drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in openstack-heat, openstack-swift und python-Werkzeug
Name: |
Mehrere Probleme in openstack-heat, openstack-swift und python-Werkzeug |
|
ID: |
SUSE-SU-2023:2378-1 |
|
Distribution: |
SUSE |
|
Plattformen: |
SUSE OpenStack Cloud 9, SUSE OpenStack Cloud Crowbar 9, SUSE Linux Enterprise Server 12 SP4 |
|
Datum: |
Mo, 5. Juni 2023, 20:33 |
|
Referenzen: |
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-47950
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1625
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25577 |
|
Applikationen: |
python-Werkzeug, OpenStack, OpenStack |
|
Originalnachricht |
--===============6785730340610504265== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit
# Security update for openstack-heat, openstack-swift, python-Werkzeug
Announcement ID: SUSE-SU-2023:2378-1 Rating: important References:
* #1207035 * #1208283 * #1209774
Cross-References:
* CVE-2022-47950 * CVE-2023-1625 * CVE-2023-25577
CVSS scores:
* CVE-2022-47950 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2022-47950 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N * CVE-2023-1625 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-25577 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-25577 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products:
* SUSE Linux Enterprise Server 12 SP4 * SUSE OpenStack Cloud 9 * SUSE OpenStack Cloud Crowbar 9
An update that solves three vulnerabilities can now be installed.
## Description:
This update for openstack-heat, openstack-swift, python-Werkzeug contains the following fixes:
Security fixes included in this update:
openstack-heat: \- CVE-2023-1625: Fixed an issue where parameter values marked as "hidden" would be shown in the stack's environment (bsc#1209774).
openstack-swift: \- CVE-2022-47950: Fixed a local file disclosure that could be triggered by an authenticated attacker by supplying a malicious XML (bnc#1207035).
python-Werkzeug: \- CVE-2023-25577: Fixed an unbounded resource usage when parsing multipart forms with many fields (bsc#1208283).
Non security changes on this update:
Changes in openstack-heat: \- Honor 'hidden' parameter in 'stack environment show' command. (bsc#1209774, CVE-2023-1625)
Changes in openstack-swift: \- Prevent XXE injections in API. (bsc#1207035, CVE-2022-47950)
Changes in python-Werkzeug; \- Limit maximum number of multipart form parts. (bsc#1208283, CVE-2023-25577)
## Patch Instructions:
To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product:
* SUSE OpenStack Cloud 9 zypper in -t patch SUSE-OpenStack-Cloud-9-2023-2378=1
* SUSE OpenStack Cloud Crowbar 9 zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-9-2023-2378=1
## Package List:
* SUSE OpenStack Cloud 9 (noarch) * openstack-swift-object-2.19.3~dev3-3.6.3 * openstack-heat-api-cfn-11.0.4~dev4-3.24.4 * openstack-swift-container-2.19.3~dev3-3.6.3 * python-Werkzeug-0.14.1-3.6.2 * python-heat-11.0.4~dev4-3.24.4 * python-swift-2.19.3~dev3-3.6.3 * openstack-heat-11.0.4~dev4-3.24.4 * venv-openstack-designate-x86_64-7.0.2~dev2-3.41.2 * venv-openstack-octavia-x86_64-3.2.3~dev7-4.41.2 * venv-openstack-magnum-x86_64-7.2.1~dev1-4.41.3 * venv-openstack-swift-x86_64-2.19.3~dev3-2.36.3 * openstack-heat-api-11.0.4~dev4-3.24.4 * openstack-swift-account-2.19.3~dev3-3.6.3 * venv-openstack-sahara-x86_64-9.0.2~dev15-3.41.2 * venv-openstack-keystone-x86_64-14.2.1~dev9-3.42.2 * openstack-heat-plugin-heat_docker-11.0.4~dev4-3.24.4 * openstack-swift-proxy-2.19.3~dev3-3.6.3 * openstack-swift-2.19.3~dev3-3.6.3 * venv-openstack-heat-x86_64-11.0.4~dev4-3.43.2 * openstack-heat-engine-11.0.4~dev4-3.24.4 * SUSE OpenStack Cloud Crowbar 9 (noarch) * openstack-swift-object-2.19.3~dev3-3.6.3 * openstack-heat-api-cfn-11.0.4~dev4-3.24.4 * openstack-swift-container-2.19.3~dev3-3.6.3 * python-Werkzeug-0.14.1-3.6.2 * python-heat-11.0.4~dev4-3.24.4 * python-swift-2.19.3~dev3-3.6.3 * openstack-heat-11.0.4~dev4-3.24.4 * openstack-heat-api-11.0.4~dev4-3.24.4 * openstack-swift-account-2.19.3~dev3-3.6.3 * openstack-heat-plugin-heat_docker-11.0.4~dev4-3.24.4 * openstack-swift-proxy-2.19.3~dev3-3.6.3 * openstack-swift-2.19.3~dev3-3.6.3 * openstack-heat-engine-11.0.4~dev4-3.24.4
## References:
* https://www.suse.com/security/cve/CVE-2022-47950.html * https://www.suse.com/security/cve/CVE-2023-1625.html * https://www.suse.com/security/cve/CVE-2023-25577.html * https://bugzilla.suse.com/show_bug.cgi?id=1207035 * https://bugzilla.suse.com/show_bug.cgi?id=1208283 * https://bugzilla.suse.com/show_bug.cgi?id=1209774
--===============6785730340610504265== Content-Type: text/html; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit
<div class="container"> <h1>Security update for openstack-heat, openstack-swift, python-Werkzeug</h1>
<table class="table table-striped table-bordered"> <tbody> <tr> <th>Announcement ID:</th> <td>SUSE-SU-2023:2378-1</td> </tr> <tr> <th>Rating:</th> <td>important</td> </tr> <tr> <th>References:</th> <td> <ul> <li style="display: inline;"> <a href="https://bugzilla.suse.com/show_bug.cgi?id=1207035">#1207035</a> </li> <li style="display: inline;"> <a href="https://bugzilla.suse.com/show_bug.cgi?id=1208283">#1208283</a> </li> <li style="display: inline;"> <a href="https://bugzilla.suse.com/show_bug.cgi?id=1209774">#1209774</a> </li> </ul> </td> </tr> <tr> <th> Cross-References: </th> <td> <ul> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2022-47950.html">CVE-2022-47950</a> </li> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2023-1625.html">CVE-2023-1625</a> </li> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2023-25577.html">CVE-2023-25577</a> </li> </ul> </td> </tr> <tr> <th>CVSS scores:</th> <td> <ul class="list-group"> <li class="list-group-item"> <span class="cvss-reference">CVE-2022-47950</span> <span class="cvss-source"> ( SUSE ): </span> <span class="cvss-score">7.5</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2022-47950</span> <span class="cvss-source"> ( NVD ): </span> <span class="cvss-score">6.5</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2023-1625</span> <span class="cvss-source"> ( SUSE ): </span> <span class="cvss-score">8.8</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2023-25577</span> <span class="cvss-source"> ( SUSE ): </span> <span class="cvss-score">7.5</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2023-25577</span> <span class="cvss-source"> ( NVD ): </span> <span class="cvss-score">7.5</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span> </li> </ul> </td> </tr> <tr> <th>Affected Products:</th> <td> <ul class="list-group"> <li class="list-group-item">SUSE Linux Enterprise Server 12 SP4</li> <li class="list-group-item">SUSE OpenStack Cloud 9</li> <li class="list-group-item">SUSE OpenStack Cloud Crowbar 9</li> </ul> </td> </tr> </tbody> </table>
<p>An update that solves three vulnerabilities can now be installed.</p>
<h2>Description:</h2> <p>This update for openstack-heat, openstack-swift, python-Werkzeug contains the following fixes:</p> <p>Security fixes included in this update:</p> <p>openstack-heat: - CVE-2023-1625: Fixed an issue where parameter values marked as "hidden" would be shown in the stack's environment (bsc#1209774).</p> <p>openstack-swift: - CVE-2022-47950: Fixed a local file disclosure that could be triggered by an authenticated attacker by supplying a malicious XML (bnc#1207035).</p> <p>python-Werkzeug: - CVE-2023-25577: Fixed an unbounded resource usage when parsing multipart forms with many fields (bsc#1208283).</p> <p>Non security changes on this update:</p> <p>Changes in openstack-heat: - Honor 'hidden' parameter in 'stack environment show' command. (bsc#1209774, CVE-2023-1625)</p> <p>Changes in openstack-swift: - Prevent XXE injections in API. (bsc#1207035, CVE-2022-47950)</p> <p>Changes in python-Werkzeug; - Limit maximum number of multipart form parts. (bsc#1208283, CVE-2023-25577)</p>
<h2>Patch Instructions:</h2> <p> To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product: </p> <ul class="list-group"> <li class="list-group-item"> SUSE OpenStack Cloud 9 <br/> <code>zypper in -t patch SUSE-OpenStack-Cloud-9-2023-2378=1</code> </li> <li class="list-group-item"> SUSE OpenStack Cloud Crowbar 9 <br/> <code>zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-9-2023-2378=1</code> </li> </ul>
<h2>Package List:</h2> <ul> <li> SUSE OpenStack Cloud 9 (noarch) <ul> <li>openstack-swift-object-2.19.3~dev3-3.6.3</li> <li>openstack-heat-api-cfn-11.0.4~dev4-3.24.4</li> <li>openstack-swift-container-2.19.3~dev3-3.6.3</li> <li>python-Werkzeug-0.14.1-3.6.2</li> <li>python-heat-11.0.4~dev4-3.24.4</li> <li>python-swift-2.19.3~dev3-3.6.3</li> <li>openstack-heat-11.0.4~dev4-3.24.4</li> <li>venv-openstack-designate-x86_64-7.0.2~dev2-3.41.2</li> <li>venv-openstack-octavia-x86_64-3.2.3~dev7-4.41.2</li> <li>venv-openstack-magnum-x86_64-7.2.1~dev1-4.41.3</li> <li>venv-openstack-swift-x86_64-2.19.3~dev3-2.36.3</li> <li>openstack-heat-api-11.0.4~dev4-3.24.4</li> <li>openstack-swift-account-2.19.3~dev3-3.6.3</li> <li>venv-openstack-sahara-x86_64-9.0.2~dev15-3.41.2</li> <li>venv-openstack-keystone-x86_64-14.2.1~dev9-3.42.2</li> <li>openstack-heat-plugin-heat_docker-11.0.4~dev4-3.24.4</li> <li>openstack-swift-proxy-2.19.3~dev3-3.6.3</li> <li>openstack-swift-2.19.3~dev3-3.6.3</li> <li>venv-openstack-heat-x86_64-11.0.4~dev4-3.43.2</li> <li>openstack-heat-engine-11.0.4~dev4-3.24.4</li> </ul> </li> <li> SUSE OpenStack Cloud Crowbar 9 (noarch) <ul> <li>openstack-swift-object-2.19.3~dev3-3.6.3</li> <li>openstack-heat-api-cfn-11.0.4~dev4-3.24.4</li> <li>openstack-swift-container-2.19.3~dev3-3.6.3</li> <li>python-Werkzeug-0.14.1-3.6.2</li> <li>python-heat-11.0.4~dev4-3.24.4</li> <li>python-swift-2.19.3~dev3-3.6.3</li> <li>openstack-heat-11.0.4~dev4-3.24.4</li> <li>openstack-heat-api-11.0.4~dev4-3.24.4</li> <li>openstack-swift-account-2.19.3~dev3-3.6.3</li> <li>openstack-heat-plugin-heat_docker-11.0.4~dev4-3.24.4</li> <li>openstack-swift-proxy-2.19.3~dev3-3.6.3</li> <li>openstack-swift-2.19.3~dev3-3.6.3</li> <li>openstack-heat-engine-11.0.4~dev4-3.24.4</li> </ul> </li> </ul>
<h2>References:</h2> <ul> <li> <a href="https://www.suse.com/security/cve/CVE-2022-47950.html">https://www.suse.com/security/cve/CVE-2022-47950.html</a> </li> <li> <a href="https://www.suse.com/security/cve/CVE-2023-1625.html">https://www.suse.com/security/cve/CVE-2023-1625.html</a> </li> <li> <a href="https://www.suse.com/security/cve/CVE-2023-25577.html">https://www.suse.com/security/cve/CVE-2023-25577.html</a> </li> <li> <a href="https://bugzilla.suse.com/show_bug.cgi?id=1207035">https://bugzilla.suse.com/show_bug.cgi?id=1207035</a> </li> <li> <a href="https://bugzilla.suse.com/show_bug.cgi?id=1208283">https://bugzilla.suse.com/show_bug.cgi?id=1208283</a> </li> <li> <a href="https://bugzilla.suse.com/show_bug.cgi?id=1209774">https://bugzilla.suse.com/show_bug.cgi?id=1209774</a> </li> </ul> </div>
--===============6785730340610504265==--
|
|
|
|