-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: openshift security update
Advisory ID:       RHSA-2016:1038-01
Product:           Red Hat OpenShift Enterprise
Advisory URL:      https://access.redhat.com/errata/RHSA-2016:1038
Issue date:        2016-05-11
CVE Names:         CVE-2016-2142 
=====================================================================

1. Summary:

Updated openshift packages that fix one security issue are now 
available for Red Hat OpenShift Enterprise 3.1.

Red Hat Product Security has rated this update as having Moderate security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.

2. Relevant releases/architectures:

Red Hat OpenShift Enterprise 3.1 - x86_64

3. Description:

OpenShift Enterprise by Red Hat is the company's cloud computing
Platform-as-a-Service (PaaS) solution designed for on-premise or 
private cloud deployments.

An access flaw was discovered in OpenShift; the 
/etc/origin/master/master-config.yaml configuration file, which could 
contain Active Directory credentials, was world-readable. A local user 
could exploit this flaw to obtain authentication credentials from the 
master-config.yaml file. (CVE-2016-2142)

If you believe that the password in this file has been viewed by an 
attacker you should reset the password after installing this update.

All installations with Active Directory integration are advised to upgrade 
to the updated software, which contains a backported patch to correct this 
issue.

This update includes the following images:

openshift3/ose:v3.1.1.6-19
openshift3/ose-deployer:v3.1.1.6-18
openshift3/ose-docker-builder:v3.1.1.6-17
openshift3/ose-f5-router:v3.1.1.6-18
openshift3/ose-sti-builder:v3.1.1.6-17
openshift3/node:v3.1.1.6-18
aep3_beta/aep-deployer:v3.1.1.6-18
aep3_beta/aep-f5-router:v3.1.1.6-18
aep3_beta/aep:v3.1.1.6-19
aep3_beta/node:v3.1.1.6-18

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1311220 - CVE-2016-2142 openshift: Bind password for AD account is stored in world readable file
1331038 - Pods are stuck in pending state due to failed image pulling

6. Package List:

Red Hat OpenShift Enterprise 3.1:

Source:
atomic-openshift-3.1.1.6-6.git.43.f583589.el7aos.src.rpm

x86_64:
atomic-openshift-3.1.1.6-6.git.43.f583589.el7aos.x86_64.rpm
atomic-openshift-clients-3.1.1.6-6.git.43.f583589.el7aos.x86_64.rpm
atomic-openshift-clients-redistributable-3.1.1.6-6.git.43.f583589.el7aos.x86_64.rpm
atomic-openshift-dockerregistry-3.1.1.6-6.git.43.f583589.el7aos.x86_64.rpm
atomic-openshift-master-3.1.1.6-6.git.43.f583589.el7aos.x86_64.rpm
atomic-openshift-node-3.1.1.6-6.git.43.f583589.el7aos.x86_64.rpm
atomic-openshift-pod-3.1.1.6-6.git.43.f583589.el7aos.x86_64.rpm
atomic-openshift-recycle-3.1.1.6-6.git.43.f583589.el7aos.x86_64.rpm
atomic-openshift-sdn-ovs-3.1.1.6-6.git.43.f583589.el7aos.x86_64.rpm
tuned-profiles-atomic-openshift-node-3.1.1.6-6.git.43.f583589.el7aos.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2016-2142
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2016 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFXM0FOXlSAg2UNWIIRAqqJAJ9E1zDpzlT5nMsTwpSBncZYM2o8VgCgo2pc
EXXV6Tmgem7x8LlUs7YzT3k=
=jW5m
-----END PGP SIGNATURE-----


--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce