what you don't know can hurt you

Red Hat Security Advisory 2017-1712-01

Red Hat Security Advisory 2017-1712-01
Posted Jul 6, 2017
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2017-1712-01 - Red Hat 3scale API Management Platform 2.0 is a platform for the management of access and traffic for web-based APIs across a variety of deployment options. Security Fix: It was found that RH-3scale AMP would permit creation of an access token without a client secret. An attacker could use this flaw to circumvent authentication controls and gain access to restricted APIs. The underlying container image was also rebuilt to resolve other security issues.

tags | advisory, web
systems | linux, redhat
advisories | CVE-2017-1000364, CVE-2017-1000366, CVE-2017-7502, CVE-2017-7512
MD5 | 956dddcd24d616d3e3eb9855a25dca7e

Red Hat Security Advisory 2017-1712-01

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
Red Hat Security Advisory

Synopsis: Important: Red Hat 3scale API Management Platform 2.0.0 security update
Advisory ID: RHSA-2017:1712-01
Product: Red Hat 3scale API Management Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2017:1712
Issue date: 2017-07-06
CVE Names: CVE-2017-1000364 CVE-2017-1000366 CVE-2017-7502
CVE-2017-7512
=====================================================================

1. Summary:

A security update for Red Hat 3scale API Management Platform 2.0.0 is now
available from the Red Hat Container Catalog.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Description:

Red Hat 3scale API Management Platform 2.0 is a platform for the management
of access and traffic for web-based APIs across a variety of deployment
options.

Security Fix(es):

* It was found that RH-3scale AMP would permit creation of an access token
without a client secret. An attacker could use this flaw to circumvent
authentication controls and gain access to restricted APIs. (CVE-2017-7512)

The underlying container image was also rebuilt to resolve other security
issues. These were addressed via the following errata:
* https://access.redhat.com/errata/RHSA-2017:1365
* https://access.redhat.com/errata/RHSA-2017:1481
* https://access.redhat.com/errata/RHSA-2017:1484

Red Hat would like to thank Ryan Nauman (TruCode) for reporting the
CVE-2017-7512 issue.

3. Solution:

To apply this security fix, use the updated docker images.

4. Bugs fixed (https://bugzilla.redhat.com/):

1457997 - CVE-2017-7512 3scale AMP: validation bypass in oauth

5. References:

https://access.redhat.com/security/cve/CVE-2017-1000364
https://access.redhat.com/security/cve/CVE-2017-1000366
https://access.redhat.com/security/cve/CVE-2017-7502
https://access.redhat.com/security/cve/CVE-2017-7512
https://access.redhat.com/security/updates/classification/#important

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2017 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFZXnRrXlSAg2UNWIIRAt8CAJ4z6GgABbXchEezh/jexuz0bTzY/gCbBwX7
C05p9KDlior7f7DTvXKIt4g=
=Iw0h
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

May 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    16 Files
  • 2
    May 2nd
    8 Files
  • 3
    May 3rd
    8 Files
  • 4
    May 4th
    2 Files
  • 5
    May 5th
    1 Files
  • 6
    May 6th
    15 Files
  • 7
    May 7th
    22 Files
  • 8
    May 8th
    16 Files
  • 9
    May 9th
    17 Files
  • 10
    May 10th
    16 Files
  • 11
    May 11th
    3 Files
  • 12
    May 12th
    4 Files
  • 13
    May 13th
    25 Files
  • 14
    May 14th
    24 Files
  • 15
    May 15th
    78 Files
  • 16
    May 16th
    16 Files
  • 17
    May 17th
    16 Files
  • 18
    May 18th
    2 Files
  • 19
    May 19th
    1 Files
  • 20
    May 20th
    11 Files
  • 21
    May 21st
    21 Files
  • 22
    May 22nd
    20 Files
  • 23
    May 23rd
    36 Files
  • 24
    May 24th
    2 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close