-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: OpenShift Container Platform 3.11 security update
Advisory ID:       RHSA-2018:3537-02
Product:           Red Hat OpenShift Enterprise
Advisory URL:      https://access.redhat.com/errata/RHSA-2018:3537
Issue date:        2018-11-20
CVE Names:         CVE-2018-3830 CVE-2018-12115 CVE-2018-1002105 
=====================================================================

1. Summary:

An update is now available for Red Hat OpenShift Container Platform 3.11.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenShift Container Platform 3.11 - noarch, x86_64

3. Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

Security Fix(es):

* A privilege escalation vulnerability exists in OpenShift Container
Platform 3.x which allows for compromise of pods running on a compute node
to which a pod is scheduled with normal user privilege. This access could
include access to all secrets, pods, environment variables, running
pod/container processes, and persistent volumes, including in privileged
containers. Additionally, on versions 3.6 and higher of OpenShift Container
Platform, this vulnerability allows cluster-admin level access to any API
hosted by an aggregated API server. This includes the aservicecataloga API
which is installed by default in 3.7 and later. Cluster-admin level access
to the service catalog allows creation of brokered services by an
unauthenticated user with escalated privileges in any namespace and on any
node. This could lead to an attacker being allowed to deploy malicious
code, or alter existing services. (CVE-2018-1002105)

* nodejs: Out of bounds (OOB) write via UCS-2 encoding (CVE-2018-12115)

* kibana: Cross-site scripting via the source field formatter
(CVE-2018-3830)

Space precludes documenting all of the bug fixes and enhancements in this
advisory. See the following Release Notes documentation for details about
these changes:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_r
elease_notes.html

All OpenShift Container Platform 3.11 users are advised to upgrade to these
updated packages and images.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1552304 - CRI-O pod log lines are occasionally split mid-line
1613722 - Eventrouter creates duplicated events every 30 min with verb UPDATE
1614904 - Validation of static pod fails due to inconsistent names
1615884 - Ability to install a cluster with a mix of Docker and CRI-O nodes
1620219 - CVE-2018-12115 nodejs: Out of bounds (OOB) write via UCS-2 encoding
1622822 - Logging should restricted to to current owner/group of a namespace.
1625090 - [CNS][3.11] Run standalone deployment playbook with glusterfs_registry group failed due to AnsibleUndefinedVariable
1626228 - Sometimes builds on api.ci fail with "no such image"
1626538 - openshift-ansible in 3.11 fails OCP 3.11 on OSP 13
1627086 - ElasticSearch pods flapping with "fatal error on the network layer" exception when logging from 1000+ nodes
1627689 - The elasticsearch-config should be logging-elasticsearch-ops in logging-es-ops pods
1628235 - Service Catalog establishes a new connection for every request and never closes them.
1628381 - [docs] Document expectations regarding operational management of NodeWithImpairedVolumes
1628902 - Meet 'openshift_is_atomic' is undefined during execute CNS standalone deployment playbook with glusterfs_registry group
1629558 - Fail to atomic pull node image due to docker service was stopped in previous task
1632364 - [3.11] Fluentd cannot handle S2I Logs
1632450 - CVE-2018-3830 kibana: Cross-site scripting via the source field formatter
1632648 - [3.11] Record is missing kubernetes field when use  '--log-driver journald' in /etc/sysconfig/docker
1632895 - [3.11] logging-eventrouter event not formatted correctly in Elasticsearch when using MUX
1633574 - Should not assign the egressIP to node automatically if there are multiple egressIPs in the project
1633923 - openshift-autoheal fails to install in disconnected install
1634700 - [3.11] Modification in master-config.yaml is causing a failure during Master-API restart (runtime-config)
1634835 - Glusterfs-registry pods also get removed while only glusterfs is being uninstalled
1635672 - Use GLUSTER_BLOCKD_STATUS_PROBE_ENABLE enabled templates in glusterfs playbooks
1636248 - not enough master nodes discoverd because service logging-es-cluster is not headless
1637413 - 3.11: APP pod unable to start after target port failure in cases where single paths are mounted on APP pods(BZ#1599742)
1637737 - Service catalog controller segmentation fault
1641245 - Upgrade to 3.11 on atomic host fails during Install or Update node system container task
1641321 - Pods in error state after installing OpenShift with OSP14
1641657 - [3.11] Registry doesn't honors openshift_additional_ca
1641796 - controller-manager pod stops responding with max memory usage and lot of open tcp sockets
1642002 - cockpit-docker is installed (and docker as dependency) even if you just want to use cri-o
1642350 - Failure to restore cache produces corrupted files passed to incremental builds
1643119 - Secure ldap identity provider fails to query the LDAP server. "tls: bad record MAC"
1643301 - Provisioning  two APB services temporarily broke networking in the namespace
1643948 - Cluster console doesn't display the real value of Crashlooping Pods (it displays 0)
1648138 - CVE-2018-1002105 kubernetes: authentication/authorization bypass in the handling of non-101 responses

6. Package List:

Red Hat OpenShift Container Platform 3.11:

Source:
atomic-enterprise-service-catalog-3.11.43-1.git.1671.04b17f5.el7.src.rpm
atomic-openshift-3.11.43-1.git.0.647ac05.el7.src.rpm
atomic-openshift-cluster-autoscaler-3.11.43-1.git.0.55c4e4b.el7.src.rpm
atomic-openshift-descheduler-3.11.43-1.git.300.a720f7f.el7.src.rpm
atomic-openshift-metrics-server-3.11.43-1.git.52.6cc0a21.el7.src.rpm
atomic-openshift-node-problem-detector-3.11.43-1.git.252.f45475c.el7.src.rpm
atomic-openshift-service-idler-3.11.43-1.git.14.bbbb450.el7.src.rpm
atomic-openshift-web-console-3.11.43-1.git.316.7753377.el7.src.rpm
cri-o-1.11.8-2.rhaos3.11.git71cc465.el7.src.rpm
golang-github-openshift-oauth-proxy-3.11.43-1.git.419.03122b3.el7.src.rpm
golang-github-prometheus-alertmanager-3.11.43-1.git.0.19c2765.el7.src.rpm
golang-github-prometheus-node_exporter-3.11.43-1.git.1060.0aff287.el7.src.rpm
golang-github-prometheus-prometheus-3.11.43-1.git.5021.31a8f1d.el7.src.rpm
jenkins-2-plugins-3.11.1539805268-1.el7.src.rpm
kibana-5.6.12-1.el7.src.rpm
openshift-ansible-3.11.43-1.git.0.fa69a02.el7.src.rpm
openshift-enterprise-autoheal-3.11.43-1.git.219.be400cf.el7.src.rpm
openshift-enterprise-cluster-capacity-3.11.43-1.git.380.9cbcbb2.el7.src.rpm
openshift-external-storage-0.0.2-4.gitd3c94f0.el7.src.rpm
openshift-monitor-project-lifecycle-3.11.43-1.git.59.662daae.el7.src.rpm
openshift-monitor-sample-app-3.11.43-1.git.5.83ab17f.el7.src.rpm
python-elasticsearch-5.5.5-1.el7.src.rpm
python-nose-xcover-1.0.10-1.el7.src.rpm

noarch:
atomic-openshift-docker-excluder-3.11.43-1.git.0.647ac05.el7.noarch.rpm
atomic-openshift-excluder-3.11.43-1.git.0.647ac05.el7.noarch.rpm
jenkins-2-plugins-3.11.1539805268-1.el7.noarch.rpm
openshift-ansible-3.11.43-1.git.0.fa69a02.el7.noarch.rpm
openshift-ansible-docs-3.11.43-1.git.0.fa69a02.el7.noarch.rpm
openshift-ansible-playbooks-3.11.43-1.git.0.fa69a02.el7.noarch.rpm
openshift-ansible-roles-3.11.43-1.git.0.fa69a02.el7.noarch.rpm
python-elasticsearch-5.5.5-1.el7.noarch.rpm
python-nose-xcover-1.0.10-1.el7.noarch.rpm

x86_64:
atomic-enterprise-service-catalog-3.11.43-1.git.1671.04b17f5.el7.x86_64.rpm
atomic-enterprise-service-catalog-svcat-3.11.43-1.git.1671.04b17f5.el7.x86_64.rpm
atomic-openshift-3.11.43-1.git.0.647ac05.el7.x86_64.rpm
atomic-openshift-clients-3.11.43-1.git.0.647ac05.el7.x86_64.rpm
atomic-openshift-clients-redistributable-3.11.43-1.git.0.647ac05.el7.x86_64.rpm
atomic-openshift-cluster-autoscaler-3.11.43-1.git.0.55c4e4b.el7.x86_64.rpm
atomic-openshift-descheduler-3.11.43-1.git.300.a720f7f.el7.x86_64.rpm
atomic-openshift-dockerregistry-3.11.43-1.git.446.b80f8a1.el7.x86_64.rpm
atomic-openshift-hyperkube-3.11.43-1.git.0.647ac05.el7.x86_64.rpm
atomic-openshift-hypershift-3.11.43-1.git.0.647ac05.el7.x86_64.rpm
atomic-openshift-master-3.11.43-1.git.0.647ac05.el7.x86_64.rpm
atomic-openshift-metrics-server-3.11.43-1.git.52.6cc0a21.el7.x86_64.rpm
atomic-openshift-node-3.11.43-1.git.0.647ac05.el7.x86_64.rpm
atomic-openshift-node-problem-detector-3.11.43-1.git.252.f45475c.el7.x86_64.rpm
atomic-openshift-pod-3.11.43-1.git.0.647ac05.el7.x86_64.rpm
atomic-openshift-sdn-ovs-3.11.43-1.git.0.647ac05.el7.x86_64.rpm
atomic-openshift-service-idler-3.11.43-1.git.14.bbbb450.el7.x86_64.rpm
atomic-openshift-template-service-broker-3.11.43-1.git.0.647ac05.el7.x86_64.rpm
atomic-openshift-tests-3.11.43-1.git.0.647ac05.el7.x86_64.rpm
atomic-openshift-web-console-3.11.43-1.git.316.7753377.el7.x86_64.rpm
cri-o-1.11.8-2.rhaos3.11.git71cc465.el7.x86_64.rpm
golang-github-openshift-oauth-proxy-3.11.43-1.git.419.03122b3.el7.x86_64.rpm
kibana-5.6.12-1.el7.x86_64.rpm
kibana-debuginfo-5.6.12-1.el7.x86_64.rpm
openshift-enterprise-autoheal-3.11.43-1.git.219.be400cf.el7.x86_64.rpm
openshift-enterprise-cluster-capacity-3.11.43-1.git.380.9cbcbb2.el7.x86_64.rpm
openshift-external-storage-cephfs-provisioner-0.0.2-4.gitd3c94f0.el7.x86_64.rpm
openshift-external-storage-debuginfo-0.0.2-4.gitd3c94f0.el7.x86_64.rpm
openshift-external-storage-efs-provisioner-0.0.2-4.gitd3c94f0.el7.x86_64.rpm
openshift-external-storage-local-provisioner-0.0.2-4.gitd3c94f0.el7.x86_64.rpm
openshift-external-storage-manila-provisioner-0.0.2-4.gitd3c94f0.el7.x86_64.rpm
openshift-external-storage-snapshot-controller-0.0.2-4.gitd3c94f0.el7.x86_64.rpm
openshift-external-storage-snapshot-provisioner-0.0.2-4.gitd3c94f0.el7.x86_64.rpm
openshift-monitor-project-lifecycle-3.11.43-1.git.59.662daae.el7.x86_64.rpm
openshift-monitor-sample-app-3.11.43-1.git.5.83ab17f.el7.x86_64.rpm
prometheus-3.11.43-1.git.5021.31a8f1d.el7.x86_64.rpm
prometheus-alertmanager-3.11.43-1.git.0.19c2765.el7.x86_64.rpm
prometheus-node-exporter-3.11.43-1.git.1060.0aff287.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2018-3830
https://access.redhat.com/security/cve/CVE-2018-12115
https://access.redhat.com/security/cve/CVE-2018-1002105
https://access.redhat.com/security/updates/classification/#critical
https://access.redhat.com/security/vulnerabilities/3716411
https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXAVoI9zjgjWX9erEAQhuOxAAiHQ4xCiHB/n5eo3v0G/DgRrHFGlQE5p5
5ZikmKGbyg3tkNRiQGO+ydDUCscNI9z0BzlN1LLXy6UECAw6pqa/d9o1bzx8ZxIQ
+8k2mcI3By4Z5XQCv1x/udHnzDGxhQRNOVzrJWMq4l2kOZLv9SSI6ZnuApNsLi1V
lx2cuVil+oU1K1ggLnnikuW+gdx7b3EgA3PWgHPcHUqdDmb3TwMoHUKKhU2FJ7z5
+ekKPAhw1boomCLXA17T56U/naP96GxKFTvq1kWTelFyGprOuTVPRfGE5e0nke5p
df51YixF5M4HTmha+VS/MFmhDrqElRpR29KgPuK/mFMzHlYZmLEehve0agedzONy
st6RFX4/SiKg0xej76pDMO6vyby0PKOSfOiwtYG0+3eW3M1gnGpnAzcIFu5/Moma
AC49hZYS+GqwxK5otrMn4k9sd4P/CKCVn0Qtt2A5PupwoYpqlvAyyY4tHNbI/2JD
p6BwYTolOVPdenPQLbuXnnNrW0Ypr6XaSLNgkIaRMu8NmzdsbShvy+jD1JcY8qFU
Zq0eBzBa7m0qvBoBMPD4eplyqH1LZlE/RMQWuwC/jl8XH5G+tdflJ237bCmbDex5
+kjvXYzTxV09AJchghEmbEemwwyLhWzFNpBFvlazvXWADCN7Agci9x0Mf4HZtC5t
n1MJSBYpnUU=
=qfY8
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce