(RHSA-2017:1712) Important: Red Hat 3scale API Management Platform 2.0.0 security update

Red Hat 3scale API Management Platform 2.0 is a platform for the management of access and traffic for web-based APIs across a variety of deployment options.

Security Fix(es):

• It was found that RH-3scale AMP would permit creation of an access token without a client secret. An attacker could use this flaw to circumvent authentication controls and gain access to restricted APIs. (CVE-2017-7512)

The underlying container image was also rebuilt to resolve other security issues. These were addressed via the following errata:

• https://access.redhat.com/errata/RHSA-2017:1365
• https://access.redhat.com/errata/RHSA-2017:1481
• https://access.redhat.com/errata/RHSA-2017:1484

Red Hat would like to thank Ryan Nauman (TruCode) for reporting the CVE-2017-7512 issue.