9.3 - RHSA-2017:1244

Problem Description:

Updated atomic-openshift-utils and openshift-ansible packages that fix two security issues and several bugs are now available for OpenShift Container Platform 3.5, 3.4, 3.3, and 3.2.

2. Relevant releases/architectures:

Red Hat OpenShift Container Platform 3.2 - noarch Red Hat OpenShift Container Platform 3.3 - noarch Red Hat OpenShift Container Platform 3.4 - noarch Red Hat OpenShift Container Platform 3.5 - noarch

3. Description:

Red Hat OpenShift Container Platform is the company's cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments.

Ansible is a SSH-based configuration management, deployment, and task execution system. The openshift-ansible packages contain Ansible code and playbooks for installing and upgrading OpenShift Container Platform 3.

Security Fix(es):

* An input validation vulnerability was found in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible, and the ability to send facts back to the Ansible server, could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges. (CVE-2017-7466)

* Ansible fails to properly mark lookup() results as unsafe, if an attacker can control the results of lookup() calls they can inject unicode strings which may then be parsed by the jinja2 templating system resulting in code execution. (CVE-2017-7481)

This update also fixes the following bugs:

* The installer could fail to add iptables rules if other iptables rules were being updated at the same time. This bug fix updates the installer to wait to obtain a lock when updating iptables rules, ensuring that rules are properly created. (BZ#1445194, BZ#1445282)

* In multi-master environments, if `ansible_host` and `openshift_hostname` values differ and Ansible sorts one of the lists differently from the other, then the CA host may be the first master but it was still signing the initial certificates with the host names of the first master. By ensuring that the host names of the CA host are used when creating the certificate authority, this bug fix ensures that the certificates are signed with the correct host names. (BZ#1447399, BZ#1440309, BZ#1447398)

* Running Ansible via `batch` systems like the `nohup` command caused Ansible to leak file descriptors and abort playbooks whenever the maximum number of open file descriptors was reached. Ansible 2.2.3.0 includes a fix for this problem, and OCP channels have been updated to include this version. (BZ#1439277)

* The OCP 3.4 logging stack upgraded the schema to use the common standard logging data model. However, some of the Elasticsearch and Kibana configuration to use this schema was missing. This caused Kibana to show an error message upon startup. This bug fix adds the correct Elasticsearch and Kibana configuration to the logging stack, including during upgrade from OCP 3.3 to 3.4, and from 3.4.x to 3.4.y. As a result, Kibana works correctly with the new logging data schema. (BZ#1444106)

* Because the upgrade playbooks upgraded packages in a serial manner rather than all at once, yum dependency resolution would have installed the latest version available in the enabled repositories rather than the requested version. This bug fix updates the playbooks to upgrade all packages to the requested version at once, which prevents yum from potentially upgrading to the latest version. (BZ#1391325, BZ#1449220, BZ#1449221)

* In an environment utilizing mixed containerized and RPM based installation methods, the installer would fail to gather facts when a master and node used different installation methods. This bug fix updates the installer to ensure mixed installations work properly. (BZ#1408663)

* Previously, if `enable_excluders=false` was set the playbooks would still install and upgrade the excluders during the config.yml playbook even if the excluders were never previously installed. With this bug fix, if the excluders were not previously installed, the playbooks will avoid installing them. (BZ#1434679)

* Previously, the playbooks would abort if a namespace had non-ASCII characters in their descriptions. This bug fix updates the playbooks to properly decode unicode characters ensuring that upgrades to OCP 3.5 work as expected. (BZ#1444806)

All OpenShift Container Platform users are advised to upgrade to these updated packages.

4. Solution:

Before applying this update, make sure all previously released errata relevant to your system have been applied.

To apply this update, run the following on all hosts where you intend to initiate Ansible-based installation or upgrade procedures:

# yum update atomic-openshift-utils

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1391325 - [3.5] openshift_pkg_version doesn't seem to work 1408663 - [3.4] facts collection for openshift.common.admin_binary does not seem to work in mixed environments 1418032 - [3.2] Update router and registry certificates in the redeploy-certificates.yml 1422541 - [3.5] [quick installer]Installer get stuck at "Gathering information from hosts..." if bad hostname checked 1434679 - [3.5] openshift-ansible should do nothing to existed excluders when set "enable_excluders=false" 1439212 - CVE-2017-7466 ansible: Arbitrary code execution on control node (incomplete fix for CVE-2016-9587) 1439277 - Ansible Install is unable to complete install due to module losing issues. 1440309 - [3.4] Post-install, master certs signed for wrong name 1444106 - [3.4 Backport] openshift users encountered confirmation "Apply these filters?" when switching between index list populated in the left panel on kibana 1444806 - [3.5] Unable to run upgrade playbook 1445194 - [3.4] Installer fails to add/check iptables rule due to lock on xtables 1445282 - [3.3] Installer fails to add/check iptables rule due to lock on xtables 1446741 - [3.4] Redeploy certificates fails with custom openshift_hosted_router_certificate 1446745 - [3.3] Redeploy certificates fails with custom openshift_hosted_router_certificate 1447398 - [3.3] Post-install, master certs signed for wrong name 1447399 - [3.5] Post-install, master certs signed for wrong name 1448842 - Installing Openshift Container Platform 3.5 returns an error on Play 11/28 (Disable excluders) 1449220 - [3.4] openshift_pkg_version doesn't seem to work 1449221 - [3.3] openshift_pkg_version doesn't seem to work 1450018 - CVE-2017-7481 ansible: Security issue with lookup return not tainting the jinja2 environment 1450412 - [3.4] Installing containerized using the 3.4 playbooks may install other versions 1450415 - [3.3] Installing containerized using the 3.3 playbooks may install other versions