Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2018.2298 Moderate: Red Hat OpenShift Application Runtimes security and bug fix update 10 August 2018 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Red Hat OpenShift Application Runtimes Publisher: Red Hat Operating System: Red Hat Impact/Access: Provide Misleading Information -- Remote/Unauthenticated Resolution: Patch/Upgrade CVE Names: CVE-2018-12540 CVE-2018-12537 Original Bulletin: https://access.redhat.com/errata/RHSA-2018:2371 - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat OpenShift Application Runtimes security and bug fix update Advisory ID: RHSA-2018:2371-01 Product: Red Hat OpenShift Application Runtimes Advisory URL: https://access.redhat.com/errata/RHSA-2018:2371 Issue date: 2018-08-09 CVE Names: CVE-2018-12537 CVE-2018-12540 ===================================================================== 1. Summary: An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat Openshift Application Runtimes provides an application platform that reduces the complexity of developing and operating applications (monoliths and microservices) for OpenShift as a containerized platform. The RHOAR Eclipse Vert.x 3.5.3 release serves as a replacement for RHOAR Eclipse Vert.x 3.5.1, and includes bug fixes and enhancements. For a detailed list of issues resolved in the community Eclipse Vert.x 3.5.3 release, see the release notes in the References section. Security Fix(es): * vertx: Improper neutralization of CRLF sequences allows remote attackers to inject arbitrary HTTP response headers (CVE-2018-12537) * vertx-web: Incomplete CSRF validation by CSRFHandler (CVE-2018-12540) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). 4. Bugs fixed (https://bugzilla.redhat.com/): 1591072 - CVE-2018-12537 vertx: Improper neutralization of CRLF sequences allows remote attackers to inject arbitrary HTTP response headers 1600666 - CVE-2018-12540 vertx-web: Incomplete CSRF validation by CSRFHandler 5. References: https://access.redhat.com/security/cve/CVE-2018-12537 https://access.redhat.com/security/cve/CVE-2018-12540 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=catRhoar.eclipse.vertx&version=3.5.3 https://access.redhat.com/documentation/en-us/red_hat_openshift_application_runtimes/1/html-single/red_hat_openshift_application_runtimes_release_notes/ 6. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2018 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBW2xSSdzjgjWX9erEAQh6Vw//ULAGJNKQS+MwW96t4pUTLDR+O+RzbWPD AJ4kZFLT6b7chyk2+pV+r3YVlu4pDicIpZ60PE+ON4aFCT4TI2Kao1Tu7eMGZoqk iwdCFdvCXv3ysXr5VUHYHkwdKwvKM8Mn/DmEy0Zi77nSazxt09mnTJcMWwn38vs7 cbI7BMEQpJFXpJwC+8hjZCk33A1y+Tv2QJce71feV2WTH9avXVWtA233AVCUaYxi ul/7vJWss/OF735ExjhEFcsuHgQfBBCD0Md4zJaNKGMrUM/oMYnVpsyNlSHFQvLr 8X0BrcAHgdEJPmF2u2zTaRQEkZcde7QQ5sWie5yW9BDtMMV+3QEz5PEtL0HvHhxD /iJyYh7kW1X2i6YG3I4OWB2JcET7CBhF2I2WCe1b4FvFcDq44ADCOycSLcR7/4km r2joW4TjiwwTRnQusXk42vyz69LAZn9zRY7NQjZUxujMT5X/7Jzz2FeIMJ/cXXTM ua3FJDB1zhYDiwPW0kzyOGXO7YziYpnmZszOCiKo92dfSS0gtGOe6IUrTz8AG8Ux 06Nl+5DRH3vdKbzsgxldlmxWdOWwp6YSa8FbJzEdtPUQxhSVj2JkDXnrfa7kSJlW g/rSM8DvVIgsREj1adF31kxHF6+9YaBvqih7b65d1fBoeVMQtwJenHjWkxnucH8j 36BwUEcSHk0= =p3aY - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBW2zX02aOgq3Tt24GAQh9oxAAj65s9WnWKmMOOeo50tc2bs31hkt2+a2H zDlY2kCeGtbpD+yMLC4Q4LPF1olAYsfusm0dj4jfDS0kM5ht0hwo/o+GGeBvoeUc S6PJgihK74vZkAHdYtw5BeQdKWAPT7Y9adOYBAiiD1lfn0DAJDq3XEyiI5qJUZ7a DH9tJSTp9XdpkD6kiayb6U2dxVX8J03M7iX443Xf7nkzZiMKkOOWAqv4/Z0auriw e01NvO3WBvAXo3gE4fOkN8tGVVRqB5zC1BsS/iPuyPUa8QeXuUrXi40uZ4VsSktL GCk+h6k6lm+dKslo1YS09IreMWcOwKDquifo3DW1gaRvokXVaW2IXgVKnOO3oqod 7JfJOTdonfahdkHxa70u262td4SbeA1Y+vVZk5M5srimEruDgyvRptCd8B/G8oVS R3hutQSJI4ATa/P4nn8n4ycrNOnJuYbrK2L83lTnSPvygvw5cWXFxGceDpavUk2I 7IZ3ea13FJUrjJske7mVcipcufhtBIJRs7OKFADVuAe3y3xpV28fOtCN3G5Sgglp Os9a6hu0Z4bx0nCwZqK0NyCEDZdnOyNr7c7+oQ0o7yuI34tzPRnPH4OxU4dcV1ZR KzLP2B5MMerjHXEvl/TasfISoTgGTZny06xXlOdvP/UZC5l9TAcW10autCbvDhT3 cT23c0MpFi8= =73e/ -----END PGP SIGNATURE-----