-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: redhat-certification security update
Advisory ID:       RHSA-2018:2373-01
Product:           Red Hat Certification
Advisory URL:      https://access.redhat.com/errata/RHSA-2018:2373
Issue date:        2018-08-09
CVE Names:         CVE-2018-10864 CVE-2018-10869 CVE-2018-10870 
=====================================================================

1. Summary:

An update for redhat-certification is now available for Red Hat
Certification for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Certification for Red Hat Enterprise Linux 7 - noarch

3. Description:

The redhat-certification package provides partners with a unified web-based
user interface to certify their products for use on Red Hat Infrastructure.
It can currently be used in the latest releases of Red Hat Certified Cloud
and Service Provider Certification, Red Hat OpenStack Certification and Red
Hat Hardware Certification Programs.

Security Fix(es):

* redhat-certification: rhcertStore.py:__saveResultsFile allows to write
any file (CVE-2018-10870)

* redhat-certification: /download allows to download any file
(CVE-2018-10869)

* redhat-certification: resource consumption in DocumentBase:loadFiltered
(CVE-2018-10864)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

These issues were discovered by Riccardo Schirone (Red Hat Product
Security).

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1593627 - CVE-2018-10864 redhat-certification: resource consumption in DocumentBase:loadFiltered
1593780 - CVE-2018-10869 redhat-certification: /download allows to download any file
1593803 - CVE-2018-10870 redhat-certification: rhcertStore.py:__saveResultsFile allows to write any file

6. Package List:

Red Hat Certification for Red Hat Enterprise Linux 7:

Source:
redhat-certification-5.16-20180809.el7.src.rpm
redhat-certification-hardware-5.16-20180809.1.el7.src.rpm
redhat-certification-hardware-preview-5.16-20180809.1.el7.src.rpm

noarch:
redhat-certification-5.16-20180809.el7.noarch.rpm
redhat-certification-backend-5.16-20180809.el7.noarch.rpm
redhat-certification-baremetal-5.16-20180809.el7.noarch.rpm
redhat-certification-cloud-5.16-20180809.el7.noarch.rpm
redhat-certification-hardware-5.16-20180809.1.el7.noarch.rpm
redhat-certification-hardware-preview-5.16-20180809.1.el7.noarch.rpm
redhat-certification-openstack-5.16-20180809.el7.noarch.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2018-10864
https://access.redhat.com/security/cve/CVE-2018-10869
https://access.redhat.com/security/cve/CVE-2018-10870
https://access.redhat.com/security/updates/classification/#critical

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBW2x4fNzjgjWX9erEAQhXTw//R2J4x2wC6NjA5bGMFDBs+c8ghQDtrZJT
Bln/a22+X+XCKDoJB68JJb/+uRtq/4jX5ad2DsB05N2/TEg0YnENgR+MZcWUHwLb
luphTbdA5nZPfaEGQ+pz8QM2tKrI1YbCgCI2Ehx4i6LVSyD5KQ2ZUf5ultX6dHmI
bZLX1uRltw/EifMJ4w28zmHljmtf0zFD6Mt8c/IoHKCgrYDgwXdpYL4hbyzWCBWK
FU6IAn51rm7w/dIdXAvhPsX8wP0y3RYOC76llqA+9XkOqYVlXoRDhEvQ5aZn8u9o
KqSF74uikRhW03MgIh3KjKn5PbJMhJ02J6Mzc9bqepfxjl2ayrAgK4lJAvvgITes
m3J8VYZ0QatICOdGgbBxIlJIamLbyVFmnDllxuDLe/W8fJbfY+qrwUD7tqweT/cg
/fahESn2jWQ3M0HKp7hbsG7VppKp1qdPsCOzccIdVLb2oJ2CMZHFZKv5Lz+eoeaz
vHLTfVzajxhtxgUIE9rjRkETm76Tz5aEUMr+BsCC/f2FMdxu8cGWx3cfoAyxEokj
N9nBDpuD+VarTpxzN6sPnKe3OH1xlrvr1pj8LKRkNSGn15v6O4vjgmMzGbEBABSC
ibqCikJB/LnNBYhomKsqS7+dTOFWKoOS6NbNk+0gR7a6Ouz35KzbgOgefm4Qnn42
EMg5Nfj+fzw=
=TWZe
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce