Synopsis

Critical: OpenShift Container Platform 3.11 security update

Type/Severity

Security Advisory: Critical

Topic

An update is now available for Red Hat OpenShift Container Platform 3.11.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

Security Fix(es):

• A privilege escalation vulnerability exists in OpenShift Container Platform 3.x which allows for compromise of pods running on a compute node to which a pod is scheduled with normal user privilege. This access could include access to all secrets, pods, environment variables, running pod/container processes, and persistent volumes, including in privileged containers. Additionally, on versions 3.6 and higher of OpenShift Container Platform, this vulnerability allows cluster-admin level access to any API hosted by an aggregated API server. This includes the ‘servicecatalog’ API which is installed by default in 3.7 and later. Cluster-admin level access to the service catalog allows creation of brokered services by an unauthenticated user with escalated privileges in any namespace and on any node. This could lead to an attacker being allowed to deploy malicious code, or alter existing services. (CVE-2018-1002105)
  
• nodejs: Out of bounds (OOB) write via UCS-2 encoding (CVE-2018-12115)
  
• kibana: Cross-site scripting via the source field formatter (CVE-2018-3830)
  

Space precludes documenting all of the bug fixes and enhancements in this advisory. See the following Release Notes documentation for details about these changes:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

All OpenShift Container Platform 3.11 users are advised to upgrade to these updated packages and images.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenShift Container Platform 3.11 x86_64

Fixes

• BZ - 1552304 - CRI-O pod log lines are occasionally split mid-line
• BZ - 1613722 - Eventrouter creates duplicated events every 30 min with verb UPDATE
• BZ - 1614904 - Validation of static pod fails due to inconsistent names
• BZ - 1615884 - Ability to install a cluster with a mix of Docker and CRI-O nodes
• BZ - 1620219 - CVE-2018-12115 nodejs: Out of bounds (OOB) write via UCS-2 encoding
• BZ - 1622822 - Logging should restricted to to current owner/group of a namespace.
• BZ - 1625090 - [CNS][3.11] Run standalone deployment playbook with glusterfs_registry group failed due to AnsibleUndefinedVariable
• BZ - 1626228 - Sometimes builds on api.ci fail with "no such image"
• BZ - 1626538 - openshift-ansible in 3.11 fails OCP 3.11 on OSP 13
• BZ - 1627086 - ElasticSearch pods flapping with "fatal error on the network layer" exception when logging from 1000+ nodes
• BZ - 1627689 - The elasticsearch-config should be logging-elasticsearch-ops in logging-es-ops pods
• BZ - 1628235 - Service Catalog establishes a new connection for every request and never closes them.
• BZ - 1628381 - [docs] Document expectations regarding operational management of NodeWithImpairedVolumes
• BZ - 1628902 - Meet 'openshift_is_atomic' is undefined during execute CNS standalone deployment playbook with glusterfs_registry group
• BZ - 1629558 - Fail to atomic pull node image due to docker service was stopped in previous task
• BZ - 1632364 - [3.11] Fluentd cannot handle S2I Logs
• BZ - 1632450 - CVE-2018-3830 kibana: Cross-site scripting via the source field formatter
• BZ - 1632648 - [3.11] Record is missing kubernetes field when use '--log-driver journald' in /etc/sysconfig/docker
• BZ - 1632895 - [3.11] logging-eventrouter event not formatted correctly in Elasticsearch when using MUX
• BZ - 1633574 - Should not assign the egressIP to node automatically if there are multiple egressIPs in the project
• BZ - 1633923 - openshift-autoheal fails to install in disconnected install
• BZ - 1634700 - [3.11] Modification in master-config.yaml is causing a failure during Master-API restart (runtime-config)
• BZ - 1634835 - Glusterfs-registry pods also get removed while only glusterfs is being uninstalled
• BZ - 1635672 - Use GLUSTER_BLOCKD_STATUS_PROBE_ENABLE enabled templates in glusterfs playbooks
• BZ - 1636248 - not enough master nodes discoverd because service logging-es-cluster is not headless
• BZ - 1637413 - 3.11: APP pod unable to start after target port failure in cases where single paths are mounted on APP pods(BZ#1599742)
• BZ - 1637737 - Service catalog controller segmentation fault
• BZ - 1641245 - Upgrade to 3.11 on atomic host fails during Install or Update node system container task
• BZ - 1641321 - Pods in error state after installing OpenShift with OSP14
• BZ - 1641657 - [3.11] Registry doesn't honors openshift_additional_ca
• BZ - 1641796 - controller-manager pod stops responding with max memory usage and lot of open tcp sockets
• BZ - 1642002 - cockpit-docker is installed (and docker as dependency) even if you just want to use cri-o
• BZ - 1642350 - Failure to restore cache produces corrupted files passed to incremental builds
• BZ - 1643119 - Secure ldap identity provider fails to query the LDAP server. "tls: bad record MAC"
• BZ - 1643301 - Provisioning two APB services temporarily broke networking in the namespace
• BZ - 1643948 - Cluster console doesn't display the real value of Crashlooping Pods (it displays 0)
• BZ - 1648138 - CVE-2018-1002105 kubernetes: authentication/authorization bypass in the handling of non-101 responses

CVEs

• CVE-2018-3830
• CVE-2018-12115
• CVE-2018-1002105

References

• https://access.redhat.com/security/updates/classification/#critical
• https://access.redhat.com/security/vulnerabilities/3716411
• https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

Red Hat OpenShift Container Platform 3.11

SRPM
atomic-enterprise-service-catalog-3.11.43-1.git.1671.04b17f5.el7.src.rpm	SHA-256: 55fb4eef8e5c8d1645897578b94c47976f6c2e54836f591ee2983b61b5ca8031
atomic-openshift-3.11.43-1.git.0.647ac05.el7.src.rpm	SHA-256: 02f688f3a82f603a69ee77657b6a1be7a65a4f414443bb999eec7fc8a8109b2a
atomic-openshift-cluster-autoscaler-3.11.43-1.git.0.55c4e4b.el7.src.rpm	SHA-256: e9e5e9e9b0bffa61d17d799d1048e36a09624341c3c01aab5ad3b864eb451762
atomic-openshift-descheduler-3.11.43-1.git.300.a720f7f.el7.src.rpm	SHA-256: cb9667b4b42745a8f9832e600a92d168b20e40f4764fa1c7e00bd7f624beb929
atomic-openshift-dockerregistry-3.11.43-1.git.446.b80f8a1.el7.src.rpm	SHA-256: bd1a6294d7dc6f51a0f301f8c06d3762568b26b8d6a8ebb7a7891fa09d26cff1
atomic-openshift-metrics-server-3.11.43-1.git.52.6cc0a21.el7.src.rpm	SHA-256: 2eac58ea2dc715b0168a3c03966f542af80dfb88f7e1886c5e3c76a490330558
atomic-openshift-node-problem-detector-3.11.43-1.git.252.f45475c.el7.src.rpm	SHA-256: f3d2a66549ab890fd973c0305cdfb86e8ec9ba41082af9d71c8a802b5ed6b3ec
atomic-openshift-service-idler-3.11.43-1.git.14.bbbb450.el7.src.rpm	SHA-256: 06aa382c650287c2a2dde515fdf22de8c1d47227937cc5f64d06bb116da962f5
atomic-openshift-web-console-3.11.43-1.git.316.7753377.el7.src.rpm	SHA-256: 77951329294e7e09f4139b1cea13436711e44f438f5f011a978e8ea91aadb0a5
cri-o-1.11.8-2.rhaos3.11.git71cc465.el7.src.rpm	SHA-256: bce818e5acd33e6a0fd954c4e1eb86a4f35c1331d3a7d12d9e334cac3c5d665f
golang-github-openshift-oauth-proxy-3.11.43-1.git.419.03122b3.el7.src.rpm	SHA-256: e5c41d069805e5548eadd65bf31d24dbb6c82dea7da84d8a243f3a1365bed927
golang-github-prometheus-alertmanager-3.11.43-1.git.0.19c2765.el7.src.rpm	SHA-256: 49bf11fd63e46d3a54202686c949b23b44762adf6a5509de15b430af0d5c37e6
golang-github-prometheus-node_exporter-3.11.43-1.git.1060.0aff287.el7.src.rpm	SHA-256: fc4aec43c2ff18832915c55405dbc46049d2e2957f20ae0092eafbc807d3a661
golang-github-prometheus-prometheus-3.11.43-1.git.5021.31a8f1d.el7.src.rpm	SHA-256: 38ead12057eecb8b176d5b678a75a321d893f3a093723eec51bdf240f4eff109
jenkins-2-plugins-3.11.1539805268-1.el7.src.rpm	SHA-256: 3a5995e79c2a1e43fd2996109b4d2e8c3cc83d3e9b46ca5d564675cf8c36a16d
kibana-5.6.12-1.el7.src.rpm	SHA-256: 4945c436750918d031028840e2e8f093a03028e07e1138a154b8a055148bd5ba
openshift-ansible-3.11.43-1.git.0.fa69a02.el7.src.rpm	SHA-256: 5dd982ec5f7b8da617e5cb268865646e5dc8d540e8f6818c391996915e4e0d41
openshift-enterprise-autoheal-3.11.43-1.git.219.be400cf.el7.src.rpm	SHA-256: c702b52fcbb932a126426fa9cb50427db9f8d1c0915a8abca0f08576113f9579
openshift-enterprise-cluster-capacity-3.11.43-1.git.380.9cbcbb2.el7.src.rpm	SHA-256: 7fae1ec46e93ce488d0c9c2bd5c7d1dd9f5ff0ae041ac65865658af0e9b5d2ff
openshift-external-storage-0.0.2-4.gitd3c94f0.el7.src.rpm	SHA-256: 627558526291cf9f51f11bf48a8e327ac3de2d8371c9b18a4f54a5097c3643b8
openshift-monitor-project-lifecycle-3.11.43-1.git.59.662daae.el7.src.rpm	SHA-256: 7a47276556dcca193bcfcb39e07cc8d3a8bd4225a775ae716812b1862b2258aa
openshift-monitor-sample-app-3.11.43-1.git.5.83ab17f.el7.src.rpm	SHA-256: 133330b56228bc918a0a4f34594be80ec731db01d81f15afc162a7c42a1051b7
python-elasticsearch-5.5.5-1.el7.src.rpm	SHA-256: 36e27f2c79011007ba5364b0f024e6d3f02b27cffd941eef447c814974d05d7d
python-nose-xcover-1.0.10-1.el7.src.rpm	SHA-256: 7567c6a8fde5486f21d1f7ce9535308698f838af36298d0d743c0b418c33039a
x86_64
atomic-enterprise-service-catalog-3.11.43-1.git.1671.04b17f5.el7.x86_64.rpm	SHA-256: 32cfff3fb2dcdf29ffd5df49c8b3243460beae247ae1fd69b83e917fb5979f01
atomic-enterprise-service-catalog-svcat-3.11.43-1.git.1671.04b17f5.el7.x86_64.rpm	SHA-256: f698bc8ccd1adc2b1785a255e9ecdcd5da5712a742afd7f20647100c7d5f86b6
atomic-openshift-3.11.43-1.git.0.647ac05.el7.x86_64.rpm	SHA-256: 2676c50c13b31633c0b8e3395bae380677cea7fcdde45c55d3e56554fbd072cf
atomic-openshift-clients-3.11.43-1.git.0.647ac05.el7.x86_64.rpm	SHA-256: 59342683dc92684826294f1ad031a43a93c1a75bfc4ba42ef3736b0bbaa59e5e
atomic-openshift-clients-redistributable-3.11.43-1.git.0.647ac05.el7.x86_64.rpm	SHA-256: 338a2f6e28347b91d4546945870d97488820f3a973559826ac96abaaed789aaf
atomic-openshift-cluster-autoscaler-3.11.43-1.git.0.55c4e4b.el7.x86_64.rpm	SHA-256: 55f10caf722a02d9dba7c841d93205ddb86371d9e95a36ad6ac7f974eeb58e1b
atomic-openshift-descheduler-3.11.43-1.git.300.a720f7f.el7.x86_64.rpm	SHA-256: 141a824f30a53fb7026118daa5199842d801e6e2a1499f1adb360ea52a51ae4e
atomic-openshift-docker-excluder-3.11.43-1.git.0.647ac05.el7.noarch.rpm	SHA-256: 53d42423c88429d89aa8bbe1e9f4bf5747a80e95900296989b4d5eaf3e370f22
atomic-openshift-dockerregistry-3.11.43-1.git.446.b80f8a1.el7.x86_64.rpm	SHA-256: 024623d474839afea4cdeb715f840de8fae86e9a5e7f02e72f0d69a7986b3c04
atomic-openshift-excluder-3.11.43-1.git.0.647ac05.el7.noarch.rpm	SHA-256: 33aa919780ad56aa45ae67de0f2f2a64969232162c0beea192f7fca7c1869700
atomic-openshift-hyperkube-3.11.43-1.git.0.647ac05.el7.x86_64.rpm	SHA-256: 91f81abc9102e142fc3af3f6d6e9dc6c1270a376b3a0eb15ae5774d2177f81d1
atomic-openshift-hypershift-3.11.43-1.git.0.647ac05.el7.x86_64.rpm	SHA-256: 08b79270e4d574edfd58ae31e35e408893cefff3c26f76e1599bf5ff7113447c
atomic-openshift-master-3.11.43-1.git.0.647ac05.el7.x86_64.rpm	SHA-256: 3b11da4b7780ab764a99a0d4e88795b5cb2f48e4fdcd6a0c1ac2f970af854b93
atomic-openshift-metrics-server-3.11.43-1.git.52.6cc0a21.el7.x86_64.rpm	SHA-256: 61c7d10108de65050a1e11462614004c5a0b9b9f7c658f0f0bfd6a8f3b1579c3
atomic-openshift-node-3.11.43-1.git.0.647ac05.el7.x86_64.rpm	SHA-256: ecf3b57bc037b2e4879b6248fffe1e60f4c0da3f5e2da7c2d091f61bca719f2b
atomic-openshift-node-problem-detector-3.11.43-1.git.252.f45475c.el7.x86_64.rpm	SHA-256: 53b34b14b2ac025c7c124e61dc810ca6f5dd045eb1d0ab21cde664be1ead16cb
atomic-openshift-pod-3.11.43-1.git.0.647ac05.el7.x86_64.rpm	SHA-256: bb21cb8d457993ed2f0f0f53a4c2dbe19e74c74adb36d7f96741ca46c26edbcb
atomic-openshift-sdn-ovs-3.11.43-1.git.0.647ac05.el7.x86_64.rpm	SHA-256: 51846b4c30e3b9b4f0212b5b9e73850f4485d98075f47d3e1d4771b3aae6a25a
atomic-openshift-service-idler-3.11.43-1.git.14.bbbb450.el7.x86_64.rpm	SHA-256: 27ee36ffbce0c221ec900e100530733ed1366986ef46cdcf7d098f323d2b4870
atomic-openshift-template-service-broker-3.11.43-1.git.0.647ac05.el7.x86_64.rpm	SHA-256: 292ec9199a06c6fcc6502582e36908a3b81852945c9e99dde544939433f87caa
atomic-openshift-tests-3.11.43-1.git.0.647ac05.el7.x86_64.rpm	SHA-256: a46a8a0e0530f9678ab73603eb341ceaf4b5076a394f9820ad9104e22993a1c6
atomic-openshift-web-console-3.11.43-1.git.316.7753377.el7.x86_64.rpm	SHA-256: 49fde03d0d733913c82a609ac36dd4977e4b896f394db6595b6f1e7dca9a5376
cri-o-1.11.8-2.rhaos3.11.git71cc465.el7.x86_64.rpm	SHA-256: 1a0943ae2481ecea708aa00e491d7e532d8a97940176213fad94aee67a5f2892
golang-github-openshift-oauth-proxy-3.11.43-1.git.419.03122b3.el7.x86_64.rpm	SHA-256: 065181bda2cbcd3cc0ebe48d5b1a36d83dd55f28c8f542b7798f634e528d27cb
jenkins-2-plugins-3.11.1539805268-1.el7.noarch.rpm	SHA-256: 8303fc1736b90927d39b8e8268666c60d4fbac11fb87ec1e08f8a30430b0e1ae
kibana-5.6.12-1.el7.x86_64.rpm	SHA-256: c0793fc1119d1196df604e8862f2cfea6ef279f3ada84cd3e62214a3ff08bc48
kibana-debuginfo-5.6.12-1.el7.x86_64.rpm	SHA-256: 658d3e2a9887463f5b13f9584d8944c9662d3ab2b75061cf1542a401769af424
openshift-ansible-3.11.43-1.git.0.fa69a02.el7.noarch.rpm	SHA-256: 26a55a7f3a4a821866db1f3fe0d72c9c2eea968fedb133d452a998cbbc29c100
openshift-ansible-docs-3.11.43-1.git.0.fa69a02.el7.noarch.rpm	SHA-256: 8b577dc86b4a4eff94d5ff9f29d86fc76519a08d96c28ea03050afbf2b266ee1
openshift-ansible-playbooks-3.11.43-1.git.0.fa69a02.el7.noarch.rpm	SHA-256: 38552f724a8797e2eda5bd1144a789432cdc554139e141c07c62757620648ff4
openshift-ansible-roles-3.11.43-1.git.0.fa69a02.el7.noarch.rpm	SHA-256: cae8261cfc82b528a7597236370197fb0713d22a4e4fae6b32300c72594f0917
openshift-enterprise-autoheal-3.11.43-1.git.219.be400cf.el7.x86_64.rpm	SHA-256: 6f4575567926096a234319abfd00b638a22dfe55bc61a4f93d93da6fcf00a5e9
openshift-enterprise-cluster-capacity-3.11.43-1.git.380.9cbcbb2.el7.x86_64.rpm	SHA-256: 7cf020a2a66ab0e6c48a0736d0e732564423e74db05438ad75cc85ed372703d9
openshift-external-storage-cephfs-provisioner-0.0.2-4.gitd3c94f0.el7.x86_64.rpm	SHA-256: 643f4d62d6bce6485ebcec0d2a329213d3e22a26408333a6c44e59dbae0d3d5e
openshift-external-storage-debuginfo-0.0.2-4.gitd3c94f0.el7.x86_64.rpm	SHA-256: db15ea55a6fd8ffdf9ed44205d50bdde37d3f3b2f78238a1942c728af28827ed
openshift-external-storage-efs-provisioner-0.0.2-4.gitd3c94f0.el7.x86_64.rpm	SHA-256: 3f353afcb1e6de3c93f663c1aa9f61c8f19941561c90dca6bb5562d59527e88c
openshift-external-storage-local-provisioner-0.0.2-4.gitd3c94f0.el7.x86_64.rpm	SHA-256: 2fc2e8e546a8b207772c68f002e8e2a05d82372c33c6de120083326835b86eeb
openshift-external-storage-manila-provisioner-0.0.2-4.gitd3c94f0.el7.x86_64.rpm	SHA-256: 9e539af1281160ad9febb9d48a4915bc6ed6c047a8f7db11e0f280003dfcdd37
openshift-external-storage-snapshot-controller-0.0.2-4.gitd3c94f0.el7.x86_64.rpm	SHA-256: 3b01afa0ed1ce3b5dfad3ffb2d60fa4a2be024c4ce3e4d6046add624224def49
openshift-external-storage-snapshot-provisioner-0.0.2-4.gitd3c94f0.el7.x86_64.rpm	SHA-256: 03c3d8885de14b1454785e5dd31abbfca64c3e34138f16e90cb7384069a8eebd
openshift-monitor-project-lifecycle-3.11.43-1.git.59.662daae.el7.x86_64.rpm	SHA-256: fb47d06f764c1eb18bdb7daf6b7e5eff1702d5819785b24252382a9623c1691e
openshift-monitor-sample-app-3.11.43-1.git.5.83ab17f.el7.x86_64.rpm	SHA-256: 05ecdc4c9633e6891391f94f84f126c7fda13175e32cafc629080641b3955d8d
prometheus-3.11.43-1.git.5021.31a8f1d.el7.x86_64.rpm	SHA-256: 3d4949e9a9409e062518bd2dfdbabab53841c0e2b97270422e9a70c16e87c123
prometheus-alertmanager-3.11.43-1.git.0.19c2765.el7.x86_64.rpm	SHA-256: fc5ab1742e1b2ed9ef2d2e757551c84cf27a830afef85fa2878708013c5ccf6e
prometheus-node-exporter-3.11.43-1.git.1060.0aff287.el7.x86_64.rpm	SHA-256: 43404b5c82432f91ae381dc532556525492d12be018eb94520475815d62eeabf
python-elasticsearch-5.5.5-1.el7.noarch.rpm	SHA-256: 46cc0f25af8edebda365b9ba75c2285f8b2f1fcc17f1ae65ffd66dc3bc0d69c5
python-nose-xcover-1.0.10-1.el7.noarch.rpm	SHA-256: 553e17fdb9ab36685f0472785c0b82b3fd788e34d9e014d97b0d3a155189df25