The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to a passthrough trigger.

Skip to navigation Skip to main content

**Utilities**

*   Subscriptions
*   Downloads
*   Containers
*   Support Cases

**Infrastructure and Management**

*   Red Hat Enterprise Linux
*   Red Hat Virtualization
*   Red Hat Identity Management
*   Red Hat Directory Server
*   Red Hat Certificate System
*   Red Hat Satellite
*   Red Hat Subscription Management
*   Red Hat Update Infrastructure
*   Red Hat Insights
*   Red Hat Ansible Automation Platform

**Cloud Computing**

*   Red Hat OpenShift
*   Red Hat CloudForms
*   Red Hat OpenStack Platform
*   Red Hat OpenShift Container Platform
*   Red Hat OpenShift Data Science
*   Red Hat OpenShift Online
*   Red Hat OpenShift Dedicated
*   Red Hat Advanced Cluster Security for Kubernetes
*   Red Hat Advanced Cluster Management for Kubernetes
*   Red Hat Quay
*   OpenShift Dev Spaces
*   Red Hat OpenShift Service on AWS

**Storage**

*   Red Hat Gluster Storage
*   Red Hat Hyperconverged Infrastructure
*   Red Hat Ceph Storage
*   Red Hat OpenShift Data Foundation

**Runtimes**

*   Red Hat Runtimes
*   Red Hat JBoss Enterprise Application Platform
*   Red Hat Data Grid
*   Red Hat JBoss Web Server
*   Red Hat Single Sign On
*   Red Hat support for Spring Boot
*   Red Hat build of Node.js
*   Red Hat build of Thorntail
*   Red Hat build of Eclipse Vert.x
*   Red Hat build of OpenJDK
*   Red Hat build of Quarkus

**Integration and Automation**

*   Red Hat Process Automation
*   Red Hat Process Automation Manager
*   Red Hat Decision Manager

All Products

Issued:

2014-04-23

Updated:

2014-04-23

**RHSA-2014:0423 - Security Advisory**

*   Overview
*   Updated Packages

**Synopsis**

Critical: openshift-origin-broker security update

**Type/Severity**

Security Advisory: Critical

**Red Hat Insights patch analysis**

Identify and remediate systems affected by this advisory.

View affected systems

**Topic**

Updated openshift-origin-broker and  
rubygem-openshift-origin-auth-remote-user packages that fix one security  
issue are now available for Red Hat OpenShift Enterprise 2.0.5.  

The Red Hat Security Response Team has rated this update as having Critical  
security impact. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available from the CVE link in  
the References section.  

**Description**

The openshift-origin-broker package provides the OpenShift Broker service  
that manages all user logins, DNS name resolution, application states, and  
general orchestration of the applications.  

The rubygem-openshift-origin-auth-remote-user package provides the remote  
user authentication plug-in.  

A flaw was found in the way openshift-origin-broker handled authentication  
requests via the remote user authentication plug-in. A remote attacker able  
to submit a request to openshift-origin-broker could set the X-Remote-User  
header, and send the request to a passthrough trigger, resulting in a  
bypass of the authentication checks to gain access to any OpenShift user  
account on the system. (CVE-2014-0188)  

All users of Red Hat OpenShift Enterprise 2.0.5 are advised to upgrade to  
these updated packages, which contain a backported patch to correct this  
issue. After installing the updated packages, restart the httpd daemon for  
this update to take effect.  

**Solution**

Before applying this update, make sure all previously released errata  
relevant to your system have been applied.  

This update is available via the Red Hat Network. Details on how to  
use the Red Hat Network to apply this update are available at  
https://access.redhat.com/site/articles/11258

**Affected Products**

*   Red Hat OpenShift Enterprise Infrastructure 2.0 x86\_64

**Fixes**

*   BZ - 1090120 - CVE-2014-0188 OpenShift: openshift-origin-broker plugin allows impersonation

**Red Hat OpenShift Enterprise Infrastructure 2.0**

SRPM

openshift-origin-broker-1.15.3.5-1.el6op.src.rpm

SHA-256: 93a29a5825cd8eb423084f0e12a11c877c30099d26ddbd1a504e13b591e72f22

rubygem-openshift-origin-auth-remote-user-1.17.4-1.el6op.src.rpm

SHA-256: 90c54d8a2e689a06a55d67ad4d79523587e13a231fa42bc4aa4de1375dd17171

x86\_64

openshift-origin-broker-1.15.3.5-1.el6op.noarch.rpm

SHA-256: e1afea87a03505424977f306a75baa2957a107d992d4cb5ca1ea164570b5ef24

rubygem-openshift-origin-auth-remote-user-1.17.4-1.el6op.noarch.rpm

SHA-256: aaebae1b7ea53f828d609a754fef7635792b01777936d1e4265bed25c632c4f0

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.

CVE-2014-0188: Red Hat Customer Portal - Access to 24x7 support and knowledge

Skip to navigation Skip to main content

**Utilities**

*   Subscriptions
*   Downloads
*   Containers
*   Support Cases

**Infrastructure and Management**

*   Red Hat Enterprise Linux
*   Red Hat Virtualization
*   Red Hat Identity Management
*   Red Hat Directory Server
*   Red Hat Certificate System
*   Red Hat Satellite
*   Red Hat Subscription Management
*   Red Hat Update Infrastructure
*   Red Hat Insights
*   Red Hat Ansible Automation Platform

**Cloud Computing**

*   Red Hat OpenShift
*   Red Hat CloudForms
*   Red Hat OpenStack Platform
*   Red Hat OpenShift Container Platform
*   Red Hat OpenShift Data Science
*   Red Hat OpenShift Online
*   Red Hat OpenShift Dedicated
*   Red Hat Advanced Cluster Security for Kubernetes
*   Red Hat Advanced Cluster Management for Kubernetes
*   Red Hat Quay
*   OpenShift Dev Spaces
*   Red Hat OpenShift Service on AWS

**Storage**

*   Red Hat Gluster Storage
*   Red Hat Hyperconverged Infrastructure
*   Red Hat Ceph Storage
*   Red Hat OpenShift Data Foundation

**Runtimes**

*   Red Hat Runtimes
*   Red Hat JBoss Enterprise Application Platform
*   Red Hat Data Grid
*   Red Hat JBoss Web Server
*   Red Hat Single Sign On
*   Red Hat support for Spring Boot
*   Red Hat build of Node.js
*   Red Hat build of Thorntail
*   Red Hat build of Eclipse Vert.x
*   Red Hat build of OpenJDK
*   Red Hat build of Quarkus

**Integration and Automation**

*   Red Hat Process Automation
*   Red Hat Process Automation Manager
*   Red Hat Decision Manager

All Products

Issued:

2013-03-12

Updated:

2013-03-12

**RHSA-2013:0638 - Security Advisory**

*   Overview
*   Updated Packages

**Synopsis**

Moderate: Red Hat OpenShift Enterprise 1.1.2 update

**Type/Severity**

Security Advisory: Moderate

**Red Hat Insights patch analysis**

Identify and remediate systems affected by this advisory.

View affected systems

**Topic**

Red Hat OpenShift Enterprise 1.1.2, which fixes several security issues, is  
now available.  

The Red Hat Security Response Team has rated this update as having moderate  
security impact. Common Vulnerability Scoring System (CVSS) base scores,  
which give detailed severity ratings, are available for each vulnerability  
from the CVE links in the References section.  

**Description**

OpenShift Enterprise is a cloud computing Platform-as-a-Service (PaaS)  
solution from Red Hat, and is designed for on-premise or private cloud  
deployments.  

A flaw was found in the handling of paths provided to ruby193-rubygem-rack.  
A remote attacker could use this flaw to conduct a directory traversal  
attack by passing malformed requests. (CVE-2013-0262)  

A timing attack flaw was found in the way rubygem-rack and  
ruby193-rubygem-rack processed HMAC digests in cookies. This flaw could aid  
an attacker using forged digital signatures to bypass authentication  
checks. (CVE-2013-0263)  

It was found that Jenkins did not protect against Cross-Site Request  
Forgery (CSRF) attacks. If a remote attacker could trick a user, who was  
logged into Jenkins, into visiting a specially-crafted URL, the attacker  
could perform operations on Jenkins. (CVE-2013-0327, CVE-2013-0329)  

A cross-site scripting (XSS) flaw was found in Jenkins. A remote attacker  
could use this flaw to conduct an XSS attack against users of Jenkins.  
(CVE-2013-0328)  

A flaw could allow a Jenkins user to build jobs they do not have access to.  
(CVE-2013-0330)  

A flaw could allow a Jenkins user to cause a denial of service if they  
are able to supply a specially-crafted payload. (CVE-2013-0331)  

Users are advised to upgrade to Red Hat OpenShift Enterprise 1.1.2. It is  
recommended that you restart your system after applying this update.  

**Solution**

Before applying this update, make sure all previously-released errata  
relevant to your system have been applied.  

This update is available via the Red Hat Network. Details on how to  
use the Red Hat Network to apply this update are available at  
https://access.redhat.com/knowledge/articles/11258

**Affected Products**

*   Red Hat OpenShift Enterprise Infrastructure 1 x86\_64
*   Red Hat OpenShift Enterprise Application Node 1 x86\_64

**Fixes**

*   BZ - 909071 - CVE-2013-0263 rubygem-rack: Timing attack in cookie sessions
*   BZ - 909072 - CVE-2013-0262 rubygem-rack: Path sanitization information disclosure
*   BZ - 914875 - CVE-2013-0327 jenkins: cross-site request forgery (CSRF) on Jenkins master
*   BZ - 914876 - CVE-2013-0328 jenkins: XSS
*   BZ - 914877 - CVE-2013-0329 jenkins: cross-site request forgery (CSRF) protection mechanism bypass
*   BZ - 914878 - CVE-2013-0330 jenkins: cause building jobs without direct access
*   BZ - 914879 - CVE-2013-0331 jenkins: denial of service attack by feeding a carefully crafted payload to Jenkins

**CVEs**

*   CVE-2013-0331
*   CVE-2013-0330
*   CVE-2013-0328
*   CVE-2013-0329
*   CVE-2013-0327
*   CVE-2013-0263
*   CVE-2013-0262

**References**

*   https://access.redhat.com/security/updates/classification/#moderate
*   https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16

**Red Hat OpenShift Enterprise Infrastructure 1**

SRPM

ruby193-rubygem-rack-1.4.1-4.el6.src.rpm

SHA-256: 72c0e0fb5d2a390ae9d9b96a3fd3b35b625e8dd89f57637e050ce5cd6d2e3a15

rubygem-rack-1.3.0-4.el6op.src.rpm

SHA-256: 1759f40fee2309d75fa95f826716f5a9d92b31b80f1a4145541d0382503ee712

x86\_64

ruby193-rubygem-rack-1.4.1-4.el6.noarch.rpm

SHA-256: 869f90f3950c348359630c71f1523970ecb31319f849b17ac60196104225442f

rubygem-rack-1.3.0-4.el6op.noarch.rpm

SHA-256: 2d90dcaadba134c77ebc9cf91c532daf815c761d90cb0309e86c42eeaac59700

**Red Hat OpenShift Enterprise Application Node 1**

SRPM

jenkins-1.502-1.el6op.src.rpm

SHA-256: 7bdbae661a29614f8b1286fefe4d930bd3e2818e40f59c5f8af47650e06a4080

openshift-origin-cartridge-jenkins-1.4-1.0.3-1.el6op.src.rpm

SHA-256: cb7b7a2da23c916ab27ede440cc5a5c5ce44d39439be07695491f03a547108b2

ruby193-rubygem-rack-1.4.1-4.el6.src.rpm

SHA-256: 72c0e0fb5d2a390ae9d9b96a3fd3b35b625e8dd89f57637e050ce5cd6d2e3a15

rubygem-rack-1.3.0-4.el6op.src.rpm

SHA-256: 1759f40fee2309d75fa95f826716f5a9d92b31b80f1a4145541d0382503ee712

x86\_64

jenkins-1.502-1.el6op.noarch.rpm

SHA-256: 23e59c10171af3d4126f091d8694c0cc19fe9876abd89da4c55846ac6a9f31a5

openshift-origin-cartridge-jenkins-1.4-1.0.3-1.el6op.noarch.rpm

SHA-256: 07144ee29f8822352bc0c83198c59fe90bce6b3f11b3cb36a62216da702cbbb1

ruby193-rubygem-rack-1.4.1-4.el6.noarch.rpm

SHA-256: 869f90f3950c348359630c71f1523970ecb31319f849b17ac60196104225442f

rubygem-rack-1.3.0-4.el6op.noarch.rpm

SHA-256: 2d90dcaadba134c77ebc9cf91c532daf815c761d90cb0309e86c42eeaac59700

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.

CVE-2013-0328: Red Hat Customer Portal - Access to 24x7 support and knowledge

RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity (XXE) injection attack.

Skip to navigation Skip to main content

**Utilities**

*   Subscriptions
*   Downloads
*   Containers
*   Support Cases

**Infrastructure and Management**

*   Red Hat Enterprise Linux
*   Red Hat Virtualization
*   Red Hat Identity Management
*   Red Hat Directory Server
*   Red Hat Certificate System
*   Red Hat Satellite
*   Red Hat Subscription Management
*   Red Hat Update Infrastructure
*   Red Hat Insights
*   Red Hat Ansible Automation Platform

**Cloud Computing**

*   Red Hat OpenShift
*   Red Hat CloudForms
*   Red Hat OpenStack Platform
*   Red Hat OpenShift Container Platform
*   Red Hat OpenShift Data Science
*   Red Hat OpenShift Online
*   Red Hat OpenShift Dedicated
*   Red Hat Advanced Cluster Security for Kubernetes
*   Red Hat Advanced Cluster Management for Kubernetes
*   Red Hat Quay
*   OpenShift Dev Spaces
*   Red Hat OpenShift Service on AWS

**Storage**

*   Red Hat Gluster Storage
*   Red Hat Hyperconverged Infrastructure
*   Red Hat Ceph Storage
*   Red Hat OpenShift Data Foundation

**Runtimes**

*   Red Hat Runtimes
*   Red Hat JBoss Enterprise Application Platform
*   Red Hat Data Grid
*   Red Hat JBoss Web Server
*   Red Hat Single Sign On
*   Red Hat support for Spring Boot
*   Red Hat build of Node.js
*   Red Hat build of Thorntail
*   Red Hat build of Eclipse Vert.x
*   Red Hat build of OpenJDK
*   Red Hat build of Quarkus

**Integration and Automation**

*   Red Hat Process Automation
*   Red Hat Process Automation Manager
*   Red Hat Decision Manager

All Products

Issued:

2012-07-05

Updated:

2012-07-05

**RHSA-2012:1058 - Security Advisory**

*   Overview
*   Updated Packages

**Synopsis**

Moderate: resteasy security update

**Type/Severity**

Security Advisory: Moderate

**Red Hat Insights patch analysis**

Identify and remediate systems affected by this advisory.

View affected systems

**Topic**

Updated resteasy packages that fix one security issue are now available for  
JBoss Enterprise Web Platform 5.1.2 for Red Hat Enterprise Linux 4, 5, and  
6.  

The Red Hat Security Response Team has rated this update as having moderate  
security impact. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available from the CVE link in  
the References section.  

**Description**

RESTEasy provides various frameworks to help you build RESTful web services  
and RESTful Java applications.  

It was found that RESTEasy was vulnerable to XML External Entity (XXE)  
attacks. If a remote attacker submitted a request containing an external  
XML entity to a RESTEasy endpoint, the entity would be resolved, allowing  
the attacker to read files accessible to the user running the application  
server. This flaw affected DOM (Document Object Model) Document and JAXB  
(Java Architecture for XML Binding) input. (CVE-2012-0818)  

Note: The fix for CVE-2012-0818 is not enabled by default. This update adds  
a new configuration option to disable entity expansion in RESTEasy. If  
applications on your server expose RESTEasy XML endpoints, a  
resteasy.document.expand.entity.references configuration snippet must be  
added to their web.xml file to disable entity expansion in RESTEasy. Refer  
to Red Hat Bugzilla bug 785631 for details.  

Warning: Before applying this update, back up your JBoss Enterprise Web  
Platform's "jboss-as-web/server/\[PROFILE\]/deploy/" directory and any other  
customized configuration files.  

Users of JBoss Enterprise Web Platform 5.1.2 on Red Hat Enterprise Linux 4,  
5, and 6 should upgrade to these updated packages, which correct this  
issue. The JBoss server process must be restarted for this update to take  
effect.  

**Solution**

Before applying this update, make sure all previously-released errata  
relevant to your system have been applied.  

This update is available via the Red Hat Network. Details on how to  
use the Red Hat Network to apply this update are available at  
https://access.redhat.com/knowledge/articles/11258

**Affected Products**

*   JBoss Enterprise Web Platform 5 for RHEL 6 x86\_64
*   JBoss Enterprise Web Platform 5 for RHEL 6 i386
*   JBoss Enterprise Web Platform 5 for RHEL 5 x86\_64
*   JBoss Enterprise Web Platform 5 for RHEL 5 i386

**Fixes**

*   BZ - 785631 - CVE-2012-0818 RESTEasy: XML eXternal Entity (XXE) flaw

**References**

*   https://access.redhat.com/security/updates/classification/#moderate
*   https://bugzilla.redhat.com/show\_bug.cgi?id=785631

**JBoss Enterprise Web Platform 5 for RHEL 6**

SRPM

resteasy-1.2.1-10.CP02\_patch01.1.ep5.el6.src.rpm

SHA-256: 3a4aa131006b3f037162518ce8d3881cf20627e5fad57dc0178d16f51a3f2c34

x86\_64

resteasy-1.2.1-10.CP02\_patch01.1.ep5.el6.noarch.rpm

SHA-256: f6cf36beb96b4eba2422aaa299680bb5998f3bb2e666d1440e17402778064556

resteasy-examples-1.2.1-10.CP02\_patch01.1.ep5.el6.noarch.rpm

SHA-256: 66e767ff2fb833d7110ada14a4cfca2855dd0e6f0a06ee5bcaa3f164b36773aa

resteasy-javadoc-1.2.1-10.CP02\_patch01.1.ep5.el6.noarch.rpm

SHA-256: 87ce316af43982a162478015b480121e4519cde5bb925f9b7dfe4d15e743a6a7

resteasy-manual-1.2.1-10.CP02\_patch01.1.ep5.el6.noarch.rpm

SHA-256: 99aaf805ad64df41f06723f68dc403f1c4ff9a8e03e56d08d1ccca29c53e19d5

i386

resteasy-1.2.1-10.CP02\_patch01.1.ep5.el6.noarch.rpm

SHA-256: f6cf36beb96b4eba2422aaa299680bb5998f3bb2e666d1440e17402778064556

resteasy-examples-1.2.1-10.CP02\_patch01.1.ep5.el6.noarch.rpm

SHA-256: 66e767ff2fb833d7110ada14a4cfca2855dd0e6f0a06ee5bcaa3f164b36773aa

resteasy-javadoc-1.2.1-10.CP02\_patch01.1.ep5.el6.noarch.rpm

SHA-256: 87ce316af43982a162478015b480121e4519cde5bb925f9b7dfe4d15e743a6a7

resteasy-manual-1.2.1-10.CP02\_patch01.1.ep5.el6.noarch.rpm

SHA-256: 99aaf805ad64df41f06723f68dc403f1c4ff9a8e03e56d08d1ccca29c53e19d5

**JBoss Enterprise Web Platform 5 for RHEL 5**

SRPM

resteasy-1.2.1-10.CP02\_patch01.1.ep5.el5.src.rpm

SHA-256: ee147792cda48183d01057a03330a79257b1d81ce6d7ea8620db591b98068b31

x86\_64

resteasy-1.2.1-10.CP02\_patch01.1.ep5.el5.noarch.rpm

SHA-256: f56fa438a6f2224e0d202a6b8de6a0932381c09aa5fc55eaa78301f156bd7b8f

resteasy-examples-1.2.1-10.CP02\_patch01.1.ep5.el5.noarch.rpm

SHA-256: e8412efaa309aa52bfb86f39ac3009e5d0033e3c9f568da90436f2443e3d038e

resteasy-javadoc-1.2.1-10.CP02\_patch01.1.ep5.el5.noarch.rpm

SHA-256: ce177e7e41c6651fbebe4b3ac6235cb0a2f79482a9ee9067ae36391be84351b1

resteasy-manual-1.2.1-10.CP02\_patch01.1.ep5.el5.noarch.rpm

SHA-256: 9ebfc64848b1f317822f255d08e9bcb72c85e69ff4965836ab0884cdc68ca0f6

i386

resteasy-1.2.1-10.CP02\_patch01.1.ep5.el5.noarch.rpm

SHA-256: f56fa438a6f2224e0d202a6b8de6a0932381c09aa5fc55eaa78301f156bd7b8f

resteasy-examples-1.2.1-10.CP02\_patch01.1.ep5.el5.noarch.rpm

SHA-256: e8412efaa309aa52bfb86f39ac3009e5d0033e3c9f568da90436f2443e3d038e

resteasy-javadoc-1.2.1-10.CP02\_patch01.1.ep5.el5.noarch.rpm

SHA-256: ce177e7e41c6651fbebe4b3ac6235cb0a2f79482a9ee9067ae36391be84351b1

resteasy-manual-1.2.1-10.CP02\_patch01.1.ep5.el5.noarch.rpm

SHA-256: 9ebfc64848b1f317822f255d08e9bcb72c85e69ff4965836ab0884cdc68ca0f6

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.

Tag

#aws