Red Hat: 2012:1555-01: openshift-console: Important Advisory
Summary
The OpenShift Management Console provides a web interface for managing
OpenShift Enterprise.
It was found that the OpenShift Management Console did not protect against
Cross-Site Request Forgery (CSRF) attacks. If a remote attacker could trick
a user, who was logged into the OpenShift Management Console, into visiting
an attacker controlled web page, the attacker could make changes to
applications hosted within OpenShift Enterprise with the privileges of the
victim which may lead to arbitrary code execution in the OpenShift
Enterprise hosted applications. (CVE-2012-5622)
This issue was discovered by Red Hat.
All users of the OpenShift Management Console are advised to upgrade to
this updated package, which corrects this issue. Before installing the
updated package, stop the openshift-console service. After the package has
been installed, start the openshift-console service.
Summary
Solution
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
References
https://www.redhat.com/security/data/cve/CVE-2012-5622.html https://access.redhat.com/security/updates/classification/#important
Package List
RedHat OpenShift Enterprise Infrastructure:
Source:
noarch:
openshift-console-0.0.5-3.el6.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package
Topic
An updated openshift-console package that fixes one security issue is nowavailable for OpenShift Enterprise.The Red Hat Security Response Team has rated this update as havingimportant security impact. A Common Vulnerability Scoring System (CVSS)base score, which gives a detailed severity rating, is available from theCVE link in the References section.
Topic
Relevant Releases Architectures
RedHat OpenShift Enterprise Infrastructure - noarch
Bugs Fixed
883227 - CVE-2012-5622 OpenShift-Enterprise: openshift-console CSRF attack