Misc

The issue concerns a predictable /tmp in the set-proxy connection hook of the OpenShift haproxy cartridge, which could facilitate a denial-of-service (DoS) attack.

The issue is related to the improper creation of files in /tmp by the dump.sh script in the cartridges/openshift-origin-cartridge-mongodb-2.2/info/bin directory of OpenShift.

A critical issue was found, affecting an unknown part of the component API. This leads to Remote Privilege Escalation and can be initiated remotely. The exploit has been disclosed publicly.

The issue is related to errors in the code when a Java plugin is enabled, allowing remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted Java applet that deallocates an in-use JavaScript wrapper. The Java plugin can deallocate a JavaScript wrapper when it is still in use, leading to a JavaScript garbage collection crash, which is potentially exploitable.

The issue allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in /tmp/. This occurs when using ControlPersist in the `runner/connection plugins/ssh.py` module.