exploit the possibilities

Red Hat Security Advisory 2017-1712-01

Red Hat Security Advisory 2017-1712-01
Posted Jul 6, 2017
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2017-1712-01 - Red Hat 3scale API Management Platform 2.0 is a platform for the management of access and traffic for web-based APIs across a variety of deployment options. Security Fix: It was found that RH-3scale AMP would permit creation of an access token without a client secret. An attacker could use this flaw to circumvent authentication controls and gain access to restricted APIs. The underlying container image was also rebuilt to resolve other security issues.

tags | advisory, web
systems | linux, redhat
advisories | CVE-2017-1000364, CVE-2017-1000366, CVE-2017-7502, CVE-2017-7512
MD5 | 956dddcd24d616d3e3eb9855a25dca7e

Red Hat Security Advisory 2017-1712-01

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
Red Hat Security Advisory

Synopsis: Important: Red Hat 3scale API Management Platform 2.0.0 security update
Advisory ID: RHSA-2017:1712-01
Product: Red Hat 3scale API Management Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2017:1712
Issue date: 2017-07-06
CVE Names: CVE-2017-1000364 CVE-2017-1000366 CVE-2017-7502
CVE-2017-7512
=====================================================================

1. Summary:

A security update for Red Hat 3scale API Management Platform 2.0.0 is now
available from the Red Hat Container Catalog.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Description:

Red Hat 3scale API Management Platform 2.0 is a platform for the management
of access and traffic for web-based APIs across a variety of deployment
options.

Security Fix(es):

* It was found that RH-3scale AMP would permit creation of an access token
without a client secret. An attacker could use this flaw to circumvent
authentication controls and gain access to restricted APIs. (CVE-2017-7512)

The underlying container image was also rebuilt to resolve other security
issues. These were addressed via the following errata:
* https://access.redhat.com/errata/RHSA-2017:1365
* https://access.redhat.com/errata/RHSA-2017:1481
* https://access.redhat.com/errata/RHSA-2017:1484

Red Hat would like to thank Ryan Nauman (TruCode) for reporting the
CVE-2017-7512 issue.

3. Solution:

To apply this security fix, use the updated docker images.

4. Bugs fixed (https://bugzilla.redhat.com/):

1457997 - CVE-2017-7512 3scale AMP: validation bypass in oauth

5. References:

https://access.redhat.com/security/cve/CVE-2017-1000364
https://access.redhat.com/security/cve/CVE-2017-1000366
https://access.redhat.com/security/cve/CVE-2017-7502
https://access.redhat.com/security/cve/CVE-2017-7512
https://access.redhat.com/security/updates/classification/#important

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2017 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFZXnRrXlSAg2UNWIIRAt8CAJ4z6GgABbXchEezh/jexuz0bTzY/gCbBwX7
C05p9KDlior7f7DTvXKIt4g=
=Iw0h
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
Login or Register to add favorites

File Archive:

August 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    1 Files
  • 2
    Aug 2nd
    7 Files
  • 3
    Aug 3rd
    0 Files
  • 4
    Aug 4th
    0 Files
  • 5
    Aug 5th
    0 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    0 Files
  • 9
    Aug 9th
    0 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close