Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.2812
Moderate: Red Hat Enterprise Linux OpenStack Platform security update
21 September 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Red Hat Enterprise Linux OpenStack Platform
Publisher: Red Hat
Operating System: Red Hat
Impact/Access: Execute Arbitrary Code/Commands -- Existing Account
Modify Arbitrary Files -- Existing Account
Denial of Service -- Remote/Unauthenticated
Access Confidential Data -- Remote with User Interaction
Reduced Security -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2018-14620 CVE-2018-10915 CVE-2018-10892
CVE-2018-2819 CVE-2018-2817 CVE-2018-2813
CVE-2018-2781 CVE-2018-2771 CVE-2018-2767
CVE-2018-2761 CVE-2018-2755 CVE-2018-2668
CVE-2018-2665 CVE-2018-2640 CVE-2018-2622
CVE-2018-2562 CVE-2017-10384 CVE-2017-10379
CVE-2017-10378 CVE-2017-10268 CVE-2017-3653
CVE-2017-3651 CVE-2017-3641 CVE-2017-3636
Reference: ESB-2018.0770
ESB-2017.1801
Original Bulletin:
https://access.redhat.com/errata/RHSA-2018:2729
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: Red Hat Enterprise Linux OpenStack Platform security update
Advisory ID: RHSA-2018:2729-01
Product: Red Hat Enterprise Linux OpenStack Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2018:2729
Issue date: 2018-09-19
Cross references: RHSA-2018:2439 RHSA-2018:2482 RHSA-2018:2557
CVE Names: CVE-2017-3636 CVE-2017-3641 CVE-2017-3651
CVE-2017-3653 CVE-2017-10268 CVE-2017-10378
CVE-2017-10379 CVE-2017-10384 CVE-2018-2562
CVE-2018-2622 CVE-2018-2640 CVE-2018-2665
CVE-2018-2668 CVE-2018-2755 CVE-2018-2761
CVE-2018-2767 CVE-2018-2771 CVE-2018-2781
CVE-2018-2813 CVE-2018-2817 CVE-2018-2819
CVE-2018-10892 CVE-2018-10915 CVE-2018-14620
=====================================================================
1. Summary:
An update is now available for Red Hat OpenStack Platform 12.0 (Pike).
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Description:
Red Hat OpenStack Platform provides the facilities for building, deploying
and monitoring a private or public infrastructure-as-a-service (IaaS) cloud
running on commonly available physical hardware.
Security Fix(es):
* openstack-rabbitmq-container: Insecure download of rabbitmq_clusterer
during docker build (CVE-2018-14620)
For more details about the security issue, including the impact, a CVSS
score, and other related information, refer to the CVE page listed in the
References section.
The Red Hat OpenStack Platform container images have been updated to
address security advisory/ies: RHSA-2018:2439, RHSA-2018:2482,
RHSA-2018:2557.
3. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing this update, the MariaDB server daemon (mysqld) will be
restarted automatically.
4. Bugs fixed (https://bugzilla.redhat.com/):
1626953 - CVE-2018-14620 openstack-rabbitmq-container: Insecure download of rabbitmq_clusterer during docker build
5. References:
https://access.redhat.com/security/cve/CVE-2017-3636
https://access.redhat.com/security/cve/CVE-2017-3641
https://access.redhat.com/security/cve/CVE-2017-3651
https://access.redhat.com/security/cve/CVE-2017-3653
https://access.redhat.com/security/cve/CVE-2017-10268
https://access.redhat.com/security/cve/CVE-2017-10378
https://access.redhat.com/security/cve/CVE-2017-10379
https://access.redhat.com/security/cve/CVE-2017-10384
https://access.redhat.com/security/cve/CVE-2018-2562
https://access.redhat.com/security/cve/CVE-2018-2622
https://access.redhat.com/security/cve/CVE-2018-2640
https://access.redhat.com/security/cve/CVE-2018-2665
https://access.redhat.com/security/cve/CVE-2018-2668
https://access.redhat.com/security/cve/CVE-2018-2755
https://access.redhat.com/security/cve/CVE-2018-2761
https://access.redhat.com/security/cve/CVE-2018-2767
https://access.redhat.com/security/cve/CVE-2018-2771
https://access.redhat.com/security/cve/CVE-2018-2781
https://access.redhat.com/security/cve/CVE-2018-2813
https://access.redhat.com/security/cve/CVE-2018-2817
https://access.redhat.com/security/cve/CVE-2018-2819
https://access.redhat.com/security/cve/CVE-2018-10892
https://access.redhat.com/security/cve/CVE-2018-10915
https://access.redhat.com/security/cve/CVE-2018-14620
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/security/cve/CVE-2018-14620
6. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBW6OAjNzjgjWX9erEAQjW9g//b6m07yIvZB6dZFDvgZAws3nFRNMyPiq0
v46z32zNN7b4QGxVe4F1x1uNkScIME8PCTPkZFRyioFGCbu42Co5zWIava0YdEhJ
0Vm3BXOSUmt5nFFvNqB6SvbTMBcuCn98vZ31X6t55sXylHSzEkL6Jjn0zEVYTwWw
Jr5ahY5fPClFbvcMEBQ/MKGgS840VzcEzx7ScLuNtKaUL5bSC2zGJbKeu+qekIzH
QxY1j9BmjxcJ9AAJCu1zieJjTbdVdQ8pohBpJDtpe33al8GK1csE4wZAfy2oKaXl
dSJlkdgYRkH/1jXjqj1T7CiPr3S8L/VwCm8NcIDImbbDpZ1yzF6Obyf+qs2RTO50
LignXhZ9rl3zSnVEXWbyI0IdQjLXbBLlwZxtTcQ+7BXx8uItUOFSxFz/Gt91FF2p
lT6gvD5KQ5f8uTZH9Wq0xAd6fDmvhYwTJklnQ0gTehFPyAnOuheSCH7qVkoQrUtO
nnQz+/EY9wX7fxPxs2YS2SkWjmgI1rp0wpIHqgd+aK52rltVxlCMCR6LaA/deJiw
J8Uu61gszCElPLw3W4DKCmeKBP7sD7ZcmIwJTq2bpaum5Ym/RkH68sFYP6sfvcQ2
y3QCguwMPTNJ/ieottjGCAd8+zO1vCcWRy4KF9LTPXRm3rnds1ibjJnei5AhrqVJ
+lkQ5BUzhs4=
=cP2C
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBW6RfcmaOgq3Tt24GAQgKsg//XTeDsRMV8HoVy2Qqd1FtPhNl9ZdtjVma
wt8kLs2exNAUqpPtA6xBnlCx1sVl3dPk1EcM+K7/LDhjRrcZWwix7P84m8oTaYTa
43XSxMfl64gRjtBn/Bw73ppPxw0a7/+aQ5YqsWp0cV54ygJpjn/yqo++1w7WefXJ
4yz6PPA0SIVe08eDx8NWMnf02tGBIhDfUHPmSOHHLxg0xCah6vEKxwH8SAU/FDbS
ciRfuljqjyUYpXZ1/VY5vti7H4n7hiiB2NE4/CR7gghXS7zoQoKH6JGZBtxQajCo
G4B8lWir4MruE1BbVswiPu5RJyNjXi9t7tntfgmy6oObTyplMJTEV5XAf7kS6RtP
svCi8HvKK9uI0ZpaZykvcPpOEd932Ta7C7+78Zhkkx1SgKTFq/N9xQ4LfCFcEMMA
VkG/1W/b6nKUyufJ9lC0bAlIK3BDKP5y11BYNc15ctFKVxR5Dl92swJaoy6k4hAt
zwOOCSbjUbT7xQ639pHqQMzbNFQg/rDTwNhCeEo3MK7SjHSrjv7Q6rVM7ektBKK7
bUIeNMpHpmyWOzgp9lJ2NnoqrPqZ78qZtMZR1BxvVRBHCBjtz5MawvydGP6RTMj5
rJh1HYawHdPvIU2Dn/XzcvHIVjKkg0w8BMibC61Jb+A3U5I+q6rX+50xIJA5Jlec
3nQEg/3MO1A=
=IeDo
-----END PGP SIGNATURE-----