RHSA-2013:0220 - Security Advisory

Topic

Red Hat OpenShift Enterprise 1.1 is now available.

The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

Description

Red Hat OpenShift Enterprise is a cloud computing Platform-as-a-Service
(PaaS) solution designed for on-premise or private cloud deployments.

Refer to the Red Hat OpenShift Enterprise 1.1 Release Notes for information
about the changes in this release. The Release Notes will be available
shortly from https://access.redhat.com/knowledge/docs/

This update also fixes the following security issues:

It was found that the master cryptographic key of Jenkins could be
retrieved via the HTTP server that is hosting Jenkins. A remote attacker
could use this flaw to access the server and execute arbitrary code with
the privileges of the user running Jenkins. Note that this issue only
affected Jenkins instances that had slaves attached and that also allowed
anonymous read access (not the default configuration). Manual action is
also required to correct this issue. Refer to "Jenkins Security Advisory
2013-01-04", linked to in the References, for further information.
(CVE-2013-0158)

When the rhc-chk script was run in debug mode, its output included
sensitive information, such as database passwords, in plain text. As this
script is commonly used when troubleshooting, this flaw could lead to users
unintentionally exposing sensitive information in support channels (for
example, a Bugzilla report). This update removes the rhc-chk script.
(CVE-2012-5658)

Multiple flaws in the Jenkins web interface could allow a remote attacker
to perform HTTP response splitting and cross-site scripting (XSS) attacks,
as well as redirecting a victim to an arbitrary page by utilizing an open
redirect flaw. (CVE-2012-6072, CVE-2012-6074, CVE-2012-6073)

A flaw was found in the way rubygem-activerecord dynamic finders extracted
options from method parameters. A remote attacker could possibly use this
flaw to perform SQL injection attacks against applications using the Active
Record dynamic finder methods. (CVE-2012-6496)

The openshift-port-proxy-cfg program created a temporary file in an
insecure way. A local attacker could use this flaw to perform a symbolic
link attack, overwriting an arbitrary file accessible to the root user with
a "0" or a "1", which could lead to a denial of service. By default,
OpenShift uses polyinstantiation (per user) for the /tmp/ directory,
minimizing the risk of exploitation by local attackers. (CVE-2013-0164)

The CVE-2013-0164 issue was discovered by Michael Scherer of the Red Hat
Regional IT team.

Users of Red Hat OpenShift Enterprise 1.0 are advised to upgrade to Red Hat
OpenShift Enterprise 1.1.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• Red Hat OpenShift Enterprise Infrastructure 1 x86_64
• Red Hat OpenShift Enterprise Application Node 1 x86_64
• Red Hat OpenShift Enterprise Client Tools 1 x86_64

Fixes

• BZ - 855264 - Can't "rhc app tail" ruby app error_log file when the server's timezone is not EST.
• BZ - 864921 - Exception is seen upon creating domain when no cartridge is installed in node.
• BZ - 872415 - No config setting for default gear capabilities for a new user
• BZ - 873765 - typo in description of man page for oo-admin-ctl-app
• BZ - 873768 - description of man page for oo-admin-ctl-template
• BZ - 874511 - [Installation]"error while loading shared libraries: libruby.so.1.9" is seen in the file /etc/httpd/logs/error_log
• BZ - 874750 - man page for oo-accept-broker defines '-d' for two different options
• BZ - 874751 - man page for oo-accept-broker does not provide acceptable options for auth, storage, and dns switches
• BZ - 874757 - oo-accept-broker usage statement does not match man page options
• BZ - 874799 - oo-admin-chk '-h' option ignored
• BZ - 874845 - oo-admin-ctl-app accepts garbage for a command and returns success.
• BZ - 875657 - [US3036]Some format errors in the prompt message when executing "oo-admin-ctl" and "oo-accept-*"
• BZ - 876324 - httpd ssl.conf and node conf should not intercept requests meant for the broker
• BZ - 876465 - Embedding scalable app (php) with jenkins fails to create a new builder (only via web)
• BZ - 876644 - oo-register-dns is hardcoded to add entries to a BIND server at 127.0.0.1
• BZ - 876937 - Return "FAILED" if trying to stop openshift-console which is already stopped
• BZ - 876939 - Return "FAILED" if trying to stop openshift-port-proxy which is already stopped
• BZ - 877158 - No "log out" button exists for the web console when using basic auth
• BZ - 877407 - [Cartridge] "Node execution failure" when creating app by --enable-jenkins
• BZ - 883527 - Remove oo-setup-bind
• BZ - 885587 - Jenkins server isn't created using option --enable-jenkins without jenkins server name speicified if commander version is 4.0.3
• BZ - 885598 - [client]Should add split charater between each alias-name when execute "rhc domain show" in ruby-1. 8 environment
• BZ - 886159 - Changing the local console port from 3128 to 8118
• BZ - 888043 - Replica set variables in broker.conf not being utilized correctly
• BZ - 888056 - production.rb should not be marked as a conf file
• BZ - 888671 - [Installation]oo-accept-broker or oo-accept-systems will create production.log, the file's permission is wrong.
• BZ - 889062 - CVE-2012-5658 OpenShift Origin: rhc-chk.rb password exposure in log files
• BZ - 889088 - Prompt error message when restore the app
• BZ - 889095 - Database password not printed out when adding db cartridge to applications
• BZ - 889125 - Should remove rhc-chk in rhc client of Enterprise
• BZ - 889649 - CVE-2012-6496 rubygem-activerecord: find_by_* SQL Injection
• BZ - 890607 - CVE-2012-6072 Jenkins: HTTP response splitting
• BZ - 890608 - CVE-2012-6073 Jenkins: open redirect
• BZ - 890612 - CVE-2012-6074 Jenkins: cross-site scripting vulnerability
• BZ - 892781 - Race condition adding multiple SSH keys to gears
• BZ - 892795 - CVE-2013-0158 jenkins: remote unauthenticated retrieval of master cryptographic key (Jenkins Security Advisory 2013-01-04)
• BZ - 892990 - The server address should not be "localhost" on user account info page
• BZ - 893288 - [Console] We should tell them the actual cloud domain they get, not rhcloud.com
• BZ - 893307 - CVE-2013-0164 openshift-origin-port-proxy: openshift-port-proxy-cfg lockwrap() tmp file creation
• BZ - 893895 - "File a bug" link should be Openshift Enterprise
• BZ - 896406 - [Installation]Some warning message when install "rubygem-openshift-origin-node" pacakge.

CVEs

• CVE-2012-6496
• CVE-2012-5658
• CVE-2013-0158
• CVE-2013-0164
• CVE-2012-6073
• CVE-2012-6072
• CVE-2012-6074

References

• https://access.redhat.com/security/updates/classification/#important
• https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-01-04
• https://access.redhat.com/knowledge/docs/