RHSA-2015:2666 - Security Advisory

Topic

Red Hat OpenShift Enterprise release 2.2.8, which fixes one security
issue, several bugs, and introduces feature enhancements, is now
available.

Red Hat Product Security has rated this update as having Important
security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

Description

OpenShift Enterprise by Red Hat is the company's cloud computing
Platform-as-a-Service (PaaS) solution designed for on-premise or
private cloud deployments.

The following security issue is addressed with this release:

An implementation error related to the memory management of request
and responses was found within HAProxy's buffer_slow_realign()
function. An unauthenticated remote attacker could use this flaw
to leak certain memory buffer contents from a past request or
session. (CVE-2015-3281)

Space precludes documenting all of the bug fixes in this advisory. See
the OpenShift Enterprise Technical Notes, which will be updated
shortly for release 2.2.8, for details about these changes:

https://access.redhat.com/documentation/en-US/OpenShift_Enterprise/2/html-single/Technical_Notes/index.html

All OpenShift Enterprise 2 users are advised to upgrade to these updated
packages.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

See the OpenShift Enterprise 2.2 Release Notes, which will be updated
shortly for release 2.2.8, for important instructions on how to fully
apply this asynchronous errata update:

https://access.redhat.com/documentation/en-US/OpenShift_Enterprise/2/html-single/2.2_Release_Notes/index.html#chap-Asynchronous_Errata_Updates

This update is available via the Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at:
https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenShift Enterprise Infrastructure 2.2 x86_64
• Red Hat OpenShift Enterprise Application Node 2.2 x86_64
• Red Hat OpenShift Enterprise Client Tools 2.2 x86_64
• Red Hat OpenShift Enterprise JBoss EAP add-on 2.2 x86_64

Fixes

• BZ - 1045226 - oo-auto-idler man page incorrect
• BZ - 1054441 - oo-accept-node should test that BROKER_HOST is consistent
• BZ - 1064039 - RFE oo-diagnostics should report when node auth is failing (401 Unauthorized)
• BZ - 1101973 - oo-diagnostics tools is checking a non-existing dir after update ose-2.0 GA to ose-2.0.z puddle + RHSCL-1.1
• BZ - 1110415 - `oo-admin-broker-cache --clear --console` does not warn that --console flag does nothing
• BZ - 1111501 - REPORT_BUILD_ANALYTICS should be set to false by default
• BZ - 1111598 - oo-admin-chk gives bad advice to users when gears do not exist on the node.
• BZ - 1139608 - rhc snapshot save different app with the same name in the same dir didn't prompt conflict information
• BZ - 1140766 - oo-admin-ctl-district doesn't suggest FQDN for -i in -h output
• BZ - 1155003 - Should prompt correct and important parameter information when use none or error parameter in "rhc server add" command
• BZ - 1177753 - Enable a configuration in rhc to use a different ssh executable
• BZ - 1211526 - HAProxy does not restart when pid is not found
• BZ - 1218872 - rhc setup fail during upload sshkey
• BZ - 1238305 - [RFE] gear-placement plugin domain_id as input data
• BZ - 1239072 - CVE-2015-3281 haproxy: information leak in buffer_slow_realign()
• BZ - 1241675 - [RFE] Check for missing openshift_application_aliases components f5-icontrol-rest.rb
• BZ - 1248439 - Routing SPI for Nginx doesn't preserve host in http request's headers
• BZ - 1255426 - API Call to disable HA does not remove 2nd haproxy head gear
• BZ - 1264722 - oo-register-dns shows erros with any option
• BZ - 1265609 - pandas not getting installed
• BZ - 1268080 - ChangeMembersDomainOp are not cleared by oo-admin-clear-pending-ops
• BZ - 1270660 - Haproxy health check should be in sync with rolling updates in EWS
• BZ - 1271338 - oo-restorecon -v -a does not add selinux MCS labels to files under hidden directory
• BZ - 1272195 - oo-admin-ctl-app -c remove-gear , ignores min scale setting
• BZ - 1277695 - hostname regex fails in update-cluster in some locales
• BZ - 1280438 - haproxy_ctld error on a close-to-quota gear
• BZ - 1282520 - Routing-daemon does not create the openshift_application_aliases policy
• BZ - 1282940 - Exception log output when using rhc app ssh "--ssh option" with exist directory

CVEs

• CVE-2015-3281

References

• https://access.redhat.com/security/updates/classification/#important