Red Hat Security Advisory

RHSA-2013:0220

Red Hat OpenShift Enterprise 1.1 update

Released 2013-01-31 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Enterprise Client Tools rhc-1.3.2-1.3.el6op
Red Hat OpenShift Enterprise Infrastructure libmongodb-2.0.2-6.el6op, mongodb-2.0.2-6.el6op, mongodb-devel-2.0.2-6.el6op +20
Red Hat OpenShift Enterprise Node jenkins-1.498-1.1.el6op, openshift-origin-cartridge-haproxy-1.4-1.0.3-1.el6op, openshift-origin-cartridge-ruby-1.8-1.0.5-1.el6op +14

Fixes 7 records

TI-2012-05214 CVE-2012-6496 · GHSA-gh2w-j7cx-2664

SQL injection vulnerability in the Active Record component in Ruby on Rails before…

MEDIUM 40

SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.04582 Published 2013-01-04 Partial fix · 3.0.18, 3.1.9 +2 CWE-89

TI-2012-05037 CVE-2012-6073 · GHSA-mqgf-4rw4-2cq2

Open redirect vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and…

LOW 30

Open redirect vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to redire…

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.01825 Published 2013-02-24 Fixed in 1.480.1, 1.491 CWE-20

TI-2012-05036 CVE-2012-6072 · GHSA-2q8v-qx2x-hxjx

CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and…

LOW 24

CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to injec…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01825 Published 2013-02-24 Fixed in 1.491, 1.480.1 CWE-20

TI-2012-05038 CVE-2012-6074 · GHSA-9hr6-5x6g-gg5g

Cross-site scripting (XSS) vulnerability in Jenkins before 1.491, Jenkins LTS before…

LOW 20

Cross-site scripting (XSS) vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote authen…

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.01419 Published 2013-02-24 Fixed in 1.491, 1.480.1 CWE-79

TI-2013-00093 CVE-2013-0158 · GHSA-jwfr-h6jp-9p2g

Unspecified vulnerability in Jenkins before 1.498, Jenkins LTS before 1.480.2, and…

LOW 18

Unspecified vulnerability in Jenkins before 1.498, Jenkins LTS before 1.480.2, and Jenkins Enterprise 1.447.x before 1.447.6.1 and 1.466.x before 1.466.12.1, when a slave is attached and anonymous read access is enabled,…

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.02455 Published 2013-02-24 Fixed in 1.498, 1.480.2

TI-2013-00099 CVE-2013-0164 · GHSA-pf6c-h3c9-qfmc

The lockwrap function in port-proxy/bin/openshift-port-proxy-cfg in Red Hat OpenShift…

LOW 17

The lockwrap function in port-proxy/bin/openshift-port-proxy-cfg in Red Hat OpenShift Origin before 1.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in…

CVSS 2.0LOW 3.6 Local No auth Interaction — EPSS 0.00365 Published 2013-02-24 Fixed CWE-264

TI-2012-04759 CVE-2012-5658 · GHSA-4prw-24cm-ghmj

rhc-chk.rb in Red Hat OpenShift Origin before 1.1, when -d (debug mode) is used, outputs…

LOW 11

rhc-chk.rb in Red Hat OpenShift Origin before 1.1, when -d (debug mode) is used, outputs the password and other sensitive information in cleartext, which allows context-dependent attackers to obtain sensitive information…

CVSS 2.0LOW 2.1 Local No auth Interaction — EPSS 0.00356 Published 2013-02-24 Fixed CWE-310