what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Red Hat Security Advisory 2018-2373-01

Red Hat Security Advisory 2018-2373-01
Posted Aug 10, 2018
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2018-2373-01 - The redhat-certification package provides partners with a unified web-based user interface to certify their products for use on Red Hat Infrastructure. It can currently be used in the latest releases of Red Hat Certified Cloud and Service Provider Certification, Red Hat OpenStack Certification and Red Hat Hardware Certification Programs. Issues addressed include writeable and downloadable file vulnerabilities.

tags | advisory, web, vulnerability
systems | linux, redhat
advisories | CVE-2018-10864, CVE-2018-10869, CVE-2018-10870
SHA-256 | 9286e36fffceb1c677171034038eb15e4450446f75085006ffa42eea1ff46f8c

Red Hat Security Advisory 2018-2373-01

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Critical: redhat-certification security update
Advisory ID: RHSA-2018:2373-01
Product: Red Hat Certification
Advisory URL: https://access.redhat.com/errata/RHSA-2018:2373
Issue date: 2018-08-09
CVE Names: CVE-2018-10864 CVE-2018-10869 CVE-2018-10870
=====================================================================

1. Summary:

An update for redhat-certification is now available for Red Hat
Certification for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Certification for Red Hat Enterprise Linux 7 - noarch

3. Description:

The redhat-certification package provides partners with a unified web-based
user interface to certify their products for use on Red Hat Infrastructure.
It can currently be used in the latest releases of Red Hat Certified Cloud
and Service Provider Certification, Red Hat OpenStack Certification and Red
Hat Hardware Certification Programs.

Security Fix(es):

* redhat-certification: rhcertStore.py:__saveResultsFile allows to write
any file (CVE-2018-10870)

* redhat-certification: /download allows to download any file
(CVE-2018-10869)

* redhat-certification: resource consumption in DocumentBase:loadFiltered
(CVE-2018-10864)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

These issues were discovered by Riccardo Schirone (Red Hat Product
Security).

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1593627 - CVE-2018-10864 redhat-certification: resource consumption in DocumentBase:loadFiltered
1593780 - CVE-2018-10869 redhat-certification: /download allows to download any file
1593803 - CVE-2018-10870 redhat-certification: rhcertStore.py:__saveResultsFile allows to write any file

6. Package List:

Red Hat Certification for Red Hat Enterprise Linux 7:

Source:
redhat-certification-5.16-20180809.el7.src.rpm
redhat-certification-hardware-5.16-20180809.1.el7.src.rpm
redhat-certification-hardware-preview-5.16-20180809.1.el7.src.rpm

noarch:
redhat-certification-5.16-20180809.el7.noarch.rpm
redhat-certification-backend-5.16-20180809.el7.noarch.rpm
redhat-certification-baremetal-5.16-20180809.el7.noarch.rpm
redhat-certification-cloud-5.16-20180809.el7.noarch.rpm
redhat-certification-hardware-5.16-20180809.1.el7.noarch.rpm
redhat-certification-hardware-preview-5.16-20180809.1.el7.noarch.rpm
redhat-certification-openstack-5.16-20180809.el7.noarch.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2018-10864
https://access.redhat.com/security/cve/CVE-2018-10869
https://access.redhat.com/security/cve/CVE-2018-10870
https://access.redhat.com/security/updates/classification/#critical

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBW2x4fNzjgjWX9erEAQhXTw//R2J4x2wC6NjA5bGMFDBs+c8ghQDtrZJT
Bln/a22+X+XCKDoJB68JJb/+uRtq/4jX5ad2DsB05N2/TEg0YnENgR+MZcWUHwLb
luphTbdA5nZPfaEGQ+pz8QM2tKrI1YbCgCI2Ehx4i6LVSyD5KQ2ZUf5ultX6dHmI
bZLX1uRltw/EifMJ4w28zmHljmtf0zFD6Mt8c/IoHKCgrYDgwXdpYL4hbyzWCBWK
FU6IAn51rm7w/dIdXAvhPsX8wP0y3RYOC76llqA+9XkOqYVlXoRDhEvQ5aZn8u9o
KqSF74uikRhW03MgIh3KjKn5PbJMhJ02J6Mzc9bqepfxjl2ayrAgK4lJAvvgITes
m3J8VYZ0QatICOdGgbBxIlJIamLbyVFmnDllxuDLe/W8fJbfY+qrwUD7tqweT/cg
/fahESn2jWQ3M0HKp7hbsG7VppKp1qdPsCOzccIdVLb2oJ2CMZHFZKv5Lz+eoeaz
vHLTfVzajxhtxgUIE9rjRkETm76Tz5aEUMr+BsCC/f2FMdxu8cGWx3cfoAyxEokj
N9nBDpuD+VarTpxzN6sPnKe3OH1xlrvr1pj8LKRkNSGn15v6O4vjgmMzGbEBABSC
ibqCikJB/LnNBYhomKsqS7+dTOFWKoOS6NbNk+0gR7a6Ouz35KzbgOgefm4Qnn42
EMg5Nfj+fzw=
=TWZe
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    0 Files
  • 21
    Mar 21st
    0 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close