Sigurnosni nedostaci programskog paketa RHEL7 Container

Preporuke

by - 17. prosinca 2019.0

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Important: Red Hat Ansible Tower 3.6.2-1 – RHEL7 Container
Advisory ID: RHSA-2019:4243-01
Product: Red Hat Ansible Tower
Advisory URL: https://access.redhat.com/errata/RHSA-2019:4243
Issue date: 2019-12-16
CVE Names: CVE-2019-19340 CVE-2019-19341 CVE-2019-19342
=====================================================================

1. Summary:

Red Hat Ansible Tower 3.6.2-1 – RHEL7 Container

2. Description:

* Added a command to generate a new SECRET_KEY and rekey the database
* Removed the guest user from the optionally-configured RabbitMQ admin
interface (CVE-2019-19340)
* Fixed slow queries for /api/v2/instances and /api/v2/instance_groups when
smart inventories are used
* Fixed assorted issues with preserving permissions in the Ansible Tower
backup playbook (CVE-2019-19341)
* Fixed a partial password disclosure when special characters existed in
the RabbitMQ password (CVE-2019-19342)
* Fixed hang in error handling for source control checkouts
* Fixed an error on subsequent job runs that override the branch of a
project on an instance that did not have a prior project checkout
* Fixed an issue where supervisord would not shut down correctly
* Fixed an issue where jobs launched in isolated or container groups would
incorrectly timeout
* Fixed link to instance groups documentation in the user interface
* Fixed retrieval of Red Hat subscription data when running in OpenShift
* Fixed editing of inventory on Workflow templates
* Fixed multiple issues with OAuth2 token cleanup system jobs
* Fixed custom email notifications for workflow approve and deny
* Updated SAML implementation to automatically log if authorization exists
* Updated AngularJS to 1.7.9 for CVE-2019-10768
* Updated installer to not install PostgreSQL server on all nodes
* Updated bundled installer to contain both Red Hat Enterprise Linux 7 and
8 builds

3. Solution:

For information on upgrading Ansible Tower, reference the Ansible Tower
Upgrade and Migration Guide:
https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/
index.html

4. Bugs fixed (https://bugzilla.redhat.com/):

1782623 – CVE-2019-19342 Tower: special characters in RabbitMQ passwords causes web socket 500 error
1782624 – CVE-2019-19340 Tower: enabling RabbitMQ manager in the installer exposes the management interface publicly
1782625 – CVE-2019-19341 Tower: intermediate files during Tower backup are world-readable

5. References:

https://access.redhat.com/security/cve/CVE-2019-19340
https://access.redhat.com/security/cve/CVE-2019-19341
https://access.redhat.com/security/cve/CVE-2019-19342
https://access.redhat.com/security/updates/classification/#important

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

iQIVAwUBXffO0tzjgjWX9erEAQjwLQ/+NfHPbunRnDxqjxWlFYKgzkge6P7m215j
E5pVV/jPas2RVjCwjTK/VHnRscJDbLEaSAkGVzW3lbqyf7xxC+WTFq8Ga8D/zS9n
XSVU7Azv6CcmBchMQu2Y+QTkdVQcWpcvhOTqZ+P4zKTb24xfL8YpQtMRvJFZgE1h
u57G29WVl0WaseQYhSqgVDcODmBmLEpYZmzoJ/aDGJQ+6hIpSs+NIcE7Au2U+qGv
5r0Yd+jg6Dz6hcQe2Y4ed7ARUPrjseHK+wKO6ZcfbjhsvpCKr3NNqDn80Pe8v+3+
uj7SDHQlFGMH1nUjakawUxRpVmug30xB8/GqeKJmpLMmLNzBhw0xkeeVWbVkNNr1
ikCHI/dWIppZ3YbvtVyLEZWPMBXvrkyGkelMQKRzLYL9eReiMs/KwJFVbmKllLsz
7XN0kqgl8IWTYNppaJP93awRs0/7AYTGsdE3l53jRurGo1ab5gHYQonctKlGFZCf
X2gxnHUWACDZHkLcZ1L7tidTGfGse+0K7UM5w999Pfv8drMOTih4CAkW8g58FKb2
3WobokIqsl8YOPxrGu+K5iHf/swtXns/8oLXh768BS+PGR7gf1sfTa5XlhCi4FLf
0SNwoMbqo7DQPwqmLxXbsH5GOFOFbjTvV5Nz0blyJaxtslHgNuCKj9wNiWdXDLTT
7lp2D94ffiM=
=PZJz
—–END PGP SIGNATURE—–

—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Important: Red Hat Ansible Tower 3.5.4-1 – RHEL7 Container
Advisory ID: RHSA-2019:4242-01
Product: Red Hat Ansible Tower
Advisory URL: https://access.redhat.com/errata/RHSA-2019:4242
Issue date: 2019-12-16
CVE Names: CVE-2019-14864 CVE-2019-19340 CVE-2019-19341
CVE-2019-19342
=====================================================================

1. Summary:

Red Hat Ansible Tower 3.5.4-1 – RHEL7 Container

2. Description:

* Added a command to generate a new SECRET_KEY and rekey the database
* Removed the guest user from the optionally-configured RabbitMQ admin
interface (CVE-2019-19340)
* Fixed assorted issues with preserving permissions in the Ansible Tower
backup playbook (CVE-2019-19341)
* Fixed a partial password disclosure when special characters existed in
the RabbitMQ password (CVE-2019-19342)
* Fixed a file descriptor leak in the Tower service during project updates
* Fixed an issue where AUTHORIZATION_CODE_EXPIRE_SECONDS and
ACCESS_TOKEN_EXPIRE_SECONDS were not properly honored
* Fixed an issue where some timezones in schedules could not be parsed
* Fixed isolated execution of playbooks with blanks in the filename
* Fixed saving of workflow extra_vars
* Updated Ansible Tower to disallow Jinja in inventory hostnames
* Updated analytics data collection to match Ansible Tower 3.6
* Updated bundled oVirt SDK to version 4.3.0

3. Solution:

For information on upgrading Ansible Tower, reference the Ansible Tower
Upgrade and Migration Guide:
https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/
index.html

4. Bugs fixed (https://bugzilla.redhat.com/):

5. References:

https://access.redhat.com/security/cve/CVE-2019-14864
https://access.redhat.com/security/cve/CVE-2019-19340
https://access.redhat.com/security/cve/CVE-2019-19341
https://access.redhat.com/security/cve/CVE-2019-19342
https://access.redhat.com/security/updates/classification/#important

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

iQIVAwUBXffOX9zjgjWX9erEAQhvew//VfJgHom06V9Aut5W0CRjEM7ZTV5iaFI/
UFs5HTVthpMvRCwa+98ZJ8jq71Rwzc7QkKL+1g3YMCvMymKTJPMUSx2yHL7toIaR
nk++xVNDzBjtq7dVBiPKyCoEi74UIa8/Zuj36hRaFxwiwsysj1TpLf/B81cUuupx
Lmo32wCDNCq0tYlqxt6ytS9rBn8UmafxvuKWMIZaWpB787/kpVNnYNrn+/Cv9Bfn
DA4Xy3U9AVeNAesbVkWgC/wpPi9aqNbyrrodVpJWTAZ1spkwdTk9XtusGRpLx51Q
InWD53RufFb4Xdd5+kZZBh1Bszw3h6XTknFKX9vWVp0aw725CgVsEoYnV9Fn0zHr
JkuCBwgr+CQgJQV3C6D4N+QYlMVuZlfW0fWgpaGgMuGVg4akl/DGmbmB+Jy9GJ/2
cr1NUDiR1TdaQa0pVnbx72Pr2OZiBi1r8aUm/jeUBC64b9NtAsLQUZSeFuCU4UwX
+7auNV+pCWwrknYWIJ+VAIhwWGO5vYVvRU9XbwG4JQ3g2HISoRXHvy1x1jk4eGkX
Xh5wAQtXKI28lSJill8TQjGX6TjsH1mLnGpzGTjl2tIZIasMviEWJzvuUcnhymiO
+sBzL1eAAExmINTJfJW1qeT9NbcD11wkY5JKXPbMhd8Gq9QPl4BndFkuJibVaMpo
thZ59eIYjCI=
=0zy5
—–END PGP SIGNATURE—–

—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

Sigurnosni nedostaci programskog paketa RHEL7 Container

Archives

More in Preporuke

Sigurnosni nedostatak programskog paketa openshift-enterprise-console-container