Critical: Errata Advisory for Red Hat OpenShift Builds 1.0.1

Critical: Release of OpenShift Serverless Client kn 1.31.1 security update

Critical: Release of OpenShift Serverless 1.31.1

IBM Robotic Process Automation 23.0.9 is vulnerable to privilege escalation that affects ownership of projects. IBM X-Force ID: 247527.

Critical: Red Hat OpenShift GitOps security update

Critical: Red Hat OpenShift GitOps security update

IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 is vulnerable to incorrect privilege assignment when importing users from an LDAP directory. IBM X-Force ID: 262481.

IBM Watson Knowledge Catalog on Cloud Pak for Data 4.5.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 237402.

IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 could allow an attacker to perform unauthorized actions due to improper or missing authentication controls. IBM X-Force ID: 199282.

mcollective has a default password set at install

Openshift has shell command injection flaws due to unsanitized data being passed into shell commands.

It was reported that by creating a new image with root password changed and using it as a sti builder image, attackers are able to gain ROOT in it. Overridding builder image scripts(e.g. assemble) can help the attackers to access the pod and/or perform remote command execution in it.

Product bugs (contain reproducer):

https://bugzilla.redhat.com/showbug.cgi?id=1315187 https://bugzilla.redhat.com/showbug.cgi?id=1315188

Upstream bug:

https://github.com/openshift/origin/pull/7864

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.

Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force approach.

The following flaw was found in Jenkins:

A vulnerability in the Jenkins remoting module allowed unauthenticated remote attackers to open a JRMP listener on the server hosting the Jenkins master process, which allowed arbitrary code execution.

External References:

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-24

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.

The following flaw was found in Jenkins:

Unsafe deserialization allows unauthenticated remote attackers to run arbitrary code on the Jenkins master.

This flaw could allow unauthenticated remote attackers to run arbitrary code on Jenkins.

Mitigation:

https://jenkins-ci.org/content/mitigating-unauthenticated-remote-code-execution-0-day-jenkins-cli

External References:

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11

cartridgerepository.rb in OpenShift Origin and Enterprise 1.2.8 through 2.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a Source-Url ending with a (1) .tar.gz, (2) .zip, (3) .tgz, or (4) .tar file extension in a cartridge manifest file.

Kurt Seifried of Red Hat reports:

The OpenShift Enterprise openshift-origin-broker configures a default password:

/etc/openshift/broker.conf:MONGOPASSWORD="mooo" /etc/openshift/broker.conf:MONGOPASSWORD="mongopass"

Please note that the optional installer also did this previously:

https://github.com/openshift/openshift-extras/blob/enterprise-2.0/enterprise/install-scripts/generic/openshift.sh

In a openshift node, there is a cron job to update mcollective facts that mishandles a temporary file. This may lead to loss of confidentiality and integrity.

Clayton Coleman reports:

Never use the form in ruby when the variables aren't known to be safe values

def self.downloadfromurl(url) maxdltime = (Rails.application.config.downloadedcartridges[:maxdownloadtime] rescue 10) || 10 maxfilesize = (Rails.application.config.downloadedcartridges[:maxcartsize] rescue 20480) || 20480 maxredirs = (Rails.application.config.downloadedcartridges[:maxdownloadredirects] rescue 2) || 2 curl --max-time #{maxdltime} --connect-timeout 2 --location --max-redirs #{maxredirs} --max-filesize #{maxfilesize} -k #{url} end

If 'URL' is not properly validated, then someone could inject " ; rm -rf /"

In this method, URL needs to be a properly formatted URI with a known whitelist of parameters.

In addition, we should only accept URI's that are of the following whitelisted criteria:

Parses URI successfully Protocol is 'http', 'https', 'git', 'ftp' (I can't think of others that are really safe). 'file' should NOT be allowed Host must be specified, and be non localhost (otherwise you allow a local injection attack). We need to be very careful here not to allow probing of the internal network, so we should only allow addresses that resolve outside of the exsrvs. Port should be valid Path should be valid

If the URI does not meet these criteria an error message should be returned to the user.