drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in crowbar-core, crowbar-openstack, influxdb, openstack-heat-templates, openstack-nova, python-Jinja2 und grafana
Name: |
Mehrere Probleme in crowbar-core, crowbar-openstack, influxdb, openstack-heat-templates, openstack-nova, python-Jinja2 und grafana |
|
ID: |
SUSE-SU-2020:3896-1 |
|
Distribution: |
SUSE |
|
Plattformen: |
SUSE OpenStack Cloud Crowbar 8, SUSE HPE Helion Openstack 8, SUSE OpenStack Cloud 8 |
|
Datum: |
Mo, 21. Dezember 2020, 20:26 |
|
Referenzen: |
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20933
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24303
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10906
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10745
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8341
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17954 |
|
Applikationen: |
OpenStack, OpenStack, OpenStack, OpenStack, Jinja2, Grafana, InfluxDB |
|
Originalnachricht |
SUSE Security Update: Security update for crowbar-core, crowbar-openstack, grafana, influxdb, openstack-heat-templates, openstack-nova, python-Jinja2 ______________________________________________________________________________
Announcement ID: SUSE-SU-2020:3896-1 Rating: important References: #1117080 #1125815 #1132174 #1132323 #1178243 #1178988 #1179161 SOC-11240 Cross-References: CVE-2016-10745 CVE-2018-17954 CVE-2019-10906 CVE-2019-20933 CVE-2019-8341 CVE-2020-24303 Affected Products: SUSE OpenStack Cloud Crowbar 8 SUSE OpenStack Cloud 8 HPE Helion Openstack 8 ______________________________________________________________________________
An update that solves 6 vulnerabilities, contains one feature and has one errata is now available.
Description:
This update for crowbar-core, crowbar-openstack, grafana, influxdb, openstack-heat-templates, openstack-nova, python-Jinja2 fixes the following issues:
Security fixes included in this request:
grafana: - CVE-2020-24303: Fixed an XXS with series overides. (bsc#1178243)
influxdb: - CVE-2019-20933: Fixed an authentication bypass. (bsc#1178988)
python-Jinja2: - CVE-2019-10906, CVE-2019-8341, CVE-2016-10745: "SandboxedEnvironment" securely handles "str.format_map" in order to prevent code execution through untrusted format strings. (bsc#1132323, bsc#1125815, bsc#1132174)
Non-security fixes included in this request:
Changes in crowbar-core.SUSE_SLE-12-SP3_Update_Products_Cloud8: - Update to version 5.0+git.1606840757.839a64745: * ntp: Do not use rate-limiting (bsc#1179161)
Changes in crowbar-openstack.SUSE_SLE-12-SP3_Update_Products_Cloud8: - Update to version 5.0+git.1604938523.ded915845: * rabbitmq: Fix crm running check (SOC-11240)
Changes in grafana.SUSE_SLE-12-SP3_Update_Products_Cloud8_Update: - Fix bsc#1178243 CVE-2020-24303 by adding 25401-Fix-XSS-vulnerability-with-series-overrides.patch
Changes in influxdb.SUSE_SLE-12-SP3_Update_Products_Cloud8: - Add CVE-2019-20933.patch (bsc#1178988, CVE-2019-20933) to fix authentication bypass - Declare license files correctly
Changes in openstack-heat-templates.SUSE_SLE-12-SP3_Update_Products_Cloud8_Update: - Update to version 0.0.0+git.1605509190.64f020b: * Fix software config on rdo * optimize size and time using --no-cache-dir * add template for servers using Octavia
- Update to version 0.0.0+git.1604032742.c5733ee: * Move heat-templates-check job to zuul v3
Changes in openstack-nova-doc.SUSE_SLE-12-SP3_Update_Products_Cloud8_Update: - Update to version nova-16.1.9.dev77: * Follow up for cherry-pick check for merge patch
Changes in openstack-nova.SUSE_SLE-12-SP3_Update_Products_Cloud8_Update: - Update to version nova-16.1.9.dev77: * Follow up for cherry-pick check for merge patch
Changes in python-Jinja2.SUSE_SLE-12-SP3_Update_Products_Cloud8_Update: - add 0001-sandbox-str.format_map.patch (bsc#1132323, CVE-2019-10906, bsc#1125815, CVE-2019-8341) * "SandboxedEnvironment" securely handles "str.format_map" in order to prevent code execution through untrusted format strings. The sandbox already handled "str.format". - add 0001-SECURITY-support-sandboxing-in-format-expressions.patch (bsc#1132174, CVE-2016-10745)
- Allows Recommends and Suggest in Fedora
- Recommends only for SUSE
Changes in rubygem-crowbar-client:
- Update to 3.9.3 - Enable restricted commands for Cloud 7 (bsc#1117080, CVE-2018-17954)
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- SUSE OpenStack Cloud Crowbar 8:
zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-8-2020-3896=1
- SUSE OpenStack Cloud 8:
zypper in -t patch SUSE-OpenStack-Cloud-8-2020-3896=1
- HPE Helion Openstack 8:
zypper in -t patch HPE-Helion-OpenStack-8-2020-3896=1
Package List:
- SUSE OpenStack Cloud Crowbar 8 (noarch):
crowbar-openstack-5.0+git.1604938523.ded915845-4.46.1 openstack-heat-templates-0.0.0+git.1605509190.64f020b-3.18.1 openstack-nova-16.1.9~dev77-3.42.1 openstack-nova-api-16.1.9~dev77-3.42.1 openstack-nova-cells-16.1.9~dev77-3.42.1 openstack-nova-compute-16.1.9~dev77-3.42.1 openstack-nova-conductor-16.1.9~dev77-3.42.1 openstack-nova-console-16.1.9~dev77-3.42.1 openstack-nova-consoleauth-16.1.9~dev77-3.42.1 openstack-nova-doc-16.1.9~dev77-3.42.1 openstack-nova-novncproxy-16.1.9~dev77-3.42.1 openstack-nova-placement-api-16.1.9~dev77-3.42.1 openstack-nova-scheduler-16.1.9~dev77-3.42.1 openstack-nova-serialproxy-16.1.9~dev77-3.42.1 openstack-nova-vncproxy-16.1.9~dev77-3.42.1 python-Jinja2-2.9.6-3.3.1 python-nova-16.1.9~dev77-3.42.1
- SUSE OpenStack Cloud Crowbar 8 (x86_64):
crowbar-core-5.0+git.1606840757.839a64745-3.47.1 crowbar-core-branding-upstream-5.0+git.1606840757.839a64745-3.47.1 grafana-6.7.4-4.15.1 grafana-debuginfo-6.7.4-4.15.1 influxdb-1.3.4-4.3.1 influxdb-debuginfo-1.3.4-4.3.1 influxdb-debugsource-1.3.4-4.3.1 ruby2.1-rubygem-crowbar-client-3.9.3-3.15.1
- SUSE OpenStack Cloud 8 (noarch):
openstack-heat-templates-0.0.0+git.1605509190.64f020b-3.18.1 openstack-nova-16.1.9~dev77-3.42.1 openstack-nova-api-16.1.9~dev77-3.42.1 openstack-nova-cells-16.1.9~dev77-3.42.1 openstack-nova-compute-16.1.9~dev77-3.42.1 openstack-nova-conductor-16.1.9~dev77-3.42.1 openstack-nova-console-16.1.9~dev77-3.42.1 openstack-nova-consoleauth-16.1.9~dev77-3.42.1 openstack-nova-doc-16.1.9~dev77-3.42.1 openstack-nova-novncproxy-16.1.9~dev77-3.42.1 openstack-nova-placement-api-16.1.9~dev77-3.42.1 openstack-nova-scheduler-16.1.9~dev77-3.42.1 openstack-nova-serialproxy-16.1.9~dev77-3.42.1 openstack-nova-vncproxy-16.1.9~dev77-3.42.1 python-Jinja2-2.9.6-3.3.1 python-nova-16.1.9~dev77-3.42.1 venv-openstack-aodh-x86_64-5.1.1~dev7-12.30.1 venv-openstack-barbican-x86_64-5.0.2~dev3-12.31.1 venv-openstack-ceilometer-x86_64-9.0.8~dev7-12.28.1 venv-openstack-cinder-x86_64-11.2.3~dev29-14.32.1 venv-openstack-designate-x86_64-5.0.3~dev7-12.29.1 venv-openstack-freezer-x86_64-5.0.0.0~xrc2~dev2-10.26.1 venv-openstack-glance-x86_64-15.0.3~dev3-12.29.1 venv-openstack-heat-x86_64-9.0.8~dev22-12.31.1 venv-openstack-ironic-x86_64-9.1.8~dev8-12.31.1 venv-openstack-keystone-x86_64-12.0.4~dev11-11.32.1 venv-openstack-magnum-x86_64-5.0.2_5.0.2_5.0.2~dev31-11.30.1 venv-openstack-manila-x86_64-5.1.1~dev5-12.35.1 venv-openstack-monasca-ceilometer-x86_64-1.5.1_1.5.1_1.5.1~dev3-8.26.1 venv-openstack-monasca-x86_64-2.2.2~dev1-11.26.1 venv-openstack-murano-x86_64-4.0.2~dev2-12.26.1 venv-openstack-neutron-x86_64-11.0.9~dev69-13.34.1 venv-openstack-nova-x86_64-16.1.9~dev77-11.32.1 venv-openstack-octavia-x86_64-1.0.6~dev3-12.31.1 venv-openstack-sahara-x86_64-7.0.5~dev4-11.30.1 venv-openstack-trove-x86_64-8.0.2~dev2-11.30.1
- SUSE OpenStack Cloud 8 (x86_64):
grafana-6.7.4-4.15.1 grafana-debuginfo-6.7.4-4.15.1 influxdb-1.3.4-4.3.1 influxdb-debuginfo-1.3.4-4.3.1 influxdb-debugsource-1.3.4-4.3.1
- HPE Helion Openstack 8 (noarch):
openstack-heat-templates-0.0.0+git.1605509190.64f020b-3.18.1 openstack-nova-16.1.9~dev77-3.42.1 openstack-nova-api-16.1.9~dev77-3.42.1 openstack-nova-cells-16.1.9~dev77-3.42.1 openstack-nova-compute-16.1.9~dev77-3.42.1 openstack-nova-conductor-16.1.9~dev77-3.42.1 openstack-nova-console-16.1.9~dev77-3.42.1 openstack-nova-consoleauth-16.1.9~dev77-3.42.1 openstack-nova-doc-16.1.9~dev77-3.42.1 openstack-nova-novncproxy-16.1.9~dev77-3.42.1 openstack-nova-placement-api-16.1.9~dev77-3.42.1 openstack-nova-scheduler-16.1.9~dev77-3.42.1 openstack-nova-serialproxy-16.1.9~dev77-3.42.1 openstack-nova-vncproxy-16.1.9~dev77-3.42.1 python-Jinja2-2.9.6-3.3.1 python-nova-16.1.9~dev77-3.42.1 venv-openstack-aodh-x86_64-5.1.1~dev7-12.30.1 venv-openstack-barbican-x86_64-5.0.2~dev3-12.31.1 venv-openstack-ceilometer-x86_64-9.0.8~dev7-12.28.1 venv-openstack-cinder-x86_64-11.2.3~dev29-14.32.1 venv-openstack-designate-x86_64-5.0.3~dev7-12.29.1 venv-openstack-freezer-x86_64-5.0.0.0~xrc2~dev2-10.26.1 venv-openstack-glance-x86_64-15.0.3~dev3-12.29.1 venv-openstack-heat-x86_64-9.0.8~dev22-12.31.1 venv-openstack-ironic-x86_64-9.1.8~dev8-12.31.1 venv-openstack-keystone-x86_64-12.0.4~dev11-11.32.1 venv-openstack-magnum-x86_64-5.0.2_5.0.2_5.0.2~dev31-11.30.1 venv-openstack-manila-x86_64-5.1.1~dev5-12.35.1 venv-openstack-monasca-ceilometer-x86_64-1.5.1_1.5.1_1.5.1~dev3-8.26.1 venv-openstack-monasca-x86_64-2.2.2~dev1-11.26.1 venv-openstack-murano-x86_64-4.0.2~dev2-12.26.1 venv-openstack-neutron-x86_64-11.0.9~dev69-13.34.1 venv-openstack-nova-x86_64-16.1.9~dev77-11.32.1 venv-openstack-octavia-x86_64-1.0.6~dev3-12.31.1 venv-openstack-sahara-x86_64-7.0.5~dev4-11.30.1 venv-openstack-trove-x86_64-8.0.2~dev2-11.30.1
- HPE Helion Openstack 8 (x86_64):
grafana-6.7.4-4.15.1 grafana-debuginfo-6.7.4-4.15.1 influxdb-1.3.4-4.3.1 influxdb-debuginfo-1.3.4-4.3.1 influxdb-debugsource-1.3.4-4.3.1
References:
https://www.suse.com/security/cve/CVE-2016-10745.html https://www.suse.com/security/cve/CVE-2018-17954.html https://www.suse.com/security/cve/CVE-2019-10906.html https://www.suse.com/security/cve/CVE-2019-20933.html https://www.suse.com/security/cve/CVE-2019-8341.html https://www.suse.com/security/cve/CVE-2020-24303.html https://bugzilla.suse.com/1117080 https://bugzilla.suse.com/1125815 https://bugzilla.suse.com/1132174 https://bugzilla.suse.com/1132323 https://bugzilla.suse.com/1178243 https://bugzilla.suse.com/1178988 https://bugzilla.suse.com/1179161
|
|
|
|