Synopsis

Moderate: openshift security update

Type/Severity

Security Advisory: Moderate

Topic

Updated openshift packages that fix one security issue are now
available for Red Hat OpenShift Enterprise 3.1.

Red Hat Product Security has rated this update as having Moderate security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.

Description

OpenShift Enterprise by Red Hat is the company's cloud computing
Platform-as-a-Service (PaaS) solution designed for on-premise or
private cloud deployments.

An access flaw was discovered in OpenShift; the
/etc/origin/master/master-config.yaml configuration file, which could
contain Active Directory credentials, was world-readable. A local user
could exploit this flaw to obtain authentication credentials from the
master-config.yaml file. (CVE-2016-2142)

If you believe that the password in this file has been viewed by an
attacker you should reset the password after installing this update.

All installations with Active Directory integration are advised to upgrade
to the updated software, which contains a backported patch to correct this
issue.

This update includes the following images:

openshift3/ose:v3.1.1.6-19
openshift3/ose-deployer:v3.1.1.6-18
openshift3/ose-docker-builder:v3.1.1.6-17
openshift3/ose-f5-router:v3.1.1.6-18
openshift3/ose-sti-builder:v3.1.1.6-17
openshift3/node:v3.1.1.6-18
aep3_beta/aep-deployer:v3.1.1.6-18
aep3_beta/aep-f5-router:v3.1.1.6-18
aep3_beta/aep:v3.1.1.6-19
aep3_beta/node:v3.1.1.6-18

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenShift Container Platform 3.1 x86_64

Fixes

• BZ - 1311220 - CVE-2016-2142 openshift: Bind password for AD account is stored in world readable file
• BZ - 1331038 - Pods are stuck in pending state due to failed image pulling

CVEs

• CVE-2016-2142

References

• http://www.redhat.com/security/updates/classification/#normal

Red Hat OpenShift Container Platform 3.1

SRPM
atomic-openshift-3.1.1.6-6.git.43.f583589.el7aos.src.rpm	SHA-256: da8c82f4e798c6c94ecb6f15bfbce64104fe84ff195402bf8cb1f17e0be1aec1
x86_64
atomic-openshift-3.1.1.6-6.git.43.f583589.el7aos.x86_64.rpm	SHA-256: 8d26193b267f655c06d8e6cc2e7620730bf69d599a0e1ba27c04fbc1c44464cc
atomic-openshift-clients-3.1.1.6-6.git.43.f583589.el7aos.x86_64.rpm	SHA-256: 446c98ffebb2a463bde8a533f189139581f65c35e69f83940270fcc50dfb6fe8
atomic-openshift-clients-redistributable-3.1.1.6-6.git.43.f583589.el7aos.x86_64.rpm	SHA-256: 2a9202f681ab2ec8bec378edad0a63546a5166b1cfbf5a16380f1397a7599a70
atomic-openshift-dockerregistry-3.1.1.6-6.git.43.f583589.el7aos.x86_64.rpm	SHA-256: 97cd3cdf7a5a622b2336979129e73ac3cab0f87d9aaa7c45a996d6e8ca0b3e7e
atomic-openshift-master-3.1.1.6-6.git.43.f583589.el7aos.x86_64.rpm	SHA-256: 41cce11257d42f8e9ee1c7da30e843429fb31f8e851e4638767aa01ab533f621
atomic-openshift-node-3.1.1.6-6.git.43.f583589.el7aos.x86_64.rpm	SHA-256: f9f81b70081b19d61c7590731c5aeadedf558cd49ab700ae1cdc6405e6db68ae
atomic-openshift-pod-3.1.1.6-6.git.43.f583589.el7aos.x86_64.rpm	SHA-256: 264f658b1770194885e060fbda56568bb57702641c59050fa7bf710859d1bcf8
atomic-openshift-recycle-3.1.1.6-6.git.43.f583589.el7aos.x86_64.rpm	SHA-256: ef5f62b29bb2ce7718c73da8848ad471c575223d71242f14525469c4f98bcb2f
atomic-openshift-sdn-ovs-3.1.1.6-6.git.43.f583589.el7aos.x86_64.rpm	SHA-256: e684973be3e66e69aa704178f67aa2bd6de1e4358d2d93aef11a0b939415b87c
tuned-profiles-atomic-openshift-node-3.1.1.6-6.git.43.f583589.el7aos.x86_64.rpm	SHA-256: e3f3767912cc544c9d4c986c87ec737afdf65542f1e826414a5961b9e4ce9c24