Detections
Analytics

RHEL 7 : atomic-openshift (RHSA-2016:1427)

medium Nessus Plugin ID 119376

Language:

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

An update for atomic-openshift is now available for Red Hat OpenShift Enterprise 3.2.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

OpenShift Enterprise by Red Hat is the company's cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments.

Security Fix(es) :

* The Kubernetes API server contains a watch cache that speeds up performance. Due to an input validation error OpenShift Enterprise may return data for other users and projects when queried by a user. An attacker with knowledge of other project names could use this vulnerability to view their information. (CVE-2016-5392)

This issue was discovered by Yanping Zhang (Red Hat).

This updates includes the following images :

openshift3/openvswitch:v3.2.1.7-1 openshift3/ose-pod:v3.2.1.7-1 openshift3/ose:v3.2.1.7-1 openshift3/ose-docker-registry:v3.2.1.7-1 openshift3/ose-keepalived-ipfailover:v3.2.1.7-1 openshift3/ose-recycler:v3.2.1.7-1 openshift3/ose-f5-router:v3.2.1.7-1 openshift3/ose-deployer:v3.2.1.7-1 openshift3/node:v3.2.1.7-1 openshift3/ose-sti-builder:v3.2.1.7-1 openshift3/ose-docker-builder:v3.2.1.7-1 openshift3/ose-haproxy-router:v3.2.1.7-1

All OpenShift Enterprise 3 users are advised to upgrade to these updated packages and images.

Solution

Update the affected packages.

See Also

https://access.redhat.com/errata/RHSA-2016:1427

https://access.redhat.com/security/cve/cve-2016-5392

Plugin Details

Severity: Medium

ID: 119376

File Name: redhat-RHSA-2016-1427.nasl

Version: 1.5

Type: local

Agent: unix

Published: 12/4/2018

Updated: 6/11/2020

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:redhat:enterprise_linux:7, p-cpe:/a:redhat:enterprise_linux:atomic-openshift, p-cpe:/a:redhat:enterprise_linux:atomic-openshift-clients, p-cpe:/a:redhat:enterprise_linux:atomic-openshift-clients-redistributable, p-cpe:/a:redhat:enterprise_linux:atomic-openshift-dockerregistry, p-cpe:/a:redhat:enterprise_linux:atomic-openshift-master, p-cpe:/a:redhat:enterprise_linux:atomic-openshift-node, p-cpe:/a:redhat:enterprise_linux:atomic-openshift-pod, p-cpe:/a:redhat:enterprise_linux:atomic-openshift-recycle, p-cpe:/a:redhat:enterprise_linux:atomic-openshift-sdn-ovs, p-cpe:/a:redhat:enterprise_linux:atomic-openshift-tests, p-cpe:/a:redhat:enterprise_linux:tuned-profiles-atomic-openshift-node

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Ease: No known exploits are available

Patch Publication Date: 7/14/2016

Vulnerability Publication Date: 8/5/2016

Reference Information

CVE: CVE-2016-5392

RHSA: 2016:1427