The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:1064 advisory.

    OpenShift Enterprise by Red Hat is the company's cloud computing Platform- as-a-Service (PaaS) solution     designed for on-premise or private cloud deployments.

    Security Fix(es):

    * A flaw was found in the building of containers within OpenShift Enterprise. An attacker could submit an     image for building that executes commands within the container as root, allowing them to potentially     escalate privileges. (CVE-2016-2160)

    * It was found that OpenShift Enterprise would disclose log file contents from reclaimed namespaces. An     attacker could create a new namespace to access log files present in a previously deleted namespace using     the same name. (CVE-2016-2149)

    * An information disclosure flaw was discovered in haproxy as used by OpenShift Enterprise; a cookie with     the name OPENSHIFT_[namespace]_SERVERID was set, which contained the internal IP address of a pod.
    (CVE-2016-3711)

    The CVE-2016-2149 issue was discovered by Wesley Hearn (Red Hat).

    Additional Changes:

    * Space precludes documenting all of the bug fixes and enhancements in this advisory. For details on all     new features, bug fixes, and known issues, see the OpenShift Enterprise 3.2 Release Notes linked to in the     References section.

    This update includes the following images:

    openshift3/ose:v3.2.0.20-3     openshift3/ose-deployer:v3.2.0.20-3     openshift3/ose-docker-builder:v3.2.0.20-3     openshift3/ose-docker-registry:v3.2.0.20-3     openshift3/ose-f5-router:v3.2.0.20-3     openshift3/ose-haproxy-router:v3.2.0.20-3     openshift3/ose-keepalived-ipfailover:v3.2.0.20-3     openshift3/ose-pod:v3.2.0.20-3     openshift3/ose-recycler:v3.2.0.20-3     openshift3/ose-sti-builder:v3.2.0.20-3     openshift3/image-inspector:1.0.0-12     openshift3/jenkins-1-rhel7:1.642-31     openshift3/logging-auth-proxy:3.2.0-3     openshift3/logging-deployment:3.2.0-8     openshift3/logging-elasticsearch:3.2.0-7     openshift3/logging-fluentd:3.2.0-6     openshift3/logging-kibana:3.2.0-3     openshift3/metrics-cassandra:3.2.0-4     openshift3/metrics-deployer:3.2.0-5     openshift3/metrics-hawkular-metrics:3.2.0-6     openshift3/metrics-heapster:3.2.0-5     openshift3/mongodb-24-rhel7:2.4-27     openshift3/mysql-55-rhel7:5.5-25     openshift3/nodejs-010-rhel7:0.10-34     openshift3/node:v3.2.0.20-3     openshift3/openvswitch:v3.2.0.20-4     openshift3/perl-516-rhel7:5.16-37     openshift3/php-55-rhel7:5.5-34     openshift3/postgresql-92-rhel7:9.2-24     openshift3/python-33-rhel7:3.3-34     openshift3/ruby-20-rhel7:2.0-34

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 7 : Red Hat OpenShift Enterprise 3.2 (RHSA-2016:1064)

high Nessus Plugin ID 119372

Version 1.8