Login
Newsletter
Werbung

Sicherheit: Preisgabe von Informationen in kubernetes-salt
Aktuelle Meldungen Distributionen
Name: Preisgabe von Informationen in kubernetes-salt
ID: SUSE-SU-2018:3073-1
Distribution: SUSE
Plattformen: SUSE CaaS Platform 3.0
Datum: Mo, 8. Oktober 2018, 19:05
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3760
Applikationen: kubernetes-salt

Originalnachricht

   SUSE Security Update: Security update for kubernetes-salt, velum
______________________________________________________________________________

Announcement ID: SUSE-SU-2018:3073-1
Rating: moderate
References: #1097753 #1098369 #1109320
Cross-References: CVE-2018-3760
Affected Products:
SUSE CaaS Platform 3.0
______________________________________________________________________________

An update that solves one vulnerability and has two fixes
is now available.

Description:


This update for rubygem-sprockets to version 3.7.2 and velum fixes the
following issues:

This security issue was fixed in rubygem-sprockets:

- CVE-2018-3760: Specially crafted requests could have been be used to
access files that exists on the filesystem that is outside an
application's root directory, when the Sprockets server is used in
production (bsc#1098369)

These non-security issues were fixed in velum:

- Fix external auth group mapping for group attr name. (bsc#1109320)
- Add configmap from pillar data to dex ldap connectors (fate#324601)
- Backport of LDAP external auth feature (fate#324601)
- Allow the user to upload a certificate via file (bsc#1097753)


Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation
methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- SUSE CaaS Platform 3.0:

To install this update, use the SUSE CaaS Platform Velum dashboard.
It will inform you if it detects new updates and let you then trigger
updating of the complete cluster in a controlled way.



Package List:

- SUSE CaaS Platform 3.0 (noarch):

kubernetes-salt-3.0.0+git_r855_633c667-3.12.6

- SUSE CaaS Platform 3.0 (x86_64):

sles12-velum-image-3.1.2-3.11.30


References:

https://www.suse.com/security/cve/CVE-2018-3760.html
https://bugzilla.suse.com/1097753
https://bugzilla.suse.com/1098369
https://bugzilla.suse.com/1109320

_______________________________________________
sle-security-updates mailing list
sle-security-updates@lists.suse.com
http://lists.suse.com/mailman/listinfo/sle-security-updates
Pro-Linux
Unterstützer werden
Neue Nachrichten
Werbung