- Issued:
- 2012-12-10
- Updated:
- 2012-12-10
RHSA-2012:1555 - Security Advisory
Synopsis
Important: openshift-console security update
Type/Severity
Security Advisory: Important
Red Hat Insights patch analysis
Identify and remediate systems affected by this advisory.
Topic
An updated openshift-console package that fixes one security issue is now
available for OpenShift Enterprise.
The Red Hat Security Response Team has rated this update as having
important security impact. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available from the
CVE link in the References section.
Description
The OpenShift Management Console provides a web interface for managing
OpenShift Enterprise.
It was found that the OpenShift Management Console did not protect against
Cross-Site Request Forgery (CSRF) attacks. If a remote attacker could trick
a user, who was logged into the OpenShift Management Console, into visiting
an attacker controlled web page, the attacker could make changes to
applications hosted within OpenShift Enterprise with the privileges of the
victim which may lead to arbitrary code execution in the OpenShift Enterprise
hosted applications. (CVE-2012-5622)
This issue was discovered by Red Hat.
All users of the OpenShift Management Console are advised to upgrade to
this updated package, which corrects this issue. Before installing the
updated package, stop the openshift-console service. After the package has
been installed, start the openshift-console service.
Solution
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Affected Products
- Red Hat OpenShift Enterprise Infrastructure 1 x86_64
Fixes
- BZ - 883227 - CVE-2012-5622 OpenShift-Enterprise: openshift-console CSRF attack
CVEs
Red Hat OpenShift Enterprise Infrastructure 1
SRPM | |
---|---|
openshift-console-0.0.5-3.el6.src.rpm | SHA-256: 1a1416e34f1029242b4e2600ae254e691b56eaa5e4734c0f3e0cc54969010112 |
x86_64 | |
openshift-console-0.0.5-3.el6.noarch.rpm | SHA-256: 4b40b0ac9be76224124d4867fe6d6e15cd7259cbc1a88fac3ae55761a0d56b88 |
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.