ESB-2018.3747 - ALERT [RedHat] Red Hat OpenShift Container Platform & Kubernetes: Multiple vulnerabilities 2018-12-04

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2018.3747
          Critical: OpenShift Container Platform security update
                              4 December 2018

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Red Hat OpenShift Container Platform
                   Kubernetes
Publisher:         Red Hat
Operating System:  Red Hat
Impact/Access:     Execute Arbitrary Code/Commands -- Existing Account            
                   Increased Privileges            -- Existing Account            
                   Overwrite Arbitrary Files       -- Remote/Unauthenticated      
                   Access Privileged Data          -- Existing Account            
                   Cross-site Scripting            -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2018-1002105 CVE-2018-12115 CVE-2018-3830

Original Bulletin: 
   https://access.redhat.com/errata/RHSA-2018:3742
   https://access.redhat.com/errata/RHSA-2018:3754
   https://access.redhat.com/errata/RHSA-2018:3752
   https://access.redhat.com/errata/RHSA-2018:3624
   https://access.redhat.com/errata/RHSA-2018:3598
   https://access.redhat.com/errata/RHSA-2018:3551
   https://access.redhat.com/errata/RHSA-2018:3549
   https://access.redhat.com/errata/RHSA-2018:3537

Comment: This bulletin contains eight (8) Red Hat security advisories.

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: OpenShift Container Platform 3.2 security update
Advisory ID:       RHSA-2018:3742-01
Product:           Red Hat OpenShift Enterprise
Advisory URL:      https://access.redhat.com/errata/RHSA-2018:3742
Issue date:        2018-12-03
CVE Names:         CVE-2018-1002105 
=====================================================================

1. Summary:

An update is now available for Red Hat OpenShift Container Platform 3.2.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenShift Container Platform 3.2 - noarch, x86_64

3. Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

Security Fix(es):

* A privilege escalation vulnerability exists in OpenShift Container
Platform 3.x which allows for compromise of pods running on a compute node
to which a pod is scheduled with normal user privilege. This access could
include access to all secrets, pods, environment variables, running
pod/container processes, and persistent volumes, including in privileged
containers. Additionally, on versions 3.6 and higher of OpenShift Container
Platform, this vulnerability allows cluster-admin level access to any API
hosted by an aggregated API server. This includes the servicecatalog API
which is installed by default in 3.7 and later. Cluster-admin level access
to the service catalog allows creation of brokered services by an
unauthenticated user with escalated privileges in any namespace and on any
node. This could lead to an attacker being allowed to deploy malicious
code, or alter existing services. (CVE-2018-1002105)

This advisory contains the RPM packages for Red Hat OpenShift Container
Platform 3.2.z. See the following advisory for the container images for
this release:

https://access.redhat.com/errata/RHBA-2018:0114

All OpenShift Container Platform 3.2 users are advised to upgrade to these
updated packages and images.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1648138 - CVE-2018-1002105 kubernetes: authentication/authorization bypass in
the handling of non-101 responses

6. Package List:

Red Hat OpenShift Container Platform 3.2:

Source:
atomic-openshift-3.2.1.34-2.git.20.6367d5d.el7.src.rpm

noarch:
atomic-openshift-docker-excluder-3.2.1.34-2.git.20.6367d5d.el7.noarch.rpm
atomic-openshift-excluder-3.2.1.34-2.git.20.6367d5d.el7.noarch.rpm

x86_64:
atomic-openshift-3.2.1.34-2.git.20.6367d5d.el7.x86_64.rpm
atomic-openshift-clients-3.2.1.34-2.git.20.6367d5d.el7.x86_64.rpm
atomic-openshift-clients-redistributable-3.2.1.34-2.git.20.6367d5d.el7.x86_64.rpm
atomic-openshift-dockerregistry-3.2.1.34-2.git.20.6367d5d.el7.x86_64.rpm
atomic-openshift-master-3.2.1.34-2.git.20.6367d5d.el7.x86_64.rpm
atomic-openshift-node-3.2.1.34-2.git.20.6367d5d.el7.x86_64.rpm
atomic-openshift-pod-3.2.1.34-2.git.20.6367d5d.el7.x86_64.rpm
atomic-openshift-recycle-3.2.1.34-2.git.20.6367d5d.el7.x86_64.rpm
atomic-openshift-sdn-ovs-3.2.1.34-2.git.20.6367d5d.el7.x86_64.rpm
atomic-openshift-tests-3.2.1.34-2.git.20.6367d5d.el7.x86_64.rpm
tuned-profiles-atomic-openshift-node-3.2.1.34-2.git.20.6367d5d.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2018-1002105
https://access.redhat.com/security/updates/classification/#critical
https://access.redhat.com/security/vulnerabilities/3716411
https://access.redhat.com/errata/RHBA-2018:0114
https://docs.openshift.com/container-platform/3.2/release_notes/ocp_3_2_release_notes.html

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXAVnbNzjgjWX9erEAQjPahAAoe26hHuCaxXCqTYVJY2tkGA1YkCdqaba
e8E5EdfH7+Cq40etP/zLzbtNCV4+IhVnNbfex+0N3iymX+NeEC11w3Iy6Ds+QKhQ
85dhmJZUOUMLDz8BJ/RaoeSzvh6xOLmYEz82eqbA2VPx9uHBn2ET1GeoHozVdJt7
01yMfceih28hhYqmv2f81mnmJjpmNepbB2LFXTZbWU6V2F76EE01b+Rq3dZMJb2y
5vY1mZifFqBFupc70CNvQIP+030ZT42Cd3njghU/AHFcfeVcHFszvXXEt7U4iHtq
EX6CYdEw6H2AGGk8gDszqc3SgZPItqfpCQ1xJe77uX25o7ibCdgqndLdBmeqzp+f
T5EKJ1CCI+sOS4YsdqVALChvp8v3typ2vw6cFLSjg9RPHovus0bqB7OZPdE60pVU
FtHtoP4T7n1qAEa8KguF+EDQ2HnzIOUZDTgr1gBlQOH5aNuhsYtNwuoZOjUuobGh
alYpgN5S44Fo3jX/0Yg/bviN11K9KMvHvm70p92VIWlPdthEN4rZlu/0FVQBbWBr
SRM9m//6+xf3bslgPDXQoNRG8pllb9DJme3sMqY11Q03jXnCZs+B4C/CIBsgBgMV
T+ieIRHeVUcMQNx+1fRiiPNUNTASlko7z7k/18KpGthmiVKwN4fGfbeBY7sSdAVC
jFCP6LrTJbA=
=bZMJ
- -----END PGP SIGNATURE-----

- --------------------------------------------------------------------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: OpenShift Container Platform 3.3 security update
Advisory ID:       RHSA-2018:3754-01
Product:           Red Hat OpenShift Enterprise
Advisory URL:      https://access.redhat.com/errata/RHSA-2018:3754
Issue date:        2018-12-03
CVE Names:         CVE-2018-1002105 
=====================================================================

1. Summary:

An update is now available for Red Hat OpenShift Container Platform release
3.3.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenShift Container Platform 3.3 - noarch, x86_64

3. Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

Security Fix(es):

* A privilege escalation vulnerability exists in OpenShift Container
Platform 3.x which allows for compromise of pods running on a compute node
to which a pod is scheduled with normal user privilege. This access could
include access to all secrets, pods, environment variables, running
pod/container processes, and persistent volumes, including in privileged
containers. Additionally, on versions 3.6 and higher of OpenShift Container
Platform, this vulnerability allows cluster-admin level access to any API
hosted by an aggregated API server. This includes the 'servicecatalog' API
which is installed by default in 3.7 and later. Cluster-admin level access
to the service catalog allows creation of brokered services by an
unauthenticated user with escalated privileges in any namespace and on any
node. This could lead to an attacker being allowed to deploy malicious
code, or alter existing services. (CVE-2018-1002105)

This advisory contains the RPM packages for Red Hat OpenShift Container
Platform 3.3. See the following advisory for the container images for this
release:

https://access.redhat.com/errata/RHBA-2018:0114

https://docs.openshift.com/container-platform/3.3/release_notes/ocp_3_3_rel
ease_notes.html

All OpenShift Container Platform 3.3 users are advised to upgrade to these
updated packages and images.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1648138 - CVE-2018-1002105 kubernetes: authentication/authorization bypass in
the handling of non-101 responses

6. Package List:

Red Hat OpenShift Container Platform 3.3:

Source:
atomic-openshift-3.3.1.46.45-1.git.0.2ce596e.el7.src.rpm
openshift-ansible-3.3.149-1.git.0.3859ddb.el7.src.rpm

noarch:
atomic-openshift-docker-excluder-3.3.1.46.45-1.git.0.2ce596e.el7.noarch.rpm
atomic-openshift-excluder-3.3.1.46.45-1.git.0.2ce596e.el7.noarch.rpm
atomic-openshift-utils-3.3.149-1.git.0.3859ddb.el7.noarch.rpm
openshift-ansible-3.3.149-1.git.0.3859ddb.el7.noarch.rpm
openshift-ansible-callback-plugins-3.3.149-1.git.0.3859ddb.el7.noarch.rpm
openshift-ansible-docs-3.3.149-1.git.0.3859ddb.el7.noarch.rpm
openshift-ansible-filter-plugins-3.3.149-1.git.0.3859ddb.el7.noarch.rpm
openshift-ansible-lookup-plugins-3.3.149-1.git.0.3859ddb.el7.noarch.rpm
openshift-ansible-playbooks-3.3.149-1.git.0.3859ddb.el7.noarch.rpm
openshift-ansible-roles-3.3.149-1.git.0.3859ddb.el7.noarch.rpm

x86_64:
atomic-openshift-3.3.1.46.45-1.git.0.2ce596e.el7.x86_64.rpm
atomic-openshift-clients-3.3.1.46.45-1.git.0.2ce596e.el7.x86_64.rpm
atomic-openshift-clients-redistributable-3.3.1.46.45-1.git.0.2ce596e.el7.x86_64.rpm
atomic-openshift-dockerregistry-3.3.1.46.45-1.git.0.2ce596e.el7.x86_64.rpm
atomic-openshift-master-3.3.1.46.45-1.git.0.2ce596e.el7.x86_64.rpm
atomic-openshift-node-3.3.1.46.45-1.git.0.2ce596e.el7.x86_64.rpm
atomic-openshift-pod-3.3.1.46.45-1.git.0.2ce596e.el7.x86_64.rpm
atomic-openshift-sdn-ovs-3.3.1.46.45-1.git.0.2ce596e.el7.x86_64.rpm
atomic-openshift-tests-3.3.1.46.45-1.git.0.2ce596e.el7.x86_64.rpm
tuned-profiles-atomic-openshift-node-3.3.1.46.45-1.git.0.2ce596e.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2018-1002105
https://access.redhat.com/security/updates/classification/#critical
https://access.redhat.com/errata/RHBA-2018:0114
https://docs.openshift.com/container-platform/3.3/release_notes/ocp_3_3_release_notes.html

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIUAwUBXAVoLtzjgjWX9erEAQjyiA/4mL90sxjyXgsnlYSnPNhVSjRRlMMCCFtJ
cDJ7huNb9CmuCRBQJY/pXi1PIc0aYOFtbJwo0uvzt/79P/KeoPmaW/Mp1oJTjC4J
JFYATHxOxNSCyCZz8vkrRoFeq3bzyqfEeq0Au+kodf5a+A6lrePInQ1VnnKtuQDm
nGOTJJAog6Dj8gNHuz1Qwqv0skD3dF9XKos50G8OFiKnfESz3yqdZdHpWLL+3hFj
HK6Zir0kXCz1Xh+e4koFvTkpNYcERqS3dv4F6wpyM/ajDX/atHRVwLO+CDuE2M9n
kx/HQQLdvu1Fxmy6X1BzXlZkiwf6s5YIR0wHXk8iDuySiEmyFG5PXVjTInIRdgBI
C3HFQuum0AFOrOyT7QpmDKk7rLRJWklx3T/iw3ePXopDBYSwZj1TJT1DeEywkz5v
Rg8IkH1rXqJT+zUZvZKmpEYZyOkEpoLjvGcObQTv9g0MVgGYntzvfocBgLV0gEd4
g8mGvMaJmPKbKPeu+aHVoJ960ChlIOLe5wNSWsN17k5oZr3vM43R2gCBD47MWQ5T
NYBKS8zf6MTONDH1GYPJOE/32YRWult6B2ulozgv7RE1qUUGHTQRNMFDdkWXP8+O
yfe46AnRlMLp5lRX7s00yaXWF6N3/uy8H3nB2YGYKaQmo9gtGUTF45+dLd3BXLjk
p3cKTtdz0g==
=UwSw
- -----END PGP SIGNATURE-----

- --------------------------------------------------------------------------------


- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: OpenShift Container Platform 3.4 security update
Advisory ID:       RHSA-2018:3752-01
Product:           Red Hat OpenShift Enterprise
Advisory URL:      https://access.redhat.com/errata/RHSA-2018:3752
Issue date:        2018-12-03
CVE Names:         CVE-2018-1002105 
=====================================================================

1. Summary:

An update is now available for Red Hat OpenShift Container Platform release
3.4.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenShift Container Platform 3.4 - noarch, x86_64

3. Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

Security Fix(es):

* A privilege escalation vulnerability exists in OpenShift Container
Platform 3.x which allows for compromise of pods running on a compute node
to which a pod is scheduled with normal user privilege. This access could
include access to all secrets, pods, environment variables, running
pod/container processes, and persistent volumes, including in privileged
containers. Additionally, on versions 3.6 and higher of OpenShift Container
Platform, this vulnerability allows cluster-admin level access to any API
hosted by an aggregated API server. This includes the servicecatalog API
which is installed by default in 3.7 and later. Cluster-admin level access
to the service catalog allows creation of brokered services by an
unauthenticated user with escalated privileges in any namespace and on any
node. This could lead to an attacker being allowed to deploy malicious
code, or alter existing services. (CVE-2018-1002105)

This advisory contains the RPM packages for Red Hat OpenShift Container
Platform 3.4. See the following advisory for the container images for this
release:

https://access.redhat.com/errata/RHBA-2018:0114

All OpenShift Container Platform 3.4 users are advised to upgrade to these
updated packages and images.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1648138 - CVE-2018-1002105 kubernetes: authentication/authorization bypass in
the handling of non-101 responses

6. Package List:

Red Hat OpenShift Container Platform 3.4:

Source:
atomic-openshift-3.4.1.44.57-1.git.0.a631031.el7.src.rpm
openshift-ansible-3.4.172-1.git.0.33fe526.el7.src.rpm

noarch:
atomic-openshift-docker-excluder-3.4.1.44.57-1.git.0.a631031.el7.noarch.rpm
atomic-openshift-excluder-3.4.1.44.57-1.git.0.a631031.el7.noarch.rpm
atomic-openshift-utils-3.4.172-1.git.0.33fe526.el7.noarch.rpm
openshift-ansible-3.4.172-1.git.0.33fe526.el7.noarch.rpm
openshift-ansible-callback-plugins-3.4.172-1.git.0.33fe526.el7.noarch.rpm
openshift-ansible-docs-3.4.172-1.git.0.33fe526.el7.noarch.rpm
openshift-ansible-filter-plugins-3.4.172-1.git.0.33fe526.el7.noarch.rpm
openshift-ansible-lookup-plugins-3.4.172-1.git.0.33fe526.el7.noarch.rpm
openshift-ansible-playbooks-3.4.172-1.git.0.33fe526.el7.noarch.rpm
openshift-ansible-roles-3.4.172-1.git.0.33fe526.el7.noarch.rpm

x86_64:
atomic-openshift-3.4.1.44.57-1.git.0.a631031.el7.x86_64.rpm
atomic-openshift-clients-3.4.1.44.57-1.git.0.a631031.el7.x86_64.rpm
atomic-openshift-clients-redistributable-3.4.1.44.57-1.git.0.a631031.el7.x86_64.rpm
atomic-openshift-dockerregistry-3.4.1.44.57-1.git.0.a631031.el7.x86_64.rpm
atomic-openshift-master-3.4.1.44.57-1.git.0.a631031.el7.x86_64.rpm
atomic-openshift-node-3.4.1.44.57-1.git.0.a631031.el7.x86_64.rpm
atomic-openshift-pod-3.4.1.44.57-1.git.0.a631031.el7.x86_64.rpm
atomic-openshift-sdn-ovs-3.4.1.44.57-1.git.0.a631031.el7.x86_64.rpm
atomic-openshift-tests-3.4.1.44.57-1.git.0.a631031.el7.x86_64.rpm
tuned-profiles-atomic-openshift-node-3.4.1.44.57-1.git.0.a631031.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2018-1002105
https://access.redhat.com/security/updates/classification/#critical
https://access.redhat.com/errata/RHBA-2018:0114
https://docs.openshift.com/container-platform/3.4/release_notes/ocp_3_4_release_notes.html

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXAVoXNzjgjWX9erEAQiJtA/7BuDthqYeMUvGFkNlm6pPn5kSfiMSJc9w
lhmxkYrfiyU1bU2AWkU130DcILC/uXb2H/ya8JMVlcKF2JdrYiuH9Nvu1cISOW+u
zpbPECHi9A1L7V3pkeWfxGkavv9/p4fi7MXvWZYtGpWB+lyC1+663tB1liLlBdlB
KSB3qF72gwZydAXftMAzl3NIdO1TMFTv4P9U67KagQfpIk7Qjn2TfvkPJ6qDiJ9f
8dgCkZ+2Fg/3WDSUXLYTJwIXEEmF1tQiq05TZ1v6V8Lk5qrCCy1K5ZBPixTZed0Y
3Eis8ehmiNQZj2/dQ9Q5EpdYNfDRrF3Anv9FrQsVkFPAi7FMfKkM94Qf5+LXdwDt
eA29sDm1vgpxQI5cZgZmW2WG+n5gj8hn1yfj7TpBs9Frj8ofd9R/6jGnQyH8R0Q/
nMnxl6jsmfZZDkXUFaF0qmQpUCW5flIucPis/eSVkOsnToWg+osypf1Gtl1w5IKy
7oLOH6Pow+QNc3SjaAz67GRH/x26I8Cqe7zCjN7vKBRjfkSLrEqXsrvIJWTmt8X6
72d65jDAf4bm2Fbvtj4mybdrN05Gv6QfOm2pEByUcaGZIiiCSxFU6GwjiilrCfhs
Zi2JpevLHA92C5pScwLZl0DMkR9xBn2Io5eo1d/M1zmKBU7PaGiQGJMvUF9YsgRl
fNnPZUih9Sw=
=rkOz
- -----END PGP SIGNATURE-----

- --------------------------------------------------------------------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: OpenShift Container Platform 3.5 security update
Advisory ID:       RHSA-2018:3624-01
Product:           Red Hat OpenShift Enterprise
Advisory URL:      https://access.redhat.com/errata/RHSA-2018:3624
Issue date:        2018-12-03
CVE Names:         CVE-2018-1002105 
=====================================================================

1. Summary:

An update is now available for Red Hat OpenShift Container Platform release
3.5.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenShift Container Platform 3.5 - noarch, x86_64

3. Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
Security Fix(es):

* A privilege escalation vulnerability exists in OpenShift Container
Platform 3.x which allows for compromise of pods running on a compute node
to which a pod is scheduled with normal user privilege. This access could
include access to all secrets, pods, environment variables, running
pod/container processes, and persistent volumes, including in privileged
containers. Additionally, on versions 3.6 and higher of OpenShift Container
Platform, this vulnerability allows cluster-admin level access to any API
hosted by an aggregated API server. This includes the servicecatalog API
which is installed by default in 3.7 and later. Cluster-admin level access
to the service catalog allows creation of brokered services by an
unauthenticated user with escalated privileges in any namespace and on any
node. This could lead to an attacker being allowed to deploy malicious
code, or alter existing services. (CVE-2018-1002105)

Space precludes documenting all of the bug fixes and enhancements in this
advisory. See the following Release Notes documentation for details about
these changes:

https://docs.openshift.com/container-platform/3.5/release_notes/ocp_3_5_rel
ease_notes.html

All OpenShift Container Platform 3.5 users are advised to upgrade to these
updated packages and images.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1563329 - Mounting socket files from subPaths fail
1568292 - [3.5]Failed to prevent s2i builder images from running as root
1573956 - Kibana page displays "OPENSHIFT ORIGIN" in OCP
1648138 - CVE-2018-1002105 kubernetes: authentication/authorization bypass in
the handling of non-101 responses

6. Package List:

Red Hat OpenShift Container Platform 3.5:

Source:
atomic-openshift-3.5.5.31.80-1.git.0.c4a0780.el7.src.rpm
cockpit-160-3.el7.src.rpm
openshift-ansible-3.5.175-1.git.0.1274ebe.el7.src.rpm

noarch:
atomic-openshift-docker-excluder-3.5.5.31.80-1.git.0.c4a0780.el7.noarch.rpm
atomic-openshift-excluder-3.5.5.31.80-1.git.0.c4a0780.el7.noarch.rpm
atomic-openshift-utils-3.5.175-1.git.0.1274ebe.el7.noarch.rpm
openshift-ansible-3.5.175-1.git.0.1274ebe.el7.noarch.rpm
openshift-ansible-callback-plugins-3.5.175-1.git.0.1274ebe.el7.noarch.rpm
openshift-ansible-docs-3.5.175-1.git.0.1274ebe.el7.noarch.rpm
openshift-ansible-filter-plugins-3.5.175-1.git.0.1274ebe.el7.noarch.rpm
openshift-ansible-lookup-plugins-3.5.175-1.git.0.1274ebe.el7.noarch.rpm
openshift-ansible-playbooks-3.5.175-1.git.0.1274ebe.el7.noarch.rpm
openshift-ansible-roles-3.5.175-1.git.0.1274ebe.el7.noarch.rpm

x86_64:
atomic-openshift-3.5.5.31.80-1.git.0.c4a0780.el7.x86_64.rpm
atomic-openshift-clients-3.5.5.31.80-1.git.0.c4a0780.el7.x86_64.rpm
atomic-openshift-clients-redistributable-3.5.5.31.80-1.git.0.c4a0780.el7.x86_64.rpm
atomic-openshift-dockerregistry-3.5.5.31.80-1.git.0.c4a0780.el7.x86_64.rpm
atomic-openshift-master-3.5.5.31.80-1.git.0.c4a0780.el7.x86_64.rpm
atomic-openshift-node-3.5.5.31.80-1.git.0.c4a0780.el7.x86_64.rpm
atomic-openshift-pod-3.5.5.31.80-1.git.0.c4a0780.el7.x86_64.rpm
atomic-openshift-sdn-ovs-3.5.5.31.80-1.git.0.c4a0780.el7.x86_64.rpm
atomic-openshift-tests-3.5.5.31.80-1.git.0.c4a0780.el7.x86_64.rpm
cockpit-debuginfo-160-3.el7.x86_64.rpm
cockpit-kubernetes-160-3.el7.x86_64.rpm
tuned-profiles-atomic-openshift-node-3.5.5.31.80-1.git.0.c4a0780.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2018-1002105
https://access.redhat.com/security/updates/classification/#critical
https://docs.openshift.com/container-platform/3.5/release_notes/ocp_3_5_release_notes.html

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXAVpTNzjgjWX9erEAQgbvRAAjLwkonIPikx7ofM1DZ40aI0AwSrMhRK1
pGPx+rriDE5AndP+ElQJvGxVGW3311f41onUgwHlKsur29KjLRxxHTddQvA/IN1X
1RmuCMKtJkOIczqw/wu/n0qm4BXZzekrcSbzIeRXz0cwD7qt3VZZDrhnJh1io7Tw
3SHLi3kTyYcudPFKFAcSfuy1jDW1dG0zOMzA2CuwMuwEN0KhPCrS8co37g9lMfaJ
dPGgj69BpPqQhOXHF2mHIbzvR4GTAF21eusAgDdDWxPBhZIxlSkem/WqMkpXKahc
38oAzgPZd88yuiKTG+/JHrVFHu4Hlhgl14fU33XqPADpk0+QnDf22N8z82ez1utt
d04lZzS48srqy8t18vPR8WnRA2Ftoze+7j+PZK01m1yVoKW7Eue8JnnTWfuavgiR
bZdxYQE4wQrTKrhKRPdsk6mP11h1jdxjZ1sDXiUsYMKtBBMy9r5SX3UhbgSlqIgx
ER6vdh6m7bWfUZGorVRN5mjWZi1eKIfk/4bHFVcXMdXm0BxM4QTwZRNZ7RO/JB2i
DIJgv19fsIjYuM/kOzD85HW3c7Ti0sbW/VLQsdtykyHqDi3HeJXoGV4cXR2KqK8l
HWhLDvCiTmYTqcUNmdoYARG3lKU8ax8S9qjzQIj8nDCZsW3SZLXaG+O/uVZaXkTu
fY0if+mXW4w=
=ON+p
- -----END PGP SIGNATURE-----
 
 --------------------------------------------------------------------------------

 -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: OpenShift Container Platform 3.6 security update
Advisory ID:       RHSA-2018:3598-01
Product:           Red Hat OpenShift Enterprise
Advisory URL:      https://access.redhat.com/errata/RHSA-2018:3598
Issue date:        2018-12-03
CVE Names:         CVE-2018-1002105 
=====================================================================

1. Summary:

An update is now available for Red Hat OpenShift Container Platform release
3.6.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenShift Container Platform 3.6 - noarch, x86_64

3. Description:

OpenShift Enterprise by Red Hat is the company's cloud computing
Platform-as-a-Service (PaaS) solution designed for on-premise or private
cloud deployments.

Security Fix(es):

* A privilege escalation vulnerability exists in OpenShift Container
Platform 3.x which allows for compromise of pods running on a compute node
to which a pod is scheduled with normal user privilege. This access could
include access to all secrets, pods, environment variables, running
pod/container processes, and persistent volumes, including in privileged
containers. Additionally, on versions 3.6 and higher of OpenShift Container
Platform, this vulnerability allows cluster-admin level access to any API
hosted by an aggregated API server. This includes the servicecatalog API
which is installed by default in 3.7 and later. Cluster-admin level access
to the service catalog allows creation of brokered services by an
unauthenticated user with escalated privileges in any namespace and on any
node. This could lead to an attacker being allowed to deploy malicious
code, or alter existing services. (CVE-2018-1002105)

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1648138 - CVE-2018-1002105 kubernetes: authentication/authorization bypass in
the handling of non-101 responses
1650020 - hawkular-metrics pod failed to become ready, infinispan
configuration is not right

6. Package List:

Red Hat OpenShift Container Platform 3.6:

Source:
atomic-openshift-3.6.173.0.140-1.git.0.9686d52.el7.src.rpm
openshift-ansible-3.6.173.0.140-1.git.0.0ccb19b.el7.src.rpm

noarch:
atomic-openshift-docker-excluder-3.6.173.0.140-1.git.0.9686d52.el7.noarch.rpm
atomic-openshift-excluder-3.6.173.0.140-1.git.0.9686d52.el7.noarch.rpm
atomic-openshift-utils-3.6.173.0.140-1.git.0.0ccb19b.el7.noarch.rpm
openshift-ansible-3.6.173.0.140-1.git.0.0ccb19b.el7.noarch.rpm
openshift-ansible-callback-plugins-3.6.173.0.140-1.git.0.0ccb19b.el7.noarch.rpm
openshift-ansible-docs-3.6.173.0.140-1.git.0.0ccb19b.el7.noarch.rpm
openshift-ansible-filter-plugins-3.6.173.0.140-1.git.0.0ccb19b.el7.noarch.rpm
openshift-ansible-lookup-plugins-3.6.173.0.140-1.git.0.0ccb19b.el7.noarch.rpm
openshift-ansible-playbooks-3.6.173.0.140-1.git.0.0ccb19b.el7.noarch.rpm
openshift-ansible-roles-3.6.173.0.140-1.git.0.0ccb19b.el7.noarch.rpm

x86_64:
atomic-openshift-3.6.173.0.140-1.git.0.9686d52.el7.x86_64.rpm
atomic-openshift-clients-3.6.173.0.140-1.git.0.9686d52.el7.x86_64.rpm
atomic-openshift-clients-redistributable-3.6.173.0.140-1.git.0.9686d52.el7.x86_64.rpm
atomic-openshift-cluster-capacity-3.6.173.0.140-1.git.0.9686d52.el7.x86_64.rpm
atomic-openshift-dockerregistry-3.6.173.0.140-1.git.0.9686d52.el7.x86_64.rpm
atomic-openshift-federation-services-3.6.173.0.140-1.git.0.9686d52.el7.x86_64.rpm
atomic-openshift-master-3.6.173.0.140-1.git.0.9686d52.el7.x86_64.rpm
atomic-openshift-node-3.6.173.0.140-1.git.0.9686d52.el7.x86_64.rpm
atomic-openshift-pod-3.6.173.0.140-1.git.0.9686d52.el7.x86_64.rpm
atomic-openshift-sdn-ovs-3.6.173.0.140-1.git.0.9686d52.el7.x86_64.rpm
atomic-openshift-service-catalog-3.6.173.0.140-1.git.0.9686d52.el7.x86_64.rpm
atomic-openshift-tests-3.6.173.0.140-1.git.0.9686d52.el7.x86_64.rpm
tuned-profiles-atomic-openshift-node-3.6.173.0.140-1.git.0.9686d52.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2018-1002105
https://access.redhat.com/security/updates/classification/#critical
https://access.redhat.com/security/vulnerabilities/3716411
https://docs.openshift.com/container-platform/3.6/release_notes/ocp_3_6_release_notes.html

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXAVpFtzjgjWX9erEAQiwCxAAltb3iVWSYDBCWdNzqN1+hbuTowsUWNAS
RAC1USrPCbwZUIwM6H1wGcN4dtNOuhyZDAIw00HI5QmlNKw/oVw5g9RN+CZeswCq
a2+KoSmd28d7Kjfk7zjrZX2zAMnDQ6qPPnnebWOF8qLDUwuPAa08dcO1jbMwtm80
2pF67SGWcAvPvJczcB8X3RTPoBlQkn5lEFthrge+KBX+hS2nBbpRll5zA8aNIhQE
uZKiVuSIYxb4rR81wXP7C89A8PAYv0widfS2mSwvKQnTiom9rJAEq1QXeWeDW9a0
T1lkHnSxX+lD/SAlzOjX4ApxSZL3PlI5ZHSkl8mhBROryym2CjGoGpyKhShggn7R
UtbFP9GbUWxEVLP7kW1b5KQt3nLt3b8zsA+4VYbdpY8NH3KpbwWPEftzI2P71jH1
ykcTiKuhsGNL1+Wze6IXy6hkdgF9dP05FT7a2MvhECnle486AEW0PG8gOUPdphFQ
EiVgGG1qn1Z+b38bjiyPGTcM+2gI/L8wc7eczONYIz6C+Z74iYnsGzv3KMVnQtdi
jrprss3/8iVTNE7xklWM5Kzq4neqfQCJvrvsjRPgozBH+1h7Z5Qr75FHrStWk4/f
UK/pTFtA0xdzlvu9qXG9i0y1brJsnxHyMQyQzMd4Ekjvu0Ossy9ifGomUYka2NPT
wdg93Tt4aEQ=
=spEk
- -----END PGP SIGNATURE-----

- --------------------------------------------------------------------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: OpenShift Container Platform 3.8 security update
Advisory ID:       RHSA-2018:3551-02
Product:           Red Hat OpenShift Enterprise
Advisory URL:      https://access.redhat.com/errata/RHSA-2018:3551
Issue date:        2018-11-19
CVE Names:         CVE-2018-1002105 
=====================================================================

1. Summary:

An update is now available for Red Hat OpenShift Container Platform 3.8.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenShift Container Platform 3.8 - noarch, x86_64

3. Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

Security Fix(es):

* A privilege escalation vulnerability exists in OpenShift Container
Platform 3.x which allows for compromise of pods running on a compute node
to which a pod is scheduled with normal user privilege. This access could
include access to all secrets, pods, environment variables, running
pod/container processes, and persistent volumes, including in privileged
containers. Additionally, on versions 3.6 and higher of OpenShift Container
Platform, this vulnerability allows cluster-admin level access to any API
hosted by an aggregated API server. This includes the servicecatalog API
which is installed by default in 3.7 and later. Cluster-admin level access
to the service catalog allows creation of brokered services by an
unauthenticated user with escalated privileges in any namespace and on any
node. This could lead to an attacker being allowed to deploy malicious
code, or alter existing services. (CVE-2018-1002105)

This advisory contains the RPM packages for Red Hat OpenShift Container
Platform 3.8.44. See the following advisory for the container images for
this release:

https://access.redhat.com/errata/RHBA-2018:3550

All OpenShift Container Platform 3.8 users are advised to upgrade to these
updated packages.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1648138 - CVE-2018-1002105 kubernetes: authentication/authorization bypass in
the handling of non-101 responses

6. Package List:

Red Hat OpenShift Container Platform 3.8:

Source:
atomic-openshift-3.8.44-1.git.0.9be0abd.el7.src.rpm
atomic-openshift-descheduler-0.3.0-1.el7.src.rpm
atomic-openshift-dockerregistry-3.8.44-1.git.224.90f9341.el7.src.rpm
atomic-openshift-node-problem-detector-3.7.0-0.el7.src.rpm
openshift-ansible-3.8.44-1.git.0.2bfde74.el7.src.rpm
python-paramiko-2.1.1-4.el7.src.rpm

noarch:
atomic-openshift-docker-excluder-3.8.44-1.git.0.9be0abd.el7.noarch.rpm
atomic-openshift-excluder-3.8.44-1.git.0.9be0abd.el7.noarch.rpm
atomic-openshift-utils-3.8.44-1.git.0.2bfde74.el7.noarch.rpm
openshift-ansible-3.8.44-1.git.0.2bfde74.el7.noarch.rpm
openshift-ansible-docs-3.8.44-1.git.0.2bfde74.el7.noarch.rpm
openshift-ansible-playbooks-3.8.44-1.git.0.2bfde74.el7.noarch.rpm
openshift-ansible-roles-3.8.44-1.git.0.2bfde74.el7.noarch.rpm
python-paramiko-2.1.1-4.el7.noarch.rpm
python-paramiko-doc-2.1.1-4.el7.noarch.rpm

x86_64:
atomic-openshift-3.8.44-1.git.0.9be0abd.el7.x86_64.rpm
atomic-openshift-clients-3.8.44-1.git.0.9be0abd.el7.x86_64.rpm
atomic-openshift-clients-redistributable-3.8.44-1.git.0.9be0abd.el7.x86_64.rpm
atomic-openshift-cluster-capacity-3.8.44-1.git.0.9be0abd.el7.x86_64.rpm
atomic-openshift-descheduler-0.3.0-1.el7.x86_64.rpm
atomic-openshift-dockerregistry-3.8.44-1.git.224.90f9341.el7.x86_64.rpm
atomic-openshift-federation-services-3.8.44-1.git.0.9be0abd.el7.x86_64.rpm
atomic-openshift-master-3.8.44-1.git.0.9be0abd.el7.x86_64.rpm
atomic-openshift-node-3.8.44-1.git.0.9be0abd.el7.x86_64.rpm
atomic-openshift-node-problem-detector-3.7.0-0.el7.x86_64.rpm
atomic-openshift-pod-3.8.44-1.git.0.9be0abd.el7.x86_64.rpm
atomic-openshift-sdn-ovs-3.8.44-1.git.0.9be0abd.el7.x86_64.rpm
atomic-openshift-service-catalog-3.8.44-1.git.0.9be0abd.el7.x86_64.rpm
atomic-openshift-template-service-broker-3.8.44-1.git.0.9be0abd.el7.x86_64.rpm
atomic-openshift-tests-3.8.44-1.git.0.9be0abd.el7.x86_64.rpm
tuned-profiles-atomic-openshift-node-3.8.44-1.git.0.9be0abd.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2018-1002105
https://access.redhat.com/security/updates/classification/#critical
https://access.redhat.com/security/vulnerabilities/3716411
https://access.redhat.com/errata/RHBA-2018:3550

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXAVpIdzjgjWX9erEAQhWpQ//TDVoab9BQ48J1tBc4cnYpUb16I8ISQjI
kUrK+3J2BgqJGd+WaRU4v4GBQmol7OuHPeHDDv8YxhZ2rt0E020l4G2y80girQvX
6ZDH52u0D9FtPfycUtkn0puF3VESjVljvw0YF3cOaNEoCqtwu5C3knM8igW4RVGy
ATgTOVnXekz8TwXB9xkcBmC6NyP/ENnBh9Wfmyz/HnTMjCZj7Qm3YvURDr1kUkh6
oiBXI+HE4yGq4/LOI6BPABtZsOolUJyEE5ICASkWn7J7btfvpxuErw6u/5ZVr5qI
m3iFKpNWZC6klqgio3nMx3snB+RCdu19z2WuW9CTQqDzqdfV7vv9mSYvkeDxsCGf
KvJ89RVv3yWhK7O/EAnN14NeUngHatZYWSGOeY8y/sMMZl0AtbaOTH++150F2cfs
qyNGWI+UvXYK8kSGM+9dKWN3uYqeGYAdcaL2KY2UqNnPXIV3u22oJL6cUES66QKk
W0Ue8kUumZRniGa6+jVi2k9P2wCPzqyJdlm1b0sNfw1cRin137hnJYVKAa233t4q
A3tLSYlUDexIAy+z3zKwUkaoG1wqeBGTYJIktm4iYr44tnv1G9LsxiP/yBJo5xbm
SjyaSgeAqnZUtU9KLNciU0oOgkESa/p4cdwDYQxk8an6nf8zc+iZ2GHSNpGZZiSt
I5qOf95ZJ/k=
=YgzG
- -----END PGP SIGNATURE-----

- --------------------------------------------------------------------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: OpenShift Container Platform 3.10 security update
Advisory ID:       RHSA-2018:3549-02
Product:           Red Hat OpenShift Enterprise
Advisory URL:      https://access.redhat.com/errata/RHSA-2018:3549
Issue date:        2018-11-20
CVE Names:         CVE-2018-1002105 
=====================================================================

1. Summary:

An update is now available for Red Hat OpenShift Container Platform 3.10.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenShift Container Platform 3.10 - noarch, ppc64le, x86_64

3. Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

Security Fix(es):

* A privilege escalation vulnerability exists in OpenShift Container
Platform 3.x which allows for compromise of pods running on a compute node
to which a pod is scheduled with normal user privilege. This access could
include access to all secrets, pods, environment variables, running
pod/container processes, and persistent volumes, including in privileged
containers. Additionally, on versions 3.6 and higher of OpenShift Container
Platform, this vulnerability allows cluster-admin level access to any API
hosted by an aggregated API server. This includes the servicecatalog API
which is installed by default in 3.7 and later. Cluster-admin level access
to the service catalog allows creation of brokered services by an
unauthenticated user with escalated privileges in any namespace and on any
node. This could lead to an attacker being allowed to deploy malicious
code, or alter existing services. (CVE-2018-1002105)

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1648138 - CVE-2018-1002105 kubernetes: authentication/authorization bypass in
the handling of non-101 responses

6. Package List:

Red Hat OpenShift Container Platform 3.10:

Source:
atomic-enterprise-service-catalog-3.10.72-1.git.1450.7d3f435.el7.src.rpm
atomic-openshift-3.10.72-1.git.0.3cb2fdc.el7.src.rpm
atomic-openshift-descheduler-3.10.72-1.git.299.953c1c8.el7.src.rpm
atomic-openshift-dockerregistry-3.10.72-1.git.390.186ec4f.el7.src.rpm
atomic-openshift-node-problem-detector-3.10.72-1.git.252.fa9e8ae.el7.src.rpm
atomic-openshift-web-console-3.10.72-1.git.395.d23c438.el7.src.rpm
golang-github-prometheus-node_exporter-3.10.72-1.git.1060.64daa26.el7.src.rpm
openshift-ansible-3.10.73-1.git.0.8b65cea.el7.src.rpm
openshift-enterprise-cluster-capacity-3.10.72-1.git.380.0fd53e8.el7.src.rpm
openshift-monitor-project-lifecycle-3.10.72-1.git.59.5358725.el7.src.rpm
openshift-monitor-sample-app-3.10.72-1.git.5.de405bc.el7.src.rpm

noarch:
atomic-openshift-docker-excluder-3.10.72-1.git.0.3cb2fdc.el7.noarch.rpm
atomic-openshift-excluder-3.10.72-1.git.0.3cb2fdc.el7.noarch.rpm
openshift-ansible-3.10.73-1.git.0.8b65cea.el7.noarch.rpm
openshift-ansible-docs-3.10.73-1.git.0.8b65cea.el7.noarch.rpm
openshift-ansible-playbooks-3.10.73-1.git.0.8b65cea.el7.noarch.rpm
openshift-ansible-roles-3.10.73-1.git.0.8b65cea.el7.noarch.rpm

ppc64le:
atomic-enterprise-service-catalog-3.10.72-1.git.1450.7d3f435.el7.ppc64le.rpm
atomic-enterprise-service-catalog-svcat-3.10.72-1.git.1450.7d3f435.el7.ppc64le.rpm
atomic-openshift-3.10.72-1.git.0.3cb2fdc.el7.ppc64le.rpm
atomic-openshift-clients-3.10.72-1.git.0.3cb2fdc.el7.ppc64le.rpm
atomic-openshift-descheduler-3.10.72-1.git.299.953c1c8.el7.ppc64le.rpm
atomic-openshift-dockerregistry-3.10.72-1.git.390.186ec4f.el7.ppc64le.rpm
atomic-openshift-hyperkube-3.10.72-1.git.0.3cb2fdc.el7.ppc64le.rpm
atomic-openshift-hypershift-3.10.72-1.git.0.3cb2fdc.el7.ppc64le.rpm
atomic-openshift-master-3.10.72-1.git.0.3cb2fdc.el7.ppc64le.rpm
atomic-openshift-node-3.10.72-1.git.0.3cb2fdc.el7.ppc64le.rpm
atomic-openshift-node-problem-detector-3.10.72-1.git.252.fa9e8ae.el7.ppc64le.rpm
atomic-openshift-pod-3.10.72-1.git.0.3cb2fdc.el7.ppc64le.rpm
atomic-openshift-sdn-ovs-3.10.72-1.git.0.3cb2fdc.el7.ppc64le.rpm
atomic-openshift-template-service-broker-3.10.72-1.git.0.3cb2fdc.el7.ppc64le.rpm
atomic-openshift-tests-3.10.72-1.git.0.3cb2fdc.el7.ppc64le.rpm
atomic-openshift-web-console-3.10.72-1.git.395.d23c438.el7.ppc64le.rpm
openshift-enterprise-cluster-capacity-3.10.72-1.git.380.0fd53e8.el7.ppc64le.rpm
openshift-monitor-project-lifecycle-3.10.72-1.git.59.5358725.el7.ppc64le.rpm
openshift-monitor-sample-app-3.10.72-1.git.5.de405bc.el7.ppc64le.rpm
prometheus-node-exporter-3.10.72-1.git.1060.64daa26.el7.ppc64le.rpm

x86_64:
atomic-enterprise-service-catalog-3.10.72-1.git.1450.7d3f435.el7.x86_64.rpm
atomic-enterprise-service-catalog-svcat-3.10.72-1.git.1450.7d3f435.el7.x86_64.rpm
atomic-openshift-3.10.72-1.git.0.3cb2fdc.el7.x86_64.rpm
atomic-openshift-clients-3.10.72-1.git.0.3cb2fdc.el7.x86_64.rpm
atomic-openshift-clients-redistributable-3.10.72-1.git.0.3cb2fdc.el7.x86_64.rpm
atomic-openshift-descheduler-3.10.72-1.git.299.953c1c8.el7.x86_64.rpm
atomic-openshift-dockerregistry-3.10.72-1.git.390.186ec4f.el7.x86_64.rpm
atomic-openshift-hyperkube-3.10.72-1.git.0.3cb2fdc.el7.x86_64.rpm
atomic-openshift-hypershift-3.10.72-1.git.0.3cb2fdc.el7.x86_64.rpm
atomic-openshift-master-3.10.72-1.git.0.3cb2fdc.el7.x86_64.rpm
atomic-openshift-node-3.10.72-1.git.0.3cb2fdc.el7.x86_64.rpm
atomic-openshift-node-problem-detector-3.10.72-1.git.252.fa9e8ae.el7.x86_64.rpm
atomic-openshift-pod-3.10.72-1.git.0.3cb2fdc.el7.x86_64.rpm
atomic-openshift-sdn-ovs-3.10.72-1.git.0.3cb2fdc.el7.x86_64.rpm
atomic-openshift-template-service-broker-3.10.72-1.git.0.3cb2fdc.el7.x86_64.rpm
atomic-openshift-tests-3.10.72-1.git.0.3cb2fdc.el7.x86_64.rpm
atomic-openshift-web-console-3.10.72-1.git.395.d23c438.el7.x86_64.rpm
openshift-enterprise-cluster-capacity-3.10.72-1.git.380.0fd53e8.el7.x86_64.rpm
openshift-monitor-project-lifecycle-3.10.72-1.git.59.5358725.el7.x86_64.rpm
openshift-monitor-sample-app-3.10.72-1.git.5.de405bc.el7.x86_64.rpm
prometheus-node-exporter-3.10.72-1.git.1060.64daa26.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2018-1002105
https://access.redhat.com/security/updates/classification/#critical
https://access.redhat.com/security/vulnerabilities/3716411
https://docs.openshift.com/container-platform/3.10/release_notes/ocp_3_10_release_notes.html

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXAVomNzjgjWX9erEAQhBWQ//UmwS8fHkbbikFnJDR5mQDYfIpCG/pl/B
RSEfb6ncO+r4IfJ9c/Nf64QLrrMJRWxUWm5fWuhLuaYLq73JX/pwoT0Sf0ZRivdm
ybNDJy0GuBjXyeKHFAh0fjaLOlLFSf8esUyU4keSVSCuvRyk0aS0EtlgPinvlscG
nGWCdqKm2L4n/TDIiwp2W2z9yhn49N+ILB8yCaOXCKcQE5Pg8kmMfa+f2kpWpP3I
9UY68nqbhAnZ/KKCik/nGhK5k3vDBCDnxm/AD3bWKTHHiT60yUSxRv37GD+WUgFb
kfOz66RlNNu5AnWS1X7uQQzE5+Ux2HlRHvmuft1krOUqmD5zOdvhqptILzH74i7z
eTde80AitS9NNu1EDfnOMPv2YC+NcryE21Ls/qmgTGmMSvPYvUhQqrufIRxgytoQ
nUiEoRNe8USCZowBoo6igHSjoA9HJai+vPlNtsV0qrVOKBcKRf6u6LjSCXYdNxr3
XLLv8O53Y4wk3qcSUhTd4B2u5/izZ6yL0VkEmuUyUGk9BDjormlkjyS9qW44v3py
c4N90i1zAHAqUPg+noTbMitMi3G84r7b8H7qAMJETjtJJYWa+Es7n/U2C7nHc294
ijCjOKXxFnS+iECk/1YL46nC1PWmcT3eorWlg1V8uLPiDczN2ANuPm196f7h4eP1
Ssa81w+Zo6c=
=KxaQ
- -----END PGP SIGNATURE-----

- --------------------------------------------------------------------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: OpenShift Container Platform 3.11 security update
Advisory ID:       RHSA-2018:3537-02
Product:           Red Hat OpenShift Enterprise
Advisory URL:      https://access.redhat.com/errata/RHSA-2018:3537
Issue date:        2018-11-20
CVE Names:         CVE-2018-3830 CVE-2018-12115 CVE-2018-1002105 
=====================================================================

1. Summary:

An update is now available for Red Hat OpenShift Container Platform 3.11.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenShift Container Platform 3.11 - noarch, x86_64

3. Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

Security Fix(es):

* A privilege escalation vulnerability exists in OpenShift Container
Platform 3.x which allows for compromise of pods running on a compute node
to which a pod is scheduled with normal user privilege. This access could
include access to all secrets, pods, environment variables, running
pod/container processes, and persistent volumes, including in privileged
containers. Additionally, on versions 3.6 and higher of OpenShift Container
Platform, this vulnerability allows cluster-admin level access to any API
hosted by an aggregated API server. This includes the servicecatalog API
which is installed by default in 3.7 and later. Cluster-admin level access
to the service catalog allows creation of brokered services by an
unauthenticated user with escalated privileges in any namespace and on any
node. This could lead to an attacker being allowed to deploy malicious
code, or alter existing services. (CVE-2018-1002105)

* nodejs: Out of bounds (OOB) write via UCS-2 encoding (CVE-2018-12115)

* kibana: Cross-site scripting via the source field formatter
(CVE-2018-3830)

Space precludes documenting all of the bug fixes and enhancements in this
advisory. See the following Release Notes documentation for details about
these changes:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_r
elease_notes.html

All OpenShift Container Platform 3.11 users are advised to upgrade to these
updated packages and images.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1552304 - CRI-O pod log lines are occasionally split mid-line
1613722 - Eventrouter creates duplicated events every 30 min with verb UPDATE
1614904 - Validation of static pod fails due to inconsistent names
1615884 - Ability to install a cluster with a mix of Docker and CRI-O nodes
1620219 - CVE-2018-12115 nodejs: Out of bounds (OOB) write via UCS-2 encoding
1622822 - Logging should restricted to to current owner/group of a namespace.
1625090 - [CNS][3.11] Run standalone deployment playbook with
glusterfs_registry group failed due to AnsibleUndefinedVariable
1626228 - Sometimes builds on api.ci fail with "no such image"
1626538 - openshift-ansible in 3.11 fails OCP 3.11 on OSP 13
1627086 - ElasticSearch pods flapping with "fatal error on the network layer"
exception when logging from 1000+ nodes
1627689 - The elasticsearch-config should be logging-elasticsearch-ops in
logging-es-ops pods
1628235 - Service Catalog establishes a new connection for every request and
never closes them.
1628381 - [docs] Document expectations regarding operational management of
NodeWithImpairedVolumes
1628902 - Meet 'openshift_is_atomic' is undefined during execute CNS standalone
deployment playbook with glusterfs_registry group
1629558 - Fail to atomic pull node image due to docker service was stopped in
previous task
1632364 - [3.11] Fluentd cannot handle S2I Logs
1632450 - CVE-2018-3830 kibana: Cross-site scripting via the source field
formatter
1632648 - [3.11] Record is missing kubernetes field when use  '--log-driver
journald' in /etc/sysconfig/docker
1632895 - [3.11] logging-eventrouter event not formatted correctly in
Elasticsearch when using MUX
1633574 - Should not assign the egressIP to node automatically if there are
multiple egressIPs in the project
1633923 - openshift-autoheal fails to install in disconnected install
1634700 - [3.11] Modification in master-config.yaml is causing a failure during
Master-API restart (runtime-config)
1634835 - Glusterfs-registry pods also get removed while only glusterfs is
being uninstalled
1635672 - Use GLUSTER_BLOCKD_STATUS_PROBE_ENABLE enabled templates in glusterfs
playbooks
1636248 - not enough master nodes discoverd because service logging-es-cluster
is not headless
1637413 - 3.11: APP pod unable to start after target port failure in cases
where single paths are mounted on APP pods(BZ#1599742)
1637737 - Service catalog controller segmentation fault
1641245 - Upgrade to 3.11 on atomic host fails during Install or Update node
system container task
1641321 - Pods in error state after installing OpenShift with OSP14
1641657 - [3.11] Registry doesn't honors openshift_additional_ca
1641796 - controller-manager pod stops responding with max memory usage and lot
of open tcp sockets
1642002 - cockpit-docker is installed (and docker as dependency) even if you
just want to use cri-o
1642350 - Failure to restore cache produces corrupted files passed to
incremental builds
1643119 - Secure ldap identity provider fails to query the LDAP server. "tls:
bad record MAC"
1643301 - Provisioning  two APB services temporarily broke networking in the
namespace
1643948 - Cluster console doesn't display the real value of Crashlooping Pods
(it displays 0)
1648138 - CVE-2018-1002105 kubernetes: authentication/authorization bypass in
the handling of non-101 responses

6. Package List:

Red Hat OpenShift Container Platform 3.11:

Source:
atomic-enterprise-service-catalog-3.11.43-1.git.1671.04b17f5.el7.src.rpm
atomic-openshift-3.11.43-1.git.0.647ac05.el7.src.rpm
atomic-openshift-cluster-autoscaler-3.11.43-1.git.0.55c4e4b.el7.src.rpm
atomic-openshift-descheduler-3.11.43-1.git.300.a720f7f.el7.src.rpm
atomic-openshift-metrics-server-3.11.43-1.git.52.6cc0a21.el7.src.rpm
atomic-openshift-node-problem-detector-3.11.43-1.git.252.f45475c.el7.src.rpm
atomic-openshift-service-idler-3.11.43-1.git.14.bbbb450.el7.src.rpm
atomic-openshift-web-console-3.11.43-1.git.316.7753377.el7.src.rpm
cri-o-1.11.8-2.rhaos3.11.git71cc465.el7.src.rpm
golang-github-openshift-oauth-proxy-3.11.43-1.git.419.03122b3.el7.src.rpm
golang-github-prometheus-alertmanager-3.11.43-1.git.0.19c2765.el7.src.rpm
golang-github-prometheus-node_exporter-3.11.43-1.git.1060.0aff287.el7.src.rpm
golang-github-prometheus-prometheus-3.11.43-1.git.5021.31a8f1d.el7.src.rpm
jenkins-2-plugins-3.11.1539805268-1.el7.src.rpm
kibana-5.6.12-1.el7.src.rpm
openshift-ansible-3.11.43-1.git.0.fa69a02.el7.src.rpm
openshift-enterprise-autoheal-3.11.43-1.git.219.be400cf.el7.src.rpm
openshift-enterprise-cluster-capacity-3.11.43-1.git.380.9cbcbb2.el7.src.rpm
openshift-external-storage-0.0.2-4.gitd3c94f0.el7.src.rpm
openshift-monitor-project-lifecycle-3.11.43-1.git.59.662daae.el7.src.rpm
openshift-monitor-sample-app-3.11.43-1.git.5.83ab17f.el7.src.rpm
python-elasticsearch-5.5.5-1.el7.src.rpm
python-nose-xcover-1.0.10-1.el7.src.rpm

noarch:
atomic-openshift-docker-excluder-3.11.43-1.git.0.647ac05.el7.noarch.rpm
atomic-openshift-excluder-3.11.43-1.git.0.647ac05.el7.noarch.rpm
jenkins-2-plugins-3.11.1539805268-1.el7.noarch.rpm
openshift-ansible-3.11.43-1.git.0.fa69a02.el7.noarch.rpm
openshift-ansible-docs-3.11.43-1.git.0.fa69a02.el7.noarch.rpm
openshift-ansible-playbooks-3.11.43-1.git.0.fa69a02.el7.noarch.rpm
openshift-ansible-roles-3.11.43-1.git.0.fa69a02.el7.noarch.rpm
python-elasticsearch-5.5.5-1.el7.noarch.rpm
python-nose-xcover-1.0.10-1.el7.noarch.rpm

x86_64:
atomic-enterprise-service-catalog-3.11.43-1.git.1671.04b17f5.el7.x86_64.rpm
atomic-enterprise-service-catalog-svcat-3.11.43-1.git.1671.04b17f5.el7.x86_64.rpm
atomic-openshift-3.11.43-1.git.0.647ac05.el7.x86_64.rpm
atomic-openshift-clients-3.11.43-1.git.0.647ac05.el7.x86_64.rpm
atomic-openshift-clients-redistributable-3.11.43-1.git.0.647ac05.el7.x86_64.rpm
atomic-openshift-cluster-autoscaler-3.11.43-1.git.0.55c4e4b.el7.x86_64.rpm
atomic-openshift-descheduler-3.11.43-1.git.300.a720f7f.el7.x86_64.rpm
atomic-openshift-dockerregistry-3.11.43-1.git.446.b80f8a1.el7.x86_64.rpm
atomic-openshift-hyperkube-3.11.43-1.git.0.647ac05.el7.x86_64.rpm
atomic-openshift-hypershift-3.11.43-1.git.0.647ac05.el7.x86_64.rpm
atomic-openshift-master-3.11.43-1.git.0.647ac05.el7.x86_64.rpm
atomic-openshift-metrics-server-3.11.43-1.git.52.6cc0a21.el7.x86_64.rpm
atomic-openshift-node-3.11.43-1.git.0.647ac05.el7.x86_64.rpm
atomic-openshift-node-problem-detector-3.11.43-1.git.252.f45475c.el7.x86_64.rpm
atomic-openshift-pod-3.11.43-1.git.0.647ac05.el7.x86_64.rpm
atomic-openshift-sdn-ovs-3.11.43-1.git.0.647ac05.el7.x86_64.rpm
atomic-openshift-service-idler-3.11.43-1.git.14.bbbb450.el7.x86_64.rpm
atomic-openshift-template-service-broker-3.11.43-1.git.0.647ac05.el7.x86_64.rpm
atomic-openshift-tests-3.11.43-1.git.0.647ac05.el7.x86_64.rpm
atomic-openshift-web-console-3.11.43-1.git.316.7753377.el7.x86_64.rpm
cri-o-1.11.8-2.rhaos3.11.git71cc465.el7.x86_64.rpm
golang-github-openshift-oauth-proxy-3.11.43-1.git.419.03122b3.el7.x86_64.rpm
kibana-5.6.12-1.el7.x86_64.rpm
kibana-debuginfo-5.6.12-1.el7.x86_64.rpm
openshift-enterprise-autoheal-3.11.43-1.git.219.be400cf.el7.x86_64.rpm
openshift-enterprise-cluster-capacity-3.11.43-1.git.380.9cbcbb2.el7.x86_64.rpm
openshift-external-storage-cephfs-provisioner-0.0.2-4.gitd3c94f0.el7.x86_64.rpm
openshift-external-storage-debuginfo-0.0.2-4.gitd3c94f0.el7.x86_64.rpm
openshift-external-storage-efs-provisioner-0.0.2-4.gitd3c94f0.el7.x86_64.rpm
openshift-external-storage-local-provisioner-0.0.2-4.gitd3c94f0.el7.x86_64.rpm
openshift-external-storage-manila-provisioner-0.0.2-4.gitd3c94f0.el7.x86_64.rpm
openshift-external-storage-snapshot-controller-0.0.2-4.gitd3c94f0.el7.x86_64.rpm
openshift-external-storage-snapshot-provisioner-0.0.2-4.gitd3c94f0.el7.x86_64.rpm
openshift-monitor-project-lifecycle-3.11.43-1.git.59.662daae.el7.x86_64.rpm
openshift-monitor-sample-app-3.11.43-1.git.5.83ab17f.el7.x86_64.rpm
prometheus-3.11.43-1.git.5021.31a8f1d.el7.x86_64.rpm
prometheus-alertmanager-3.11.43-1.git.0.19c2765.el7.x86_64.rpm
prometheus-node-exporter-3.11.43-1.git.1060.0aff287.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2018-3830
https://access.redhat.com/security/cve/CVE-2018-12115
https://access.redhat.com/security/cve/CVE-2018-1002105
https://access.redhat.com/security/updates/classification/#critical
https://access.redhat.com/security/vulnerabilities/3716411
https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXAVoI9zjgjWX9erEAQhuOxAAiHQ4xCiHB/n5eo3v0G/DgRrHFGlQE5p5
5ZikmKGbyg3tkNRiQGO+ydDUCscNI9z0BzlN1LLXy6UECAw6pqa/d9o1bzx8ZxIQ
+8k2mcI3By4Z5XQCv1x/udHnzDGxhQRNOVzrJWMq4l2kOZLv9SSI6ZnuApNsLi1V
lx2cuVil+oU1K1ggLnnikuW+gdx7b3EgA3PWgHPcHUqdDmb3TwMoHUKKhU2FJ7z5
+ekKPAhw1boomCLXA17T56U/naP96GxKFTvq1kWTelFyGprOuTVPRfGE5e0nke5p
df51YixF5M4HTmha+VS/MFmhDrqElRpR29KgPuK/mFMzHlYZmLEehve0agedzONy
st6RFX4/SiKg0xej76pDMO6vyby0PKOSfOiwtYG0+3eW3M1gnGpnAzcIFu5/Moma
AC49hZYS+GqwxK5otrMn4k9sd4P/CKCVn0Qtt2A5PupwoYpqlvAyyY4tHNbI/2JD
p6BwYTolOVPdenPQLbuXnnNrW0Ypr6XaSLNgkIaRMu8NmzdsbShvy+jD1JcY8qFU
Zq0eBzBa7m0qvBoBMPD4eplyqH1LZlE/RMQWuwC/jl8XH5G+tdflJ237bCmbDex5
+kjvXYzTxV09AJchghEmbEemwwyLhWzFNpBFvlazvXWADCN7Agci9x0Mf4HZtC5t
n1MJSBYpnUU=
=qfY8
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXAXJM2aOgq3Tt24GAQjh3w/+I8VihqcXUaXbpNeeocTxN6Ob4XNCiNTi
Uu88SYoahcjYk2DHkODkhKjQJtDu/Gs+N+ZmoJS4KN7Zc80gC7whN3a4uDBCI0gP
F9v6hBpoiBfEwKTwharuT03l9HOg6hivEW3SphTsk7nvWQ/k4kTjXM9Q0eAaTgGV
oD42sfFasBbDebUBWGSvMCFzt1Vci2NSjBzmIC+TvoEEWkLfvNueju2bIt+JFrYQ
EwdxFMI2FR711Gr9AkD/0OPeJeydEYrd3Ze8qeciCE1oomi8Krz0klTkCCYy9RSp
F5a01riFYpHISggy/Yhs5w+BalPbq+FHY9iuwiMCUlAQ/zJJqGYX6cpAKcwIR60O
bIWYsDXgEf1D4Rm1sUJLxobRAze1lEw8Ub/0tzHkRxbGR8dkxHKlnIyhoulFJ76A
7yoRusFUv5bgBAJ/Wfw51v3nL/Ww7foPftTgMUanSHP0ujrjtXu58WeS846S/h2U
yfkOSW6NQoJPOvVOPFNBm602YZa1ebo6CxoM2FTE17kZ4FiqWtCr0i6k19947BoA
aQcJ7/PEL/5a75aFtge8UBNLZhTbeTR8zbi+SGkgWJbLZAlVDEOR9dlugJlG0b8K
7Mc9ZUbkNELgZzEMb+P0k1vaPdDJOVAY98PxLkaIvdbcBHLl3w4WESVyyDBhPyaP
92WSR0S28ro=
=fJVH
-----END PGP SIGNATURE-----

« Back to bulletins