RHSA-2013:1852: Moderate: Red Hat Enterprise MRG Grid 2.4 security update

Red Hat Enterprise MRG (Messaging, Realtime, and Grid) is a next-generationIT infrastructure for enterprise computing. MRG offers increasedperformance, reliability, interoperability, and faster computing forenterprise customers.MRG Grid provides high-throughput computing and enables enterprises toachieve higher peak computing capacity as well as improved infrastructureutilization by leveraging their existing technology to build highperformance grids. MRG Grid provides a job-queueing mechanism, schedulingpolicy, and a priority scheme, as well as resource monitoring and resourcemanagement. Users submit their jobs to MRG Grid, where they are placed intoa queue. MRG Grid then chooses when and where to run the jobs based upon apolicy, carefully monitors their progress, and ultimately informs the userupon completion.It was found that, when using RubyGems, the connection could be redirectedfrom HTTPS to HTTP. This could lead to a user believing they are installinga gem via HTTPS, when the connection may have been silently downgraded toHTTP. (CVE-2012-2125)It was found that RubyGems did not verify SSL connections. This could leadto man-in-the-middle attacks. (CVE-2012-2126)It was discovered that the rubygems API validated version strings using anunsafe regular expression. An application making use of this API to processa version string from an untrusted source could be vulnerable to a denialof service attack through CPU exhaustion. (CVE-2013-4287)A flaw was found in the way cumin enforced user roles, allowing anunprivileged cumin user to access a range of resources without having theappropriate role. A remote, authenticated attacker could use this flaw toaccess privileged information, and perform a variety of privilegedoperations. (CVE-2013-4404)It was found that multiple forms in the cumin web interface did not protectagainst Cross-Site Request Forgery (CSRF) attacks. If a remote attackercould trick a user, who is logged into the cumin web interface, intovisiting a specially crafted URL, the attacker could perform actions in thecontext of the logged in user. (CVE-2013-4405)It was found that cumin did not properly escape input from the "Maxallowance" field in the "Set limit" form of the cumin web interface.A remote attacker could use this flaw to perform cross-site scripting (XSS)attacks against victims by tricking them into visiting a specially craftedURL. (CVE-2013-4414)A flaw was found in the way cumin parsed POST request data. A remoteattacker could potentially use this flaw to perform SQL injection attackson cumin's database. (CVE-2013-4461)Red Hat would like to thank Rubygems upstream for reporting CVE-2013-4287.Upstream acknowledges Damir Sharipov as the original reporter ofCVE-2013-4287. The CVE-2013-4404, CVE-2013-4405, CVE-2013-4414, andCVE-2013-4461 issues were discovered by Tomáš Nováčik of the Red Hat MRGQuality Engineering team.All users of the Grid capabilities of Red Hat Enterprise MRG are advised toupgrade to these updated packages, which correct these issues.