user (SECURITY-186) 1282368 - CVE-2015-5325 jenkins: JNLP slaves not subject to slave-to-master access control (SECURITY-206) 1282369 - CVE-2015-5326 jenkins: Stored XSS vulnerability in slave offline status message (SECURITY-214) 1282371 - CVE-2015-8103 jenkins: Remote code execution vulnerability due to unsafe deserialization in Jenkins remoting (SECURITY-218) 1283372 - oo-admin-gear man page displays wrong option 1291292 - CVE-2015-5254 activemq: unsafe deserialization 1291795 - CVE-2015-7537 jenkins: CSRF vulnerability in some administrative actions (SECURITY-225) 1291797 - CVE-2015-7538 jenkins: CSRF protection ineffective (SECURITY-233) 1291798 - CVE-2015-7539 jenkins: Jenkins plugin manager vulnerable to MITM attacks (SECURITY-234) 1294513 - oo-diagnostics test_enterprise_rpms fails for nodejs010-nodejs-debug 1299014 - [RFE] Configuration setting to set cipher on Openshift node web proxy 1299095 - oo-diagnostic error on broker No such file or directory - /etc/openshift/env/OPENSHIFT_BROKER_HOST 1302787 - Node web proxy configuration file is overwritten upon update 1305688 - oo-accept-broker incorrectly parses MONGO_HOST_PORT individual host and ports 1307174 - rhc ssh does not respect PATH env variable, nor the --ssh PATH option 1307175 - oo-accept-node does not validate whether threads are in cgroups 1308716 - rhc snapshot save different app with the same name in the same dir didn't prompt conflict information 1308718 - It is better to return meaningful error message when do ssh in head gear of scalable app with incorrect user id or ssh url 1308720 - Unable to deploy Drupal 1308722 - Django quickstart can't bind address 1308739 - It will not validate the deployment type when do app deploy via REST API 1310247 - New configuration item, TRAFFIC_CONTROL_DEVS 1310266 - https using letsencrypt has B rating - chain incomplete 1310841 - Fix zsh autocompletion for rhc 1314535 - oo-admin-repair-node,oo-admin-ctl-iptables-port-proxy and oo-admin-ctl-tc has no man page 1314546 - Python cartridge doesn't stop deploy process when it failed to install packages (It is different from behavior of other cartridges)

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2016-0489.html

CWE : Common Weakness Enumeration

% Id Name
23 % CWE-200 Information Exposure
15 % CWE-352 Cross-Site Request Forgery (CSRF) (CWE/SANS Top 25)
15 % CWE-264 Permissions, Privileges, and Access Controls
8 % CWE-502 Deserialization of Untrusted Data
8 % CWE-345 Insufficient Verification of Data Authenticity
8 % CWE-284 Access Control (Authorization) Issues
8 % CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)
8 % CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE/SANS Top 25)
8 % CWE-20 Improper Input Validation

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 24
Application 656
Application 32
Application 2
Os 2
Os 1

Snort® IPS/IDS

Date Description
2018-05-15 Apache ActiveMQ JMS ObjectMessage deserialization attempt
RuleID : 46304 - Revision : 2 - Type : SERVER-OTHER
2016-03-29 Java Library CommonsCollection unauthorized serialized object attempt
RuleID : 37860 - Revision : 5 - Type : SERVER-WEBAPP
2016-03-29 Java Library CommonsCollection unauthorized serialized object attempt
RuleID : 37859 - Revision : 6 - Type : SERVER-WEBAPP
2016-03-14 Java Library CommonsCollection unauthorized serialized object attempt
RuleID : 36826 - Revision : 11 - Type : SERVER-OTHER

Nessus® Vulnerability Scanner

Date Description
2017-10-18 Name : The remote host is affected by multiple vulnerabilities.
File : oracle_bi_publisher_oct_2017_cpu.nasl - Type : ACT_GATHER_INFO
2016-03-28 Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_a258604df2aa11e5b4a9ac220bdcec59.nasl - Type : ACT_GATHER_INFO
2016-03-22 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-3524.nasl - Type : ACT_GATHER_INFO
2016-03-04 Name : The remote Fedora host is missing a security update.
File : fedora_2015-7ca4368b0c.nasl - Type : ACT_GATHER_INFO
2016-03-04 Name : The remote Fedora host is missing a security update.
File : fedora_2015-89468612f5.nasl - Type : ACT_GATHER_INFO
2016-03-04 Name : The remote Fedora host is missing a security update.
File : fedora_2015-938c70c840.nasl - Type : ACT_GATHER_INFO
2016-03-04 Name : The remote Fedora host is missing one or more security updates.
File : fedora_2015-a433d8ba72.nasl - Type : ACT_GATHER_INFO
2016-03-04 Name : The remote Fedora host is missing one or more security updates.
File : fedora_2015-d02feebd15.nasl - Type : ACT_GATHER_INFO
2016-03-04 Name : The remote Fedora host is missing a security update.
File : fedora_2015-d7e5461dbf.nasl - Type : ACT_GATHER_INFO
2016-03-04 Name : The remote Fedora host is missing a security update.
File : fedora_2015-eefc5a6762.nasl - Type : ACT_GATHER_INFO
2015-12-16 Name : The remote host is running a web application that is affected by a remote cod...
File : activemq_5_13_0.nasl - Type : ACT_GATHER_INFO
2015-12-10 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_23af04259eac11e5b93700e0814cab4e.nasl - Type : ACT_GATHER_INFO
2015-11-17 Name : The remote web server is affected by a remote code execution vulnerability.
File : jenkins_security218.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2016-03-22 21:23:48
  • First insertion