A flaw was found in all Openshift Enterprise versions using the openshift elasticsearch plugin. An attacker with knowledge of the given name used to authenticate and access Elasticsearch can later access it without the token, bypassing authentication. This attack also requires that the Elasticsearch be configured with an external route, and the data accessed is limited to the indices.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat Openshift | — | Upgrade openshift-elasticsearch-pluginUpgrade nodejs-brace-expansionUpgrade rubygem-http-cookieUpgrade nodejs-pauseUpgrade nodejs-path-to-regexpUpgrade nodejs-concat-streamUpgrade nodejs-gruntUpgrade jenkins-plugin-pipeline-input-stepUpgrade ansibleUpgrade python-rsaUpgrade nodejs-client-sessionsUpgrade nodejs-map-objUpgrade nodejs-parse-durationUpgrade nodejs-unc-path-regexUpgrade jenkins-plugin-blueocean-jwtUpgrade nodejs-ctypeUpgrade rubygem-netrcUpgrade jenkins-plugin-workflow-basic-stepsUpgrade rubygem-syslog_protocolUpgrade nodejs-argparseUpgrade openshift-eventrouterUpgrade rubygem-elasticsearch-transportUpgrade jenkins-plugin-multiple-scmsUpgrade nodejs-image-sizeUpgrade nodejs-finalhandlerUpgrade nodejs-freshUpgrade nodejs-combined-streamUpgrade nodejs-node-uuidUpgrade rubygem-lru_reduxUpgrade rubygem-docker-apiUpgrade nodejs-is-bufferUpgrade nodejs-methodsUpgrade nodejs-form-dataUpgrade nodejs-grunt-cliUpgrade nodejs-stringstreamUpgrade nodejs-has-flagUpgrade jenkins-plugin-ssh-credentialsUpgrade ansible-asb-modulesUpgrade elastic-curatorUpgrade jenkins-plugin-workflow-multibranchUpgrade apb-base-scriptsUpgrade nodejs-varyUpgrade rubygem-rest-clientUpgrade python-elasticsearchUpgrade nodejs-aws-sign2Upgrade nodejs-indent-stringUpgrade jenkins-plugin-cloudbees-folderUpgrade nodejs-merge-descriptorsUpgrade mediawiki-container-scriptsUpgrade nodejs-prrUpgrade nodejs-type-isUpgrade nodejs-serve-staticUpgrade rubygem-mime-types-dataUpgrade nodejs-mime-dbUpgrade nodejs-caselessUpgrade nodejs-lessUpgrade jenkins-plugin-blueocean-webUpgrade rubygem-fluent-plugin-docker_metadata_filterUpgrade cri-oUpgrade rubygem-uuidtoolsUpgrade nodejs-graceful-fsUpgrade rubygem-yajl-rubyUpgrade python-pyUpgrade elasticsearch-cloud-kubernetesUpgrade rubygem-http_parser.rbUpgrade rubygem-domain_nameUpgrade python-dockerUpgrade nodejs-cookie-signatureUpgrade rubygem-resolve-hostnameUpgrade nodejs-cliuiUpgrade rubygem-multipart-postUpgrade nodejs-abbrevUpgrade jenkins-plugin-pipeline-model-definitionUpgrade nodejs-on-finishedUpgrade jenkins-plugin-pipeline-model-extensionsUpgrade nodejs-morganUpgrade nodejs-typedarrayUpgrade jenkins-plugin-token-macroUpgrade nodejs-lodashUpgrade nodejs-assert-plusUpgrade nodejs-process-nextick-argsUpgrade nodejs-onceUpgrade nodejs-colorsUpgrade nodejs-commanderUpgrade nodejs-core-util-isUpgrade nodejs-findup-syncUpgrade jenkins-plugin-blueocean-display-urlUpgrade nodejs-extendUpgrade jenkins-plugin-blueocean-restUpgrade nodejs-globUpgrade jenkins-plugin-blueocean-commonsUpgrade rubygem-fluent-plugin-secure-forwardUpgrade nodejs-tough-cookieUpgrade nodejs-y18nUpgrade rubygem-httpUpgrade jenkins-plugin-sse-gatewayUpgrade jenkins-plugin-mapdb-apiUpgrade jenkins-plugin-gitUpgrade golang-github-prometheus-prometheusUpgrade jenkins-plugin-workflow-apiUpgrade nodejs-http-proxyUpgrade nodejs-escape-htmlUpgrade nodejs-bytesUpgrade nodejs-passportUpgrade jenkins-plugin-matrix-authUpgrade jenkins-plugin-blueocean-personalizationUpgrade python-kubernetesUpgrade nodejs-delayed-streamUpgrade nodejs-eventemitter3Upgrade nodejs-camelcase-keysUpgrade nodejs-source-mapUpgrade nodejs-qsUpgrade nodejs-json-stringify-safeUpgrade nodejs-unpipeUpgrade ansible-service-brokerUpgrade rubygem-activesupportUpgrade nodejs-forever-agentUpgrade python-string_utilsUpgrade jenkins-plugin-kubernetesUpgrade rubygem-unfUpgrade jenkins-plugin-jackson2-apiUpgrade python-cachetoolsUpgrade jenkins-plugin-subversionUpgrade nodejs-hookerUpgrade jenkins-plugin-workflow-step-apiUpgrade jenkins-plugin-junitUpgrade rubygem-systemd-journalUpgrade atomic-openshift-node-problem-detectorUpgrade nodejs-is-propertyUpgrade fluentdUpgrade nodejs-cookiesUpgrade rubygem-exconUpgrade nodejs-xtendUpgrade nodejs-grunt-contrib-lessUpgrade nodejs-requires-portUpgrade rubygem-elasticsearchUpgrade nodejs-asyncUpgrade jenkins-plugin-blueocean-i18nUpgrade nodejs-ansi-regexUpgrade nodejs-tunnel-agentUpgrade jenkins-plugin-openshift-pipelineUpgrade mediawiki123Upgrade nodejs-ipaddr.jsUpgrade python-botoUpgrade rubygem-tzinfoUpgrade jenkins-plugin-blueocean-eventsUpgrade jenkins-plugin-pipeline-model-apiUpgrade nodejsUpgrade rubygem-addressableUpgrade atomic-openshift-deschedulerUpgrade nodejs-generate-object-propertyUpgrade nodejs-negotiatorUpgrade rubygem-fluent-plugin-viaq_data_modelUpgrade jenkins-plugin-favoriteUpgrade jenkins-plugin-openshift-clientUpgrade nodejs-ee-firstUpgrade rubygem-tzinfo-dataUpgrade nodejs-jsonpointerUpgrade jenkins-plugin-openshift-syncUpgrade jenkins-plugin-pipeline-model-declarative-agentUpgrade nodejs-grunt-contrib-copyUpgrade hawkular-openshift-agentUpgrade jenkins-plugin-credentialsUpgrade jenkins-plugin-durable-taskUpgrade python-cryptoUpgrade nodejs-camelcaseUpgrade thriftUpgrade jenkins-plugin-workflow-supportUpgrade nodejs-strip-ansiUpgrade jenkins-plugin-script-securityUpgrade nodejs-amdefineUpgrade sshpassUpgrade perl-IO-StringUpgrade rubygem-fluent-plugin-flatten-hashUpgrade python-paramikoUpgrade nodejs-is-unc-pathUpgrade elasticsearchUpgrade nodejs-kind-ofUpgrade nodejs-array-flattenUpgrade nodejs-passport-strategyUpgrade nodejs-minimatchUpgrade jenkins-plugin-blueocean-rest-implUpgrade jenkins-plugin-handlebarsUpgrade rubygem-thread_safeUpgrade nodejs-inheritsUpgrade jenkins-plugin-structsUpgrade jenkins-plugin-openshift-loginUpgrade jenkins-plugin-pipeline-stage-tags-metadataUpgrade nodejs-sendUpgrade python-httplib2Upgrade rubygem-string-scrubUpgrade image-inspectorUpgrade nodejs-pseudomapUpgrade jenkins-plugin-matrix-projectUpgrade nodejs-mkdirpUpgrade nodejs-grunt-legacy-utilUpgrade nodejs-window-sizeUpgrade nodejs-readable-streamUpgrade rubygem-http-form_dataUpgrade jenkins-plugin-blueocean-github-pipelineUpgrade nodejs-errnoUpgrade python-crontabUpgrade nodejs-path-is-absoluteUpgrade nodejs-underscore-dot-stringUpgrade jenkins-plugin-pubsub-lightUpgrade nodejs-mimeUpgrade jenkins-plugin-pipeline-utility-stepsUpgrade rubygem-unf_extUpgrade nodejs-util-deprecateUpgrade nodejs-escape-string-regexpUpgrade python-typingUpgrade nodejs-destroyUpgrade rubygem-fluent-plugin-elasticsearchUpgrade nodejs-on-headersUpgrade jenkins-plugin-blueocean-git-pipelineUpgrade nodejs-ansi-stylesUpgrade jenkins-plugin-docker-commonsUpgrade nodejs-iconv-liteUpgrade nodejs-acceptsUpgrade jenkins-plugin-pipeline-milestone-stepUpgrade nodejs-http-errorsUpgrade nodejs-wrappyUpgrade jenkins-plugin-branch-apiUpgrade nodejs-etagUpgrade rubygem-minitestUpgrade nodejs-has-ansiUpgrade nodejs-minimistUpgrade python-openshiftUpgrade jenkins-plugin-ace-editorUpgrade nodejs-sprintf-jsUpgrade python-urllib3Upgrade jenkins-plugin-workflow-cps-global-libUpgrade kibanaUpgrade jenkins-plugin-mercurialUpgrade nodejs-yallistUpgrade mysql-apb-roleUpgrade golang-github-prometheus-node_exporterUpgrade nodejs-dateformatUpgrade rubygem-multi_jsonUpgrade jenkins-plugin-credentials-bindingUpgrade rubygem-fluent-plugin-kubernetes_metadata_filterUpgrade nodejs-string_decoderUpgrade nodejs-http-signatureUpgrade nodejs-forwardedUpgrade nodejs-har-validatorUpgrade nodejs-grunt-legacy-log-utilsUpgrade nodejs-eventemitter2Upgrade nodejs-is-my-json-validUpgrade jenkins-plugin-scm-apiUpgrade nodejs-coffee-scriptUpgrade jenkins-plugin-blueoceanUpgrade rubygem-proxifierUpgrade nodejs-range-parserUpgrade nodejs-cookieUpgrade nodejs-is-absoluteUpgrade jenkins-plugin-blueocean-autofavoriteUpgrade nodejs-raw-bodyUpgrade rubygem-elasticsearch-apiUpgrade nodejs-passport-http-bearerUpgrade nodejs-whichUpgrade nodejs-lru-cacheUpgrade http-parserUpgrade python-ruamel-yamlUpgrade nodejs-isarrayUpgrade jenkins-plugin-git-clientUpgrade rubygem-recursive-open-structUpgrade nodejs-wordwrapUpgrade python-dictdifferUpgrade nodejs-asapUpgrade python-pysocksUpgrade python-clickUpgrade nodejs-decamelizeUpgrade cockpitUpgrade rubygem-sigdumpUpgrade jenkins-plugin-blueocean-pipeline-editorUpgrade nodejs-inflightUpgrade nodejs-is-relativeUpgrade jenkins-plugin-pipeline-rest-apiUpgrade nodejs-media-typerUpgrade python-ruamel-ordereddictUpgrade jenkins-plugin-pipeline-build-stepUpgrade dumb-initUpgrade jenkins-plugin-workflow-cpsUpgrade jenkins-plugin-icon-shimUpgrade libuvUpgrade nodejs-repeatingUpgrade nodejs-right-alignUpgrade jenkins-plugin-github-apiUpgrade rubygem-mime-typesUpgrade nodejs-openshift-auth-proxyUpgrade nodejs-mime-typesUpgrade nodejs-js-yamlUpgrade python-certifiUpgrade nodejs-hoekUpgrade rubygem-ffiUpgrade nodejs-base64urlUpgrade nodejs-packagingUpgrade nodejs-parseurlUpgrade nodejs-msUpgrade openshift-external-storageUpgrade mariadb-apb-roleUpgrade nodejs-noptUpgrade rubygem-fluent-plugin-rewrite-tag-filterUpgrade nodejs-passport-oauth2Upgrade jenkins-plugin-github-branch-sourceUpgrade golang-github-openshift-prometheus-alert-bufferUpgrade jenkins-plugin-git-serverUpgrade nodejs-content-dispositionUpgrade nodejs-resolveUpgrade nodejs-center-alignUpgrade rubygem-msgpackUpgrade jenkins-plugin-blueocean-configUpgrade nodejs-file-sync-cmpUpgrade nodejs-align-textUpgrade nodejs-has-colorUpgrade jenkins-plugin-githubUpgrade nodejs-expressUpgrade apbUpgrade golang-github-prometheus-alertmanagerUpgrade heapsterUpgrade jenkins-plugin-pipeline-graph-analysisUpgrade nodejs-uid2Upgrade nodejs-os-localeUpgrade golang-github-openshift-oauth-proxyUpgrade golang-github-prometheus-promuUpgrade jenkins-plugin-authentication-tokensUpgrade nodejs-asn1Upgrade nodejs-hawkUpgrade nodejs-meowUpgrade jenkins-plugin-blueocean-dashboardUpgrade nodejs-depdUpgrade jenkins-plugin-workflow-durable-task-stepUpgrade nodejs-graceful-readlinkUpgrade ansible-kubernetes-modulesUpgrade nodejs-url-joinUpgrade nodejs-cryptilesUpgrade jenkins-plugin-display-url-apiUpgrade rubygem-fluent-plugin-record-modifierUpgrade nodejs-proxy-addrUpgrade nodejs-grunt-legacy-logUpgrade nodejs-statusesUpgrade nodejs-is-windowsUpgrade jenkins-plugin-variantUpgrade jenkins-plugin-blueocean-pipeline-api-implUpgrade nodejs-bluebirdUpgrade jenkins-2-pluginsUpgrade nodejs-boomUpgrade nodejs-oauthUpgrade nodejs-debugUpgrade mediawiki-apb-roleUpgrade nodejs-esprimaUpgrade nodejs-number-is-nanUpgrade nodejs-balanced-matchUpgrade openshift-ansibleUpgrade nodejs-content-typeUpgrade nodejs-yargsUpgrade nodejs-generate-functionUpgrade nodejs-keygripUpgrade nodejs-concat-mapUpgrade jenkins-plugin-workflow-remote-loaderUpgrade nodejs-promiseUpgrade rubygem-fluent-plugin-systemdUpgrade jenkins-plugin-docker-workflowUpgrade nodejs-basic-authUpgrade python-google-authUpgrade nodejs-is-finiteUpgrade rubygem-faradayUpgrade jenkins-plugin-workflow-aggregatorUpgrade jenkins-plugin-metricsUpgrade nodejs-blUpgrade nodejs-repeat-stringUpgrade atomic-openshiftUpgrade python-mockUpgrade jenkins-plugin-jquery-detachedUpgrade postgresql-apb-roleUpgrade rubygem-fluent-mixin-config-placeholdersUpgrade jenkins-plugin-workflow-scm-stepUpgrade nodejs-exitUpgrade rubygem-fluent-plugin-remote-syslogUpgrade nodejs-lcidUpgrade rubygem-i18nUpgrade jenkinsUpgrade nodejs-object-assignUpgrade containernetworking-pluginsUpgrade nodejs-invert-kvUpgrade nodejs-getobjectUpgrade nodejs-chalkUpgrade jenkins-plugin-pipeline-stage-viewUpgrade nodejs-body-parserUpgrade jenkins-plugin-mailerUpgrade nodejs-requestUpgrade rubygem-kubeclientUpgrade rubygem-cool.ioUpgrade nodejs-utils-mergeUpgrade nodejs-longestUpgrade nodejs-rimrafUpgrade jenkins-plugin-workflow-jobUpgrade jenkins-plugin-momentjsUpgrade jenkins-plugin-plain-credentialsUpgrade jenkins-plugin-pipeline-stage-stepUpgrade nodejs-grunt-contrib-cleanUpgrade python-passlibUpgrade nodejs-isstreamUpgrade nodejs-patternflyUpgrade nodejs-sntpUpgrade nodejs-supports-colorUpgrade nodejs-oauth-sign | Jun 18, 2018 | Nov 28, 2017 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub