Red Hat Security AdvisoryRHSA-2014:1906
Red Hat OpenShift Enterprise 2.1.9 security, bug fix, and enhancement update
Released 2014-11-25 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- RHOSE Infrastructure 2.1 openshift-enterprise-release-2.1.9-1.el6op, openshift-enterprise-upgrade-2.1.9-1.el6op, openshift-enterprise-upgrade-broker-2.1.9-1.el6op +5
- RHOSE JBoss EAP add-on 2.1 openshift-origin-cartridge-jbosseap-2.16.3.7-1.el6op
- RHOSE Node 2.1 openshift-enterprise-release-2.1.9-1.el6op, openshift-enterprise-upgrade-2.1.9-1.el6op, openshift-enterprise-upgrade-node-2.1.9-1.el6op +9
Fixes 2 records
Priority LOW 37
Red Hat OpenShift Enterprise before 2.2 does not properly restrict access to gears, which allows remote attackers to access the network resources of arbitrary gears via unspecified vectors.
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.02058 · Published 2014-11-13 · Fixed CWE-264
Priority LOW 11
Red Hat OpenShift Enterprise before 2.2 allows local users to obtain IP address and port number information for remote systems by reading /proc/net/tcp.
CVSS 2.0LOW 2.1· Local · No auth · Interaction — · EPSS 0.00375 · Published 2014-11-13 · Partial fix CWE-264
