RHSA-2013:0638: Moderate: Red Hat OpenShift Enterprise 1.1.2 update

OpenShift Enterprise is a cloud computing Platform-as-a-Service (PaaS)solution from Red Hat, and is designed for on-premise or private clouddeployments.A flaw was found in the handling of paths provided to ruby193-rubygem-rack.A remote attacker could use this flaw to conduct a directory traversalattack by passing malformed requests. (CVE-2013-0262)A timing attack flaw was found in the way rubygem-rack andruby193-rubygem-rack processed HMAC digests in cookies. This flaw could aidan attacker using forged digital signatures to bypass authenticationchecks. (CVE-2013-0263)It was found that Jenkins did not protect against Cross-Site RequestForgery (CSRF) attacks. If a remote attacker could trick a user, who waslogged into Jenkins, into visiting a specially-crafted URL, the attackercould perform operations on Jenkins. (CVE-2013-0327, CVE-2013-0329)A cross-site scripting (XSS) flaw was found in Jenkins. A remote attackercould use this flaw to conduct an XSS attack against users of Jenkins.(CVE-2013-0328)A flaw could allow a Jenkins user to build jobs they do not have access to.(CVE-2013-0330)A flaw could allow a Jenkins user to cause a denial of service if theyare able to supply a specially-crafted payload. (CVE-2013-0331)Users are advised to upgrade to Red Hat OpenShift Enterprise 1.1.2. It isrecommended that you restart your system after applying this update.