Arbitrary Code Execution

rubygem-openshift-origin-node is vulnerable to arbitrary code execution attacks. The vulnerability exists as Red Hat OpenShift Enterprise 2.0 and 2.1 and OpenShift Origin allow remote authenticated users to execute arbitrary commands via shell metacharacters in a directory name that is referenced...

World-readable Permissions

The openshift-origin-broker-util package has world-readable permission vulnerability. It happens because the package sets the permissions for mcollective client.cfg configuration as world-readable by default, leakaging sensitive information regarding the mcollective installation, including...

Authentication Bypass

openshift-origin-broker is vulnerable to authentication bypass attacks. The vulnerability exists as the openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attacker...

Information Disclosure

rhc-chk.rb in Red Hat OpenShift Origin is vulnerable to information disclosure. When -d debug mode is used, the output of the process contains confidential information such as the plaintext database passwords. This leads to unintentional disclosure of confidential in support channels such as a...

Denial Of Service (Dos)

rubygem-openshift-origin-node is vulnerable to denial of service. OpenShift uses /etc/cron.daily/openshift-origin-cron-daily to run daily scheduled jobs, which will run all users' cron.daily content. These cron.daily jobs will prevent further jobs from running in a timely manner if the cron.daily...

Remote Code Execution (RCE)

rubygem-openshift-origin-node is vulnerable to remote code execution. A remote authenticated user is permitted to install cartridges via the web interface, which would allow a remote attacker to abuse the application behavior to execute arbitrary code on the system with root privileges...

Remote Code Execution (RCE)

openshift-origin-node-util is vulnerable to remote code execution RCE attacks. The vulnerability exists as node-util/www/html/restorer.php in the Red Hat OpenShift Origin before 1.0.5-3 allows remote attackers to execute arbitrary commands via a crafted uuid in the PATHINFO...

Cross-Site Request Forgery (CSRF)

OpenShift Enterprise is vulnerable to cross-site request forgery CSRF. The server is unable to verify the authenticity of web requests due to a lack of anti-CSRF protection mechanism in the REST API, allowing an attacker to submit requests on behalf of the user, and potentially obtain credentials...

Cross-site Request Forgery

OpenShift is susceptible to Cross-Site Request Forgery CSRF attacks. It has a flaw in management console openshift console/app/controllers/applicationcontroller.rb, allowing the attacker to steal the authenticated user session...

Important: Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix and enhancement update

Red Hat OpenShift Container Platform release 3.11.59 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud...

Moderate: Red Hat Bug Fix Advisory: OpenShift Container Platform 3.9 bug fix and enhancement update

Red Hat OpenShift Container Platform release 3.9.60 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud...

[SECURITY] Fedora 29 Update: origin-3.11.1-1.fc29

OpenShift Origin is a distribution of Kubernetes optimized for enterprise a pplication development and deployment. OpenShift Origin adds developer and operational centric tools on top of Kubernetes to enable rapid application development, easy deployment and scaling, and long-term lifecycle...

Security Bulletin: IBM MQ Cloud Paks are vulnerable to multiple vulnerabilities in Systemd (CVE-2018-15688 CVE-2018-15687 CVE-2018-15686)

Summary Several vulnerabilities were identified with versions of Systemd which is included in IBM MQ Cloud Paks. Vulnerability Details CVEID: CVE-2018-15686 DESCRIPTION: systemd could allow a local attacker to gain elevated privileges on the system, caused by a flaw in the unitdeserialize functio...

Important: Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix and enhancement update

Red Hat OpenShift Container Platform releases 3.11.51 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private clou...

RHEL 7 : openshift (RHSA-2016:0070)

Red Hat OpenShift Enterprise release 3.1.1 is now available with updates to packages that fix several security issues, bugs and introduce feature enhancements. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores,...

RHEL 6 : Ruby on Rails (RHSA-2013:0153)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:0153 advisory. Ruby on Rails is a modelviewcontroller MVC framework for web application development. Action Pack implements the controller and the view components...

RHEL 6 : openshift (RHSA-2013:0582)

Red Hat OpenShift Enterprise 1.1.1 is now available. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in...

RHEL 6 : Red Hat OpenShift Enterprise 1.1 update (Important) (RHSA-2013:0220)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0220 advisory. Red Hat OpenShift Enterprise is a cloud computing Platform-as-a-Service PaaS solution designed for on-premise or private cloud deployments...

RHEL 6 : ruby193-ruby, rubygem-json and rubygem-rdoc (RHSA-2013:0701)

Updated ruby193-ruby, rubygem-json and rubygem-rdoc packages that fix two security issues are now available for Red Hat OpenShift Enterprise 1.1.3. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores,...

RHEL 6 : openshift-origin-node-util (RHSA-2013:0148)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2013:0148 advisory. The openshift-origin-node-util package provides a set of utility scripts for a node. Red Hat OpenShift Enterprise is a cloud computing...