Synopsis

Important: Red Hat OpenShift Enterprise 3.2 security update

Type/Severity

Security Advisory: Important

Topic

An update for atomic-openshift and nodejs-node-uuid is now available for Red Hat OpenShift Enterprise 3.2. In addition, all images have been rebuilt on the new RHEL 7.2.4 base image.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

OpenShift Enterprise by Red Hat is the company's cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments.

Security Fix(es):

• A vulnerability was found in the STI build process in OpenShift Enterprise. Access to STI builds was not properly restricted, allowing an attacker to use STI builds to access the Docker socket and escalate their privileges. (CVE-2016-3738)
  
• An origin validation vulnerability was found in OpenShift Enterprise. An attacker could potentially access API credentials stored in a web browser's localStorage if anonymous access was granted to a service/proxy or pod/proxy API for a specific pod, and an authorized access_token was provided in the query parameter. (CVE-2016-3703)
  
• A flaw was found in OpenShift Enterprise when multi-tenant SDN is enabled and a build is run within a namespace that would normally be isolated from pods in other namespaces. If an s2i build is run in such an environment the container being built can access network resources on pods that should not be available to it. (CVE-2016-3708)
  

The CVE-2016-3738 issue was discovered by David Eads (Red Hat); the CVE-2016-3703 issue was discovered by Jordan Liggitt (Red Hat); and the CVE-2016-3708 issue was discovered by Ben Parees (Red Hat).

This update includes the following images:

openshift3/ose:v3.2.0.44-2
openshift3/ose-deployer:v3.2.0.44-2
openshift3/ose-docker-builder:v3.2.0.44-2
openshift3/ose-docker-registry:v3.2.0.44-2
openshift3/ose-f5-router:v3.2.0.44-2
openshift3/ose-haproxy-router:v3.2.0.44-2
openshift3/ose-keepalived-ipfailover:v3.2.0.44-2
openshift3/ose-pod:v3.2.0.44-2
openshift3/ose-recycler:v3.2.0.44-2
openshift3/ose-sti-builder:v3.2.0.44-2
openshift3/jenkins-1-rhel7:1.642-32
openshift3/logging-auth-proxy:3.2.0-4
openshift3/logging-deployment:3.2.0-9
openshift3/logging-elasticsearch:3.2.0-8
openshift3/logging-fluentd:3.2.0-8
openshift3/logging-kibana:3.2.0-4
openshift3/metrics-deployer:3.2.0-6
openshift3/metrics-heapster:3.2.0-6
openshift3/mongodb-24-rhel7:2.4-28
openshift3/mysql-55-rhel7:5.5-26
openshift3/nodejs-010-rhel7:0.10-35
openshift3/node:v3.2.0.44-2
openshift3/openvswitch:v3.2.0.44-2
openshift3/perl-516-rhel7:5.16-38
openshift3/php-55-rhel7:5.5-35
openshift3/postgresql-92-rhel7:9.2-25
openshift3/python-33-rhel7:3.3-35
openshift3/ruby-20-rhel7:2.0-35

aep3_beta/aep:v3.2.0.44-2
aep3_beta/aep-deployer:v3.2.0.44-2
aep3_beta/aep-docker-registry:v3.2.0.44-2
aep3_beta/aep-f5-router:v3.2.0.44-2
aep3_beta/aep-haproxy-router:v3.2.0.44-2
aep3_beta/aep-keepalived-ipfailover:v3.2.0.44-2
aep3_beta/aep-pod:v3.2.0.44-2
aep3_beta/aep-recycler:v3.2.0.44-2
aep3_beta/logging-auth-proxy:3.2.0-4
aep3_beta/logging-deployment:3.2.0-9
aep3_beta/logging-elasticsearch:3.2.0-8
aep3_beta/logging-fluentd:3.2.0-8
aep3_beta/logging-kibana:3.2.0-4
aep3_beta/metrics-deployer:3.2.0-6
aep3_beta/metrics-heapster:3.2.0-6
aep3_beta/node:v3.2.0.44-2
aep3_beta/openvswitch:v3.2.0.44-2

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenShift Container Platform 3.2 x86_64

Fixes

• BZ - 1306011 - Deployer pods incorrectly using the host entry from openshiftLoopbackKubeconfig
• BZ - 1318974 - Creating pods on OSE with awsElasticBlockStore only assigns devices /dev/xvdb - /dev/xvdp to openshift node
• BZ - 1324996 - JSON message fields are getting overwritten
• BZ - 1329044 - console.dev-preview-int.openshift.com setting of memory limit confusing
• BZ - 1330233 - CVE-2016-3703 OpenShift Enterprise 3: Untrusted content loaded via the API proxy can access web console credentials on the same domain
• BZ - 1330364 - Should update the role name in the prompt on the web console
• BZ - 1331229 - CVE-2016-3708 OpenShiftEnterprise 3: s2i builds implicitly perform docker builds
• BZ - 1333168 - Node.js images crash with DEV_MODE=true
• BZ - 1333461 - CVE-2016-3738 origin: pod update allows docker socket access via build-pod

CVEs

• CVE-2016-3703
• CVE-2016-3708
• CVE-2016-3738

References

• http://www.redhat.com/security/updates/classification/#normal

Red Hat OpenShift Container Platform 3.2

SRPM
atomic-openshift-3.2.0.44-1.git.0.a4463d9.el7.src.rpm	SHA-256: 2d706648de2b40d6ca62a19451a1cd2f6487c3586b8fec11ad1e72cb483fc92d
nodejs-node-uuid-1.4.7-1.el7.src.rpm	SHA-256: 3022a085ad749d4f4ad2ac069c0114023bb187d817115f55a4082f22c5bbb452
x86_64
atomic-openshift-3.2.0.44-1.git.0.a4463d9.el7.x86_64.rpm	SHA-256: 84dbe7b3887fc9c6144708140ca3e12b1903f486eb2040a95ec37291bb895022
atomic-openshift-clients-3.2.0.44-1.git.0.a4463d9.el7.x86_64.rpm	SHA-256: e0adfadb62a4e21f798a0f152ba6b1d775a5f0c706713332e765ac29191fb920
atomic-openshift-clients-redistributable-3.2.0.44-1.git.0.a4463d9.el7.x86_64.rpm	SHA-256: c3de008a4be1ee38500df0e875dfc2aa2d618ff15d7e0935dd33a1cb150d0598
atomic-openshift-dockerregistry-3.2.0.44-1.git.0.a4463d9.el7.x86_64.rpm	SHA-256: 71e932f3c91d1a152651fb0161213e062200910cceb7d4bf190a48d72cc45026
atomic-openshift-master-3.2.0.44-1.git.0.a4463d9.el7.x86_64.rpm	SHA-256: 77d473fdb225a2adb9e202b58d142e2858141ff261ad9600111ff3aeda2d23d0
atomic-openshift-node-3.2.0.44-1.git.0.a4463d9.el7.x86_64.rpm	SHA-256: 79e883c6bfa4240745358b6413efade24bafc3385b0593f313cc99df93a2639e
atomic-openshift-pod-3.2.0.44-1.git.0.a4463d9.el7.x86_64.rpm	SHA-256: 315428908959bdad33f62c72118613848c83de19ac04065effb1af9b8288d78d
atomic-openshift-recycle-3.2.0.44-1.git.0.a4463d9.el7.x86_64.rpm	SHA-256: 1b6cae18e6195ab5ad87318fe644f9f819f92f0ad178048e040fdc9585b66f22
atomic-openshift-sdn-ovs-3.2.0.44-1.git.0.a4463d9.el7.x86_64.rpm	SHA-256: 16300d4303734a8a7fea62eafe874fb51018928cc5fdea26d099359b4e0dfbda
atomic-openshift-tests-3.2.0.44-1.git.0.a4463d9.el7.x86_64.rpm	SHA-256: 86d85cb40371e31c60954ffebb71074e36083df1b0822ca56b3df240e330e4c3
nodejs-node-uuid-1.4.7-1.el7.noarch.rpm	SHA-256: 3459f18f9bbb1a10c24379b26aaca9765c95dead7a09d922160ceddc6a767e97
tuned-profiles-atomic-openshift-node-3.2.0.44-1.git.0.a4463d9.el7.x86_64.rpm	SHA-256: 63c3cd5203501906ac1269aedbd3bbf09d1473644b137bd985d14f0907b6e82c