Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2018.1326 Moderate: Red Hat Mobile Application Platform 4.6.0 release - RPMs 1 May 2018 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Red Hat Mobile Application Platform Publisher: Red Hat Operating System: Red Hat Virtualisation Impact/Access: Denial of Service -- Remote/Unauthenticated Reduced Security -- Existing Account Resolution: Patch/Upgrade CVE Names: CVE-2018-3728 CVE-2017-15010 Original Bulletin: https://access.redhat.com/errata/RHSA-2018:1263 - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat Mobile Application Platform 4.6.0 release - RPMs Advisory ID: RHSA-2018:1263-01 Product: Red Hat Mobile Application Platform Advisory URL: https://access.redhat.com/errata/RHSA-2018:1263 Issue date: 2018-04-30 CVE Names: CVE-2017-15010 CVE-2018-3728 ===================================================================== 1. Summary: Red Hat Mobile Application Platform 4.6.0 release - RPMs 2. Relevant releases/architectures: Red Hat Mobile Application Platform 4.6 - noarch, x86_64 3. Description: Red Hat Mobile Application Platform (RHMAP) 4.6 is delivered as a set of container images. In addition to the images, several components are delivered as RPMs: * OpenShift templates used to deploy an RHMAP Core and MBaaS * The fh-system-dump-tool allows you to analyze all the projects running in an OpenShift cluster and reports any problems discovered. For more information, see the Operations Guide. The following RPMs are included in the RHMAP container images, and are provided here only for completeness: * The Nagios server, which is used to monitor the status of RHMAP components, is installed inside the Nagios container image. This release serves as an update for Red Hat Mobile Application Platform 4.5.6. It includes bug fixes and enhancements. Refer to the Red Hat Mobile Application Platform 4.6.0 Release Notes for information about the most significant bug fixes and enhancements included in this release. Nagios is a program that monitors hosts and services on your network, and has the ability to send email or page alerts when a problem arises or is resolved. Security Fix(es): * nodejs-tough-cookie: Regular expression denial of service (CVE-2017-15010) * hoek: Prototype pollution in utilities function (CVE-2018-3728) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1493989 - CVE-2017-15010 nodejs-tough-cookie: Regular expression denial of service 1545893 - CVE-2018-3728 hoek: Prototype pollution in utilities function 6. JIRA issues fixed (https://issues.jboss.org/): RHMAP-19902 - Create productized release of RHMAP 4.6 for use by both self-managed and hosted offerings 7. Package List: Red Hat Mobile Application Platform 4.6: Source: fh-system-dump-tool-1.0.0-5.el7.src.rpm fping-3.10-4.el7map.src.rpm nagios-4.0.8-8.el7map.src.rpm nagios-plugins-2.0.3-3.el7map.src.rpm perl-Crypt-CBC-2.33-2.el7map.src.rpm perl-Crypt-DES-2.05-20.el7map.src.rpm perl-Net-SNMP-6.0.1-7.el7map.src.rpm phantomjs-1.9.7-3.el7map.src.rpm python-meld3-0.6.10-1.el7map.src.rpm qstat-2.11-13.20080912svn311.el7map.src.rpm radiusclient-ng-0.5.6-9.el7map.src.rpm redis-2.8.21-2.el7map.src.rpm rhmap-fh-openshift-templates-4.6.0-5.el7.src.rpm rhmap-mod_authnz_external-3.3.1-7.el7map.src.rpm sendEmail-1.56-2.el7.src.rpm ssmtp-2.64-14.el7map.src.rpm supervisor-3.1.3-3.el7map.src.rpm noarch: perl-Crypt-CBC-2.33-2.el7map.noarch.rpm perl-Net-SNMP-6.0.1-7.el7map.noarch.rpm rhmap-fh-openshift-templates-4.6.0-5.el7.noarch.rpm sendEmail-1.56-2.el7.noarch.rpm supervisor-3.1.3-3.el7map.noarch.rpm x86_64: fh-system-dump-tool-1.0.0-5.el7.x86_64.rpm fping-3.10-4.el7map.x86_64.rpm fping-debuginfo-3.10-4.el7map.x86_64.rpm nagios-4.0.8-8.el7map.x86_64.rpm nagios-common-4.0.8-8.el7map.x86_64.rpm nagios-debuginfo-4.0.8-8.el7map.x86_64.rpm nagios-devel-4.0.8-8.el7map.x86_64.rpm nagios-plugins-2.0.3-3.el7map.x86_64.rpm nagios-plugins-all-2.0.3-3.el7map.x86_64.rpm nagios-plugins-apt-2.0.3-3.el7map.x86_64.rpm nagios-plugins-breeze-2.0.3-3.el7map.x86_64.rpm nagios-plugins-by_ssh-2.0.3-3.el7map.x86_64.rpm nagios-plugins-cluster-2.0.3-3.el7map.x86_64.rpm nagios-plugins-dbi-2.0.3-3.el7map.x86_64.rpm nagios-plugins-debuginfo-2.0.3-3.el7map.x86_64.rpm nagios-plugins-dhcp-2.0.3-3.el7map.x86_64.rpm nagios-plugins-dig-2.0.3-3.el7map.x86_64.rpm nagios-plugins-disk-2.0.3-3.el7map.x86_64.rpm nagios-plugins-disk_smb-2.0.3-3.el7map.x86_64.rpm nagios-plugins-dns-2.0.3-3.el7map.x86_64.rpm nagios-plugins-dummy-2.0.3-3.el7map.x86_64.rpm nagios-plugins-file_age-2.0.3-3.el7map.x86_64.rpm nagios-plugins-flexlm-2.0.3-3.el7map.x86_64.rpm nagios-plugins-fping-2.0.3-3.el7map.x86_64.rpm nagios-plugins-game-2.0.3-3.el7map.x86_64.rpm nagios-plugins-hpjd-2.0.3-3.el7map.x86_64.rpm nagios-plugins-http-2.0.3-3.el7map.x86_64.rpm nagios-plugins-icmp-2.0.3-3.el7map.x86_64.rpm nagios-plugins-ide_smart-2.0.3-3.el7map.x86_64.rpm nagios-plugins-ifoperstatus-2.0.3-3.el7map.x86_64.rpm nagios-plugins-ifstatus-2.0.3-3.el7map.x86_64.rpm nagios-plugins-ircd-2.0.3-3.el7map.x86_64.rpm nagios-plugins-ldap-2.0.3-3.el7map.x86_64.rpm nagios-plugins-load-2.0.3-3.el7map.x86_64.rpm nagios-plugins-log-2.0.3-3.el7map.x86_64.rpm nagios-plugins-mailq-2.0.3-3.el7map.x86_64.rpm nagios-plugins-mrtg-2.0.3-3.el7map.x86_64.rpm nagios-plugins-mrtgtraf-2.0.3-3.el7map.x86_64.rpm nagios-plugins-mysql-2.0.3-3.el7map.x86_64.rpm nagios-plugins-nagios-2.0.3-3.el7map.x86_64.rpm nagios-plugins-nt-2.0.3-3.el7map.x86_64.rpm nagios-plugins-ntp-2.0.3-3.el7map.x86_64.rpm nagios-plugins-ntp-perl-2.0.3-3.el7map.x86_64.rpm nagios-plugins-nwstat-2.0.3-3.el7map.x86_64.rpm nagios-plugins-oracle-2.0.3-3.el7map.x86_64.rpm nagios-plugins-overcr-2.0.3-3.el7map.x86_64.rpm nagios-plugins-perl-2.0.3-3.el7map.x86_64.rpm nagios-plugins-pgsql-2.0.3-3.el7map.x86_64.rpm nagios-plugins-ping-2.0.3-3.el7map.x86_64.rpm nagios-plugins-procs-2.0.3-3.el7map.x86_64.rpm nagios-plugins-radius-2.0.3-3.el7map.x86_64.rpm nagios-plugins-real-2.0.3-3.el7map.x86_64.rpm nagios-plugins-rpc-2.0.3-3.el7map.x86_64.rpm nagios-plugins-sensors-2.0.3-3.el7map.x86_64.rpm nagios-plugins-smtp-2.0.3-3.el7map.x86_64.rpm nagios-plugins-snmp-2.0.3-3.el7map.x86_64.rpm nagios-plugins-ssh-2.0.3-3.el7map.x86_64.rpm nagios-plugins-swap-2.0.3-3.el7map.x86_64.rpm nagios-plugins-tcp-2.0.3-3.el7map.x86_64.rpm nagios-plugins-time-2.0.3-3.el7map.x86_64.rpm nagios-plugins-ups-2.0.3-3.el7map.x86_64.rpm nagios-plugins-uptime-2.0.3-3.el7map.x86_64.rpm nagios-plugins-users-2.0.3-3.el7map.x86_64.rpm nagios-plugins-wave-2.0.3-3.el7map.x86_64.rpm perl-Crypt-DES-2.05-20.el7map.x86_64.rpm perl-Crypt-DES-debuginfo-2.05-20.el7map.x86_64.rpm phantomjs-1.9.7-3.el7map.x86_64.rpm phantomjs-debuginfo-1.9.7-3.el7map.x86_64.rpm python-meld3-0.6.10-1.el7map.x86_64.rpm python-meld3-debuginfo-0.6.10-1.el7map.x86_64.rpm qstat-2.11-13.20080912svn311.el7map.x86_64.rpm qstat-debuginfo-2.11-13.20080912svn311.el7map.x86_64.rpm radiusclient-ng-0.5.6-9.el7map.x86_64.rpm radiusclient-ng-debuginfo-0.5.6-9.el7map.x86_64.rpm radiusclient-ng-devel-0.5.6-9.el7map.x86_64.rpm radiusclient-ng-utils-0.5.6-9.el7map.x86_64.rpm redis-2.8.21-2.el7map.x86_64.rpm redis-debuginfo-2.8.21-2.el7map.x86_64.rpm rhmap-mod_authnz_external-3.3.1-7.el7map.x86_64.rpm rhmap-mod_authnz_external-debuginfo-3.3.1-7.el7map.x86_64.rpm ssmtp-2.64-14.el7map.x86_64.rpm ssmtp-debuginfo-2.64-14.el7map.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 8. References: https://access.redhat.com/security/cve/CVE-2017-15010 https://access.redhat.com/security/cve/CVE-2018-3728 https://access.redhat.com/security/updates/classification/#moderate 9. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2018 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFa52N+XlSAg2UNWIIRAqygAJ9noJhJ8e0rxjoKDSVQoRQK5j14JwCfVEhm AELsmyx/WkgIUnMZLdpdKjg= =0gN9 - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBWuf+n4x+lLeg9Ub1AQhXQQ//VkoXIjmds7wu2uybkkT5eDCcBI75NHVY yWDqFVgMB6HwuEKP/Znb0eTPEUVK+mfCDwyLDwlpe1wlDyc1FBwCk7rCIERqb/kG rX7246P7nzTxyAR3vxPc++w3z64BqHPk/eCb6CKK+preA/MoqchZ/RC4K9QiN1py WwZFDPRX6rHxHleOjNBc+I1RZ33cyVpLAQSbXdGtJRtXn9nn2mxj8erj9q3Rt6wY pxUUJSG8Y30fPMpqA7VFItnlFEmdwA2TnsbuMiCLGfgLAYbpFNrmCiNCa8adIvNo vsBfYe7YDYBniafwJOmLMfNQqx9YsSSN+zN0QIn+qqO9FBRvVifqw4d+LV5XkXsV Lk12Xx7zQgsS67dTXE7aDqP7Vq0Nzotv4IshBYAaOsGfh9AVJ6T2GnhF2d47VgXP TE4u2WkUSwkezZpvRLJ6/7tPdK6JICRa3rSfv+zzi7VabAYH3qERuVnW8zCBzDNy KXXAF/O95v1Gi4f7/ucp+5hfPrDgtIqkfwp8THFm+a0lkyLxW2qnNz8fmePLlWlW PHfaWwiQ/MmwLRI43dUeguoRtAqJwNVU+IEQ3CkqVs7Iw08aaWzkUEygLskBbUj7 NuD0seAnU6XbPBwcql0H1ctkTm5vJrQnmsf/dhqdeL54rfiODC5bjx7rzPwwAE3/ ybhUGuoquzc= =2HIN -----END PGP SIGNATURE-----