RHSA-2016:0070: Important: Red Hat OpenShift Enterprise 3.1.1 bug fix and enhancement update

Published Jan 26, 2016
·
Updated

OpenShift Enterprise by Red Hat is the company's cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments.The following security issues are addressed with this release:An authorization flaw was discovered in Kubernetes; the API server did not properly check user permissions when handling certain requests. An authenticated remote attacker could use this flaw to gain additional access to resources such as RAM and disk space. (CVE-2016-1905)An authorization flaw was discovered in Kubernetes; the API server did not properly check user permissions when handling certain build-configuration strategies. A remote attacker could create build configurations with strategies that violate policy. Although the attacker could not launch the build themselves (launch fails when the policy is violated), if the build configuration files were later launched by other privileged services (such as automated triggers), user privileges could be bypassed allowing attacker escalation. (CVE-2016-1906)An update for Jenkins Continuous Integration Server that addresses a large number of security issues including XSS, CSRF, information disclosure and code execution have been addressed as well. (CVE-2013-2186, CVE-2014-1869, CVE-2014-3661, CVE-2014-3662CVE-2014-3663, CVE-2014-3664, CVE-2014-3666, CVE-2014-3667CVE-2014-3680, CVE-2014-3681, CVE-2015-1806, CVE-2015-1807CVE-2015-1808, CVE-2015-1810, CVE-2015-1812, CVE-2015-1813CVE-2015-1814, CVE-2015-5317, CVE-2015-5318, CVE-2015-5319CVE-2015-5320, CVE-2015-5321, CVE-2015-5322, CVE-2015-5323CVE-2015-5324, CVE-2015-5325, CVE-2015-5326 ,CVE-2015-7537CVE-2015-7538, CVE-2015-7539, CVE-2015-8103)Space precludes documenting all of the bug fixes and enhancements in this advisory. See the OpenShift Enterprise 3.1 Release Notes, which will be updated shortly for release 3.1.1, for details about these changes:https://docs.openshift.com/enterprise/3.1/releasenotes/ose31releasenotes.html All OpenShift Enterprise 3 users are advised to upgrade to these updated packages.

Affected Software

136 affected componentsFixes available
redhat/atomic-openshift<3.1.1.6-1.git.0.b57e8bd.el7a
3.1.1.6-1.git.0.b57e8bd.el7a
redhat/heapster<0.18.2-3.gitaf4752e.el7a
0.18.2-3.gitaf4752e.el7a
redhat/jenkins<1.625.3-2.el7a
1.625.3-2.el7a
redhat/nodejs-align-text<0.1.3-2.el7a
0.1.3-2.el7a
redhat/nodejs-ansi-green<0.1.1-1.el7a
0.1.1-1.el7a
redhat/nodejs-ansi-wrap<0.1.0-1.el7a
0.1.0-1.el7a
redhat/nodejs-anymatch<1.3.0-1.el7a
1.3.0-1.el7a
redhat/nodejs-arr-diff<2.0.0-1.el7a
2.0.0-1.el7a
redhat/nodejs-arr-flatten<1.0.1-1.el7a
1.0.1-1.el7a
redhat/nodejs-array-unique<0.2.1-1.el7a
0.2.1-1.el7a
redhat/nodejs-arrify<1.0.0-1.el7a
1.0.0-1.el7a
redhat/nodejs-async-each<1.0.0-1.el7a
1.0.0-1.el7a
redhat/nodejs-binary-extensions<1.3.1-1.el7a
1.3.1-1.el7a
redhat/nodejs-braces<1.8.2-2.el7a
1.8.2-2.el7a
redhat/nodejs-capture-stack-trace<1.0.0-2.el7a
1.0.0-2.el7a
redhat/nodejs-chokidar<1.4.1-2.el7a
1.4.1-2.el7a
redhat/nodejs-configstore<1.4.0-1.el7a
1.4.0-1.el7a
redhat/nodejs-create-error-class<2.0.1-2.el7a
2.0.1-2.el7a
redhat/nodejs-deep-extend<0.3.2-2.el7a
0.3.2-2.el7a
redhat/nodejs-duplexer<0.1.1-2.el7a
0.1.1-2.el7a
redhat/nodejs-duplexify<3.4.2-1.el7a
3.4.2-1.el7a
redhat/nodejs-end-of-stream<1.1.0-2.el7a
1.1.0-2.el7a
redhat/nodejs-error-ex<1.2.0-1.el7a
1.2.0-1.el7a
redhat/nodejs-es6-promise<3.0.2-2.el7a
3.0.2-2.el7a
redhat/nodejs-event-stream<3.3.2-1.el7a
3.3.2-1.el7a
redhat/nodejs-expand-brackets<0.1.4-1.el7a
0.1.4-1.el7a
redhat/nodejs-expand-range<1.8.1-1.el7a
1.8.1-1.el7a
redhat/nodejs-extglob<0.3.1-1.el7a
0.3.1-1.el7a
redhat/nodejs-filename-regex<2.0.0-1.el7a
2.0.0-1.el7a
redhat/nodejs-fill-range<2.2.3-1.el7a
2.2.3-1.el7a
redhat/nodejs-for-in<0.1.4-1.el7a
0.1.4-1.el7a
redhat/nodejs-for-own<0.1.3-1.el7a
0.1.3-1.el7a
redhat/nodejs-from<0.1.3-2.el7a
0.1.3-2.el7a
redhat/nodejs-glob-base<0.3.0-1.el7a
0.3.0-1.el7a
redhat/nodejs-glob-parent<2.0.0-1.el7a
2.0.0-1.el7a
redhat/nodejs-got<5.2.1-1.el7a
5.2.1-1.el7a
redhat/nodejs-graceful-fs<4.1.2-1.el7a
4.1.2-1.el7a
redhat/nodejs-ini<1.1.0-6.el7a
1.1.0-6.el7a
redhat/nodejs-is-binary-path<1.0.1-1.el7a
1.0.1-1.el7a
redhat/nodejs-is-dotfile<1.0.2-1.el7a
1.0.2-1.el7a
redhat/nodejs-is-equal-shallow<0.1.3-1.el7a
0.1.3-1.el7a
redhat/nodejs-is-extendable<0.1.1-1.el7a
0.1.1-1.el7a
redhat/nodejs-is-extglob<1.0.0-1.el7a
1.0.0-1.el7a
redhat/nodejs-is-glob<2.0.1-1.el7a
2.0.1-1.el7a
redhat/nodejs-is-npm<1.0.0-1.el7a
1.0.0-1.el7a
redhat/nodejs-is-number<2.1.0-1.el7a
2.1.0-1.el7a
redhat/nodejs-is-plain-obj<1.0.0-1.el7a
1.0.0-1.el7a
redhat/nodejs-is-primitive<2.0.0-1.el7a
2.0.0-1.el7a
redhat/nodejs-is-redirect<1.0.0-1.el7a
1.0.0-1.el7a
redhat/nodejs-is-stream<1.0.1-2.el7a
1.0.1-2.el7a
redhat/nodejs-isobject<2.0.0-1.el7a
2.0.0-1.el7a
redhat/nodejs-kind-of<3.0.2-1.el7a
3.0.2-1.el7a
redhat/nodejs-latest-version<2.0.0-1.el7a
2.0.0-1.el7a
redhat/nodejs-lazy-cache<1.0.2-1.el7a
1.0.2-1.el7a
redhat/nodejs-lodash.assign<3.2.0-1.el7a
3.2.0-1.el7a
redhat/nodejs-lodash.baseassign<3.2.0-1.el7a
3.2.0-1.el7a
redhat/nodejs-lodash.basecopy<3.0.1-1.el7a
3.0.1-1.el7a
redhat/nodejs-lodash.bindcallback<3.0.1-1.el7a
3.0.1-1.el7a
redhat/nodejs-lodash.createassigner<3.1.1-1.el7a
3.1.1-1.el7a
redhat/nodejs-lodash.defaults<3.1.2-1.el7a
3.1.2-1.el7a
redhat/nodejs-lodash.getnative<3.9.1-1.el7a
3.9.1-1.el7a
redhat/nodejs-lodash.isarguments<3.0.4-1.el7a
3.0.4-1.el7a
redhat/nodejs-lodash.isarray<3.0.4-1.el7a
3.0.4-1.el7a
redhat/nodejs-lodash.isiterateecall<3.0.9-1.el7a
3.0.9-1.el7a
redhat/nodejs-lodash.keys<3.1.2-1.el7a
3.1.2-1.el7a
redhat/nodejs-lodash.restparam<3.6.1-1.el7a
3.6.1-1.el7a
redhat/nodejs-lowercase-keys<1.0.0-2.el7a
1.0.0-2.el7a
redhat/nodejs-map-stream<0.1.0-2.el7a
0.1.0-2.el7a
redhat/nodejs-micromatch<2.3.5-2.el7a
2.3.5-2.el7a
redhat/nodejs-mkdirp<0.5.0-2.el7a
0.5.0-2.el7a
redhat/nodejs-node-status-codes<1.0.0-1.el7a
1.0.0-1.el7a
redhat/nodejs-nodemon<1.8.1-2.el7a
1.8.1-2.el7a
redhat/nodejs-normalize-path<2.0.1-1.el7a
2.0.1-1.el7a
redhat/nodejs-object-assign<4.0.1-1.el7a
4.0.1-1.el7a
redhat/nodejs-object.omit<2.0.0-1.el7a
2.0.0-1.el7a
redhat/nodejs-optimist<0.4.0-5.el7a
0.4.0-5.el7a
redhat/nodejs-os-homedir<1.0.1-1.el7a
1.0.1-1.el7a
redhat/nodejs-os-tmpdir<1.0.1-1.el7a
1.0.1-1.el7a
redhat/nodejs-osenv<0.1.0-2.el7a
0.1.0-2.el7a
redhat/nodejs-package-json<2.3.0-1.el7a
2.3.0-1.el7a
redhat/nodejs-parse-glob<3.0.4-1.el7a
3.0.4-1.el7a
redhat/nodejs-parse-json<2.2.0-2.el7a
2.2.0-2.el7a
redhat/nodejs-pause-stream<0.0.11-2.el7a
0.0.11-2.el7a
redhat/nodejs-pinkie<2.0.1-1.el7a
2.0.1-1.el7a
redhat/nodejs-pinkie-promise<2.0.0-1.el7a
2.0.0-1.el7a
redhat/nodejs-prepend-http<1.0.1-2.el7a
1.0.1-2.el7a
redhat/nodejs-preserve<0.2.0-1.el7a
0.2.0-1.el7a
redhat/nodejs-ps-tree<1.0.1-1.el7a
1.0.1-1.el7a
redhat/nodejs-randomatic<1.1.5-1.el7a
1.1.5-1.el7a
redhat/nodejs-rc<1.1.2-1.el7a
1.1.2-1.el7a
redhat/nodejs-read-all-stream<3.0.1-3.el7a
3.0.1-3.el7a
redhat/nodejs-readdirp<2.0.0-2.el7a
2.0.0-2.el7a
redhat/nodejs-regex-cache<0.4.2-1.el7a
0.4.2-1.el7a
redhat/nodejs-registry-url<3.0.3-1.el7a
3.0.3-1.el7a
redhat/nodejs-repeat-element<1.1.2-1.el7a
1.1.2-1.el7a
redhat/nodejs-semver<5.1.0-1.el7a
5.1.0-1.el7a
redhat/nodejs-semver-diff<2.1.0-1.el7a
2.1.0-1.el7a
redhat/nodejs-slide<1.1.5-3.el7a
1.1.5-3.el7a
redhat/nodejs-split<0.3.3-2.el7a
0.3.3-2.el7a
redhat/nodejs-stream-combiner<0.2.1-2.el7a
0.2.1-2.el7a
redhat/nodejs-string-length<1.0.1-1.el7a
1.0.1-1.el7a
redhat/nodejs-strip-json-comments<1.0.2-2.el7a
1.0.2-2.el7a
redhat/nodejs-success-symbol<0.1.0-1.el7a
0.1.0-1.el7a
redhat/nodejs-through<2.3.4-4.el7a
2.3.4-4.el7a
redhat/nodejs-timed-out<2.0.0-3.el7a
2.0.0-3.el7a
redhat/nodejs-touch<1.0.0-2.el7a
1.0.0-2.el7a
redhat/nodejs-undefsafe<0.0.3-1.el7a
0.0.3-1.el7a
redhat/nodejs-unzip-response<1.0.0-1.el7a
1.0.0-1.el7a
redhat/nodejs-update-notifier<0.6.0-1.el7a
0.6.0-1.el7a
redhat/nodejs-url-parse-lax<1.0.0-1.el7a
1.0.0-1.el7a
redhat/nodejs-uuid<2.0.1-1.el7a
2.0.1-1.el7a
redhat/nodejs-write-file-atomic<1.1.2-2.el7a
1.1.2-2.el7a
redhat/nodejs-xdg-basedir<2.0.0-1.el7a
2.0.0-1.el7a
redhat/openshift-ansible<3.0.35-1.git.0.6a386dd.el7a
3.0.35-1.git.0.6a386dd.el7a
redhat/openvswitch<2.4.0-1.el7
2.4.0-1.el7
redhat/origin-kibana<0.5.0-1.el7a
0.5.0-1.el7a
redhat/atomic-openshift-clients<3.1.1.6-1.git.0.b57e8bd.el7a
3.1.1.6-1.git.0.b57e8bd.el7a
redhat/atomic-openshift-clients-redistributable<3.1.1.6-1.git.0.b57e8bd.el7a
3.1.1.6-1.git.0.b57e8bd.el7a
redhat/atomic-openshift-dockerregistry<3.1.1.6-1.git.0.b57e8bd.el7a
3.1.1.6-1.git.0.b57e8bd.el7a
redhat/atomic-openshift-master<3.1.1.6-1.git.0.b57e8bd.el7a
3.1.1.6-1.git.0.b57e8bd.el7a
redhat/atomic-openshift-node<3.1.1.6-1.git.0.b57e8bd.el7a
3.1.1.6-1.git.0.b57e8bd.el7a
redhat/atomic-openshift-pod<3.1.1.6-1.git.0.b57e8bd.el7a
3.1.1.6-1.git.0.b57e8bd.el7a
redhat/atomic-openshift-recycle<3.1.1.6-1.git.0.b57e8bd.el7a
3.1.1.6-1.git.0.b57e8bd.el7a
redhat/atomic-openshift-sdn-ovs<3.1.1.6-1.git.0.b57e8bd.el7a
3.1.1.6-1.git.0.b57e8bd.el7a
redhat/atomic-openshift-utils<3.0.35-1.git.0.6a386dd.el7a
3.0.35-1.git.0.6a386dd.el7a
redhat/openshift-ansible-docs<3.0.35-1.git.0.6a386dd.el7a
3.0.35-1.git.0.6a386dd.el7a
redhat/openshift-ansible-filter-plugins<3.0.35-1.git.0.6a386dd.el7a
3.0.35-1.git.0.6a386dd.el7a
redhat/openshift-ansible-lookup-plugins<3.0.35-1.git.0.6a386dd.el7a
3.0.35-1.git.0.6a386dd.el7a
redhat/openshift-ansible-playbooks<3.0.35-1.git.0.6a386dd.el7a
3.0.35-1.git.0.6a386dd.el7a
redhat/openshift-ansible-roles<3.0.35-1.git.0.6a386dd.el7a
3.0.35-1.git.0.6a386dd.el7a
redhat/openvswitch<2.4.0-1.el7
2.4.0-1.el7
redhat/openvswitch-debuginfo<2.4.0-1.el7
2.4.0-1.el7
redhat/openvswitch-devel<2.4.0-1.el7
2.4.0-1.el7
redhat/openvswitch-test<2.4.0-1.el7
2.4.0-1.el7
redhat/python-openvswitch<2.4.0-1.el7
2.4.0-1.el7
redhat/tuned-profiles-atomic-openshift-node<3.1.1.6-1.git.0.b57e8bd.el7a
3.1.1.6-1.git.0.b57e8bd.el7a

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/atomic-openshift to a version that resolves this vulnerability.

    Fixed in 3.1.1.6-1.git.0.b57e8bd.el7a
  2. Upgrade

    Upgrade redhat/heapster to a version that resolves this vulnerability.

    Fixed in 0.18.2-3.gitaf4752e.el7a
  3. Upgrade

    Upgrade redhat/jenkins to a version that resolves this vulnerability.

    Fixed in 1.625.3-2.el7a
  4. Upgrade

    Upgrade redhat/nodejs-align-text to a version that resolves this vulnerability.

    Fixed in 0.1.3-2.el7a
  5. Upgrade

    Upgrade redhat/nodejs-ansi-green to a version that resolves this vulnerability.

    Fixed in 0.1.1-1.el7a
  6. Upgrade

    Upgrade redhat/nodejs-ansi-wrap to a version that resolves this vulnerability.

    Fixed in 0.1.0-1.el7a
  7. Upgrade

    Upgrade redhat/nodejs-anymatch to a version that resolves this vulnerability.

    Fixed in 1.3.0-1.el7a
  8. Upgrade

    Upgrade redhat/nodejs-arr-diff to a version that resolves this vulnerability.

    Fixed in 2.0.0-1.el7a
  9. Upgrade

    Upgrade redhat/nodejs-arr-flatten to a version that resolves this vulnerability.

    Fixed in 1.0.1-1.el7a
  10. Upgrade

    Upgrade redhat/nodejs-array-unique to a version that resolves this vulnerability.

    Fixed in 0.2.1-1.el7a
  11. Upgrade

    Upgrade redhat/nodejs-arrify to a version that resolves this vulnerability.

    Fixed in 1.0.0-1.el7a
  12. Upgrade

    Upgrade redhat/nodejs-async-each to a version that resolves this vulnerability.

    Fixed in 1.0.0-1.el7a
  13. Upgrade

    Upgrade redhat/nodejs-binary-extensions to a version that resolves this vulnerability.

    Fixed in 1.3.1-1.el7a
  14. Upgrade

    Upgrade redhat/nodejs-braces to a version that resolves this vulnerability.

    Fixed in 1.8.2-2.el7a
  15. Upgrade

    Upgrade redhat/nodejs-capture-stack-trace to a version that resolves this vulnerability.

    Fixed in 1.0.0-2.el7a
  16. Upgrade

    Upgrade redhat/nodejs-chokidar to a version that resolves this vulnerability.

    Fixed in 1.4.1-2.el7a
  17. Upgrade

    Upgrade redhat/nodejs-configstore to a version that resolves this vulnerability.

    Fixed in 1.4.0-1.el7a
  18. Upgrade

    Upgrade redhat/nodejs-create-error-class to a version that resolves this vulnerability.

    Fixed in 2.0.1-2.el7a
  19. Upgrade

    Upgrade redhat/nodejs-deep-extend to a version that resolves this vulnerability.

    Fixed in 0.3.2-2.el7a
  20. Upgrade

    Upgrade redhat/nodejs-duplexer to a version that resolves this vulnerability.

    Fixed in 0.1.1-2.el7a
  21. Upgrade

    Upgrade redhat/nodejs-duplexify to a version that resolves this vulnerability.

    Fixed in 3.4.2-1.el7a
  22. Upgrade

    Upgrade redhat/nodejs-end-of-stream to a version that resolves this vulnerability.

    Fixed in 1.1.0-2.el7a
  23. Upgrade

    Upgrade redhat/nodejs-error-ex to a version that resolves this vulnerability.

    Fixed in 1.2.0-1.el7a
  24. Upgrade

    Upgrade redhat/nodejs-es6-promise to a version that resolves this vulnerability.

    Fixed in 3.0.2-2.el7a
  25. Upgrade

    Upgrade redhat/nodejs-event-stream to a version that resolves this vulnerability.

    Fixed in 3.3.2-1.el7a
  26. Upgrade

    Upgrade redhat/nodejs-expand-brackets to a version that resolves this vulnerability.

    Fixed in 0.1.4-1.el7a
  27. Upgrade

    Upgrade redhat/nodejs-expand-range to a version that resolves this vulnerability.

    Fixed in 1.8.1-1.el7a
  28. Upgrade

    Upgrade redhat/nodejs-extglob to a version that resolves this vulnerability.

    Fixed in 0.3.1-1.el7a
  29. Upgrade

    Upgrade redhat/nodejs-filename-regex to a version that resolves this vulnerability.

    Fixed in 2.0.0-1.el7a
  30. Upgrade

    Upgrade redhat/nodejs-fill-range to a version that resolves this vulnerability.

    Fixed in 2.2.3-1.el7a
  31. Upgrade

    Upgrade redhat/nodejs-for-in to a version that resolves this vulnerability.

    Fixed in 0.1.4-1.el7a
  32. Upgrade

    Upgrade redhat/nodejs-for-own to a version that resolves this vulnerability.

    Fixed in 0.1.3-1.el7a
  33. Upgrade

    Upgrade redhat/nodejs-from to a version that resolves this vulnerability.

    Fixed in 0.1.3-2.el7a
  34. Upgrade

    Upgrade redhat/nodejs-glob-base to a version that resolves this vulnerability.

    Fixed in 0.3.0-1.el7a
  35. Upgrade

    Upgrade redhat/nodejs-glob-parent to a version that resolves this vulnerability.

    Fixed in 2.0.0-1.el7a
  36. Upgrade

    Upgrade redhat/nodejs-got to a version that resolves this vulnerability.

    Fixed in 5.2.1-1.el7a
  37. Upgrade

    Upgrade redhat/nodejs-graceful-fs to a version that resolves this vulnerability.

    Fixed in 4.1.2-1.el7a
  38. Upgrade

    Upgrade redhat/nodejs-ini to a version that resolves this vulnerability.

    Fixed in 1.1.0-6.el7a
  39. Upgrade

    Upgrade redhat/nodejs-is-binary-path to a version that resolves this vulnerability.

    Fixed in 1.0.1-1.el7a
  40. Upgrade

    Upgrade redhat/nodejs-is-dotfile to a version that resolves this vulnerability.

    Fixed in 1.0.2-1.el7a
  41. Upgrade

    Upgrade redhat/nodejs-is-equal-shallow to a version that resolves this vulnerability.

    Fixed in 0.1.3-1.el7a
  42. Upgrade

    Upgrade redhat/nodejs-is-extendable to a version that resolves this vulnerability.

    Fixed in 0.1.1-1.el7a
  43. Upgrade

    Upgrade redhat/nodejs-is-extglob to a version that resolves this vulnerability.

    Fixed in 1.0.0-1.el7a
  44. Upgrade

    Upgrade redhat/nodejs-is-glob to a version that resolves this vulnerability.

    Fixed in 2.0.1-1.el7a
  45. Upgrade

    Upgrade redhat/nodejs-is-npm to a version that resolves this vulnerability.

    Fixed in 1.0.0-1.el7a
  46. Upgrade

    Upgrade redhat/nodejs-is-number to a version that resolves this vulnerability.

    Fixed in 2.1.0-1.el7a
  47. Upgrade

    Upgrade redhat/nodejs-is-plain-obj to a version that resolves this vulnerability.

    Fixed in 1.0.0-1.el7a
  48. Upgrade

    Upgrade redhat/nodejs-is-primitive to a version that resolves this vulnerability.

    Fixed in 2.0.0-1.el7a
  49. Upgrade

    Upgrade redhat/nodejs-is-redirect to a version that resolves this vulnerability.

    Fixed in 1.0.0-1.el7a
  50. Upgrade

    Upgrade redhat/nodejs-is-stream to a version that resolves this vulnerability.

    Fixed in 1.0.1-2.el7a
  51. Upgrade

    Upgrade redhat/nodejs-isobject to a version that resolves this vulnerability.

    Fixed in 2.0.0-1.el7a
  52. Upgrade

    Upgrade redhat/nodejs-kind-of to a version that resolves this vulnerability.

    Fixed in 3.0.2-1.el7a
  53. Upgrade

    Upgrade redhat/nodejs-latest-version to a version that resolves this vulnerability.

    Fixed in 2.0.0-1.el7a
  54. Upgrade

    Upgrade redhat/nodejs-lazy-cache to a version that resolves this vulnerability.

    Fixed in 1.0.2-1.el7a
  55. Upgrade

    Upgrade redhat/nodejs-lodash.assign to a version that resolves this vulnerability.

    Fixed in 3.2.0-1.el7a
  56. Upgrade

    Upgrade redhat/nodejs-lodash.baseassign to a version that resolves this vulnerability.

    Fixed in 3.2.0-1.el7a
  57. Upgrade

    Upgrade redhat/nodejs-lodash.basecopy to a version that resolves this vulnerability.

    Fixed in 3.0.1-1.el7a
  58. Upgrade

    Upgrade redhat/nodejs-lodash.bindcallback to a version that resolves this vulnerability.

    Fixed in 3.0.1-1.el7a
  59. Upgrade

    Upgrade redhat/nodejs-lodash.createassigner to a version that resolves this vulnerability.

    Fixed in 3.1.1-1.el7a
  60. Upgrade

    Upgrade redhat/nodejs-lodash.defaults to a version that resolves this vulnerability.

    Fixed in 3.1.2-1.el7a
  61. Upgrade

    Upgrade redhat/nodejs-lodash.getnative to a version that resolves this vulnerability.

    Fixed in 3.9.1-1.el7a
  62. Upgrade

    Upgrade redhat/nodejs-lodash.isarguments to a version that resolves this vulnerability.

    Fixed in 3.0.4-1.el7a
  63. Upgrade

    Upgrade redhat/nodejs-lodash.isarray to a version that resolves this vulnerability.

    Fixed in 3.0.4-1.el7a
  64. Upgrade

    Upgrade redhat/nodejs-lodash.isiterateecall to a version that resolves this vulnerability.

    Fixed in 3.0.9-1.el7a
  65. Upgrade

    Upgrade redhat/nodejs-lodash.keys to a version that resolves this vulnerability.

    Fixed in 3.1.2-1.el7a
  66. Upgrade

    Upgrade redhat/nodejs-lodash.restparam to a version that resolves this vulnerability.

    Fixed in 3.6.1-1.el7a
  67. Upgrade

    Upgrade redhat/nodejs-lowercase-keys to a version that resolves this vulnerability.

    Fixed in 1.0.0-2.el7a
  68. Upgrade

    Upgrade redhat/nodejs-map-stream to a version that resolves this vulnerability.

    Fixed in 0.1.0-2.el7a
  69. Upgrade

    Upgrade redhat/nodejs-micromatch to a version that resolves this vulnerability.

    Fixed in 2.3.5-2.el7a
  70. Upgrade

    Upgrade redhat/nodejs-mkdirp to a version that resolves this vulnerability.

    Fixed in 0.5.0-2.el7a
  71. Upgrade

    Upgrade redhat/nodejs-node-status-codes to a version that resolves this vulnerability.

    Fixed in 1.0.0-1.el7a
  72. Upgrade

    Upgrade redhat/nodejs-nodemon to a version that resolves this vulnerability.

    Fixed in 1.8.1-2.el7a
  73. Upgrade

    Upgrade redhat/nodejs-normalize-path to a version that resolves this vulnerability.

    Fixed in 2.0.1-1.el7a
  74. Upgrade

    Upgrade redhat/nodejs-object-assign to a version that resolves this vulnerability.

    Fixed in 4.0.1-1.el7a
  75. Upgrade

    Upgrade redhat/nodejs-object.omit to a version that resolves this vulnerability.

    Fixed in 2.0.0-1.el7a
  76. Upgrade

    Upgrade redhat/nodejs-optimist to a version that resolves this vulnerability.

    Fixed in 0.4.0-5.el7a
  77. Upgrade

    Upgrade redhat/nodejs-os-homedir to a version that resolves this vulnerability.

    Fixed in 1.0.1-1.el7a
  78. Upgrade

    Upgrade redhat/nodejs-os-tmpdir to a version that resolves this vulnerability.

    Fixed in 1.0.1-1.el7a
  79. Upgrade

    Upgrade redhat/nodejs-osenv to a version that resolves this vulnerability.

    Fixed in 0.1.0-2.el7a
  80. Upgrade

    Upgrade redhat/nodejs-package-json to a version that resolves this vulnerability.

    Fixed in 2.3.0-1.el7a
  81. Upgrade

    Upgrade redhat/nodejs-parse-glob to a version that resolves this vulnerability.

    Fixed in 3.0.4-1.el7a
  82. Upgrade

    Upgrade redhat/nodejs-parse-json to a version that resolves this vulnerability.

    Fixed in 2.2.0-2.el7a
  83. Upgrade

    Upgrade redhat/nodejs-pause-stream to a version that resolves this vulnerability.

    Fixed in 0.0.11-2.el7a
  84. Upgrade

    Upgrade redhat/nodejs-pinkie to a version that resolves this vulnerability.

    Fixed in 2.0.1-1.el7a
  85. Upgrade

    Upgrade redhat/nodejs-pinkie-promise to a version that resolves this vulnerability.

    Fixed in 2.0.0-1.el7a
  86. Upgrade

    Upgrade redhat/nodejs-prepend-http to a version that resolves this vulnerability.

    Fixed in 1.0.1-2.el7a
  87. Upgrade

    Upgrade redhat/nodejs-preserve to a version that resolves this vulnerability.

    Fixed in 0.2.0-1.el7a
  88. Upgrade

    Upgrade redhat/nodejs-ps-tree to a version that resolves this vulnerability.

    Fixed in 1.0.1-1.el7a
  89. Upgrade

    Upgrade redhat/nodejs-randomatic to a version that resolves this vulnerability.

    Fixed in 1.1.5-1.el7a
  90. Upgrade

    Upgrade redhat/nodejs-rc to a version that resolves this vulnerability.

    Fixed in 1.1.2-1.el7a
  91. Upgrade

    Upgrade redhat/nodejs-read-all-stream to a version that resolves this vulnerability.

    Fixed in 3.0.1-3.el7a
  92. Upgrade

    Upgrade redhat/nodejs-readdirp to a version that resolves this vulnerability.

    Fixed in 2.0.0-2.el7a
  93. Upgrade

    Upgrade redhat/nodejs-regex-cache to a version that resolves this vulnerability.

    Fixed in 0.4.2-1.el7a
  94. Upgrade

    Upgrade redhat/nodejs-registry-url to a version that resolves this vulnerability.

    Fixed in 3.0.3-1.el7a
  95. Upgrade

    Upgrade redhat/nodejs-repeat-element to a version that resolves this vulnerability.

    Fixed in 1.1.2-1.el7a
  96. Upgrade

    Upgrade redhat/nodejs-semver to a version that resolves this vulnerability.

    Fixed in 5.1.0-1.el7a
  97. Upgrade

    Upgrade redhat/nodejs-semver-diff to a version that resolves this vulnerability.

    Fixed in 2.1.0-1.el7a
  98. Upgrade

    Upgrade redhat/nodejs-slide to a version that resolves this vulnerability.

    Fixed in 1.1.5-3.el7a
  99. Upgrade

    Upgrade redhat/nodejs-split to a version that resolves this vulnerability.

    Fixed in 0.3.3-2.el7a
  100. Upgrade

    Upgrade redhat/nodejs-stream-combiner to a version that resolves this vulnerability.

    Fixed in 0.2.1-2.el7a
  101. Upgrade

    Upgrade redhat/nodejs-string-length to a version that resolves this vulnerability.

    Fixed in 1.0.1-1.el7a
  102. Upgrade

    Upgrade redhat/nodejs-strip-json-comments to a version that resolves this vulnerability.

    Fixed in 1.0.2-2.el7a
  103. Upgrade

    Upgrade redhat/nodejs-success-symbol to a version that resolves this vulnerability.

    Fixed in 0.1.0-1.el7a
  104. Upgrade

    Upgrade redhat/nodejs-through to a version that resolves this vulnerability.

    Fixed in 2.3.4-4.el7a
  105. Upgrade

    Upgrade redhat/nodejs-timed-out to a version that resolves this vulnerability.

    Fixed in 2.0.0-3.el7a
  106. Upgrade

    Upgrade redhat/nodejs-touch to a version that resolves this vulnerability.

    Fixed in 1.0.0-2.el7a
  107. Upgrade

    Upgrade redhat/nodejs-undefsafe to a version that resolves this vulnerability.

    Fixed in 0.0.3-1.el7a
  108. Upgrade

    Upgrade redhat/nodejs-unzip-response to a version that resolves this vulnerability.

    Fixed in 1.0.0-1.el7a
  109. Upgrade

    Upgrade redhat/nodejs-update-notifier to a version that resolves this vulnerability.

    Fixed in 0.6.0-1.el7a
  110. Upgrade

    Upgrade redhat/nodejs-url-parse-lax to a version that resolves this vulnerability.

    Fixed in 1.0.0-1.el7a
  111. Upgrade

    Upgrade redhat/nodejs-uuid to a version that resolves this vulnerability.

    Fixed in 2.0.1-1.el7a
  112. Upgrade

    Upgrade redhat/nodejs-write-file-atomic to a version that resolves this vulnerability.

    Fixed in 1.1.2-2.el7a
  113. Upgrade

    Upgrade redhat/nodejs-xdg-basedir to a version that resolves this vulnerability.

    Fixed in 2.0.0-1.el7a
  114. Upgrade

    Upgrade redhat/openshift-ansible to a version that resolves this vulnerability.

    Fixed in 3.0.35-1.git.0.6a386dd.el7a
  115. Upgrade

    Upgrade redhat/openvswitch to a version that resolves this vulnerability.

    Fixed in 2.4.0-1.el7
  116. Upgrade

    Upgrade redhat/origin-kibana to a version that resolves this vulnerability.

    Fixed in 0.5.0-1.el7a
  117. Upgrade

    Upgrade redhat/atomic-openshift-clients to a version that resolves this vulnerability.

    Fixed in 3.1.1.6-1.git.0.b57e8bd.el7a
  118. Upgrade

    Upgrade redhat/atomic-openshift-clients-redistributable to a version that resolves this vulnerability.

    Fixed in 3.1.1.6-1.git.0.b57e8bd.el7a
  119. Upgrade

    Upgrade redhat/atomic-openshift-dockerregistry to a version that resolves this vulnerability.

    Fixed in 3.1.1.6-1.git.0.b57e8bd.el7a
  120. Upgrade

    Upgrade redhat/atomic-openshift-master to a version that resolves this vulnerability.

    Fixed in 3.1.1.6-1.git.0.b57e8bd.el7a
  121. Upgrade

    Upgrade redhat/atomic-openshift-node to a version that resolves this vulnerability.

    Fixed in 3.1.1.6-1.git.0.b57e8bd.el7a
  122. Upgrade

    Upgrade redhat/atomic-openshift-pod to a version that resolves this vulnerability.

    Fixed in 3.1.1.6-1.git.0.b57e8bd.el7a
  123. Upgrade

    Upgrade redhat/atomic-openshift-recycle to a version that resolves this vulnerability.

    Fixed in 3.1.1.6-1.git.0.b57e8bd.el7a
  124. Upgrade

    Upgrade redhat/atomic-openshift-sdn-ovs to a version that resolves this vulnerability.

    Fixed in 3.1.1.6-1.git.0.b57e8bd.el7a
  125. Upgrade

    Upgrade redhat/atomic-openshift-utils to a version that resolves this vulnerability.

    Fixed in 3.0.35-1.git.0.6a386dd.el7a
  126. Upgrade

    Upgrade redhat/openshift-ansible-docs to a version that resolves this vulnerability.

    Fixed in 3.0.35-1.git.0.6a386dd.el7a
  127. Upgrade

    Upgrade redhat/openshift-ansible-filter-plugins to a version that resolves this vulnerability.

    Fixed in 3.0.35-1.git.0.6a386dd.el7a
  128. Upgrade

    Upgrade redhat/openshift-ansible-lookup-plugins to a version that resolves this vulnerability.

    Fixed in 3.0.35-1.git.0.6a386dd.el7a
  129. Upgrade

    Upgrade redhat/openshift-ansible-playbooks to a version that resolves this vulnerability.

    Fixed in 3.0.35-1.git.0.6a386dd.el7a
  130. Upgrade

    Upgrade redhat/openshift-ansible-roles to a version that resolves this vulnerability.

    Fixed in 3.0.35-1.git.0.6a386dd.el7a
  131. Upgrade

    Upgrade redhat/openvswitch-debuginfo to a version that resolves this vulnerability.

    Fixed in 2.4.0-1.el7
  132. Upgrade

    Upgrade redhat/openvswitch-devel to a version that resolves this vulnerability.

    Fixed in 2.4.0-1.el7
  133. Upgrade

    Upgrade redhat/openvswitch-test to a version that resolves this vulnerability.

    Fixed in 2.4.0-1.el7
  134. Upgrade

    Upgrade redhat/python-openvswitch to a version that resolves this vulnerability.

    Fixed in 2.4.0-1.el7
  135. Upgrade

    Upgrade redhat/tuned-profiles-atomic-openshift-node to a version that resolves this vulnerability.

    Fixed in 3.1.1.6-1.git.0.b57e8bd.el7a
  136. Upgrade

    Upgrade OpenShift Enterprise to a version that resolves this vulnerability.

    Fixed in 3.1.1
  137. Operational

    Apply all previously released errata relevant to the system before applying the OpenShift Enterprise 3.1.1 update.

Event History

Jan 26, 2016
Advisory Published
via Red Hat·12:00 AM
Data Sourced
via Red Hat·12:00 AM
RemedyDescriptionAffected Software

Frequently Asked Questions

1

What is the severity of RHSA-2016:0070?

The severity of RHSA-2016:0070 is classified as moderate.

2

What are the affected packages in RHSA-2016:0070?

RHSA-2016:0070 affects multiple packages including atomic-openshift, heapster, jenkins, and several nodejs packages.

3

How do I fix RHSA-2016:0070?

To fix RHSA-2016:0070, upgrade the affected packages to the recommended versions as specified in the advisory.

4

Are there workarounds for RHSA-2016:0070?

There are no specific workarounds mentioned for RHSA-2016:0070; upgrading is the advised action.

5

What causes the vulnerability in RHSA-2016:0070?

RHSA-2016:0070 addresses an authorization flaw discovered in Kubernetes that could potentially lead to unauthorized access.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203