Login
Newsletter
Werbung

Sicherheit: Preisgabe von Informationen in python-azure-agent
Aktuelle Meldungen Distributionen
Name: Preisgabe von Informationen in python-azure-agent
ID: SUSE-SU-2020:0440-1
Distribution: SUSE
Plattformen: SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1, SUSE Linux Enterprise Module for Public Cloud 15-SP1
Datum: Mo, 24. Februar 2020, 22:53
Referenzen: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0804
Applikationen: python-azure-agent

Originalnachricht


SUSE Security Update: Security update for python-azure-agent
______________________________________________________________________________

Announcement ID: SUSE-SU-2020:0440-1
Rating: moderate
References: #1127838
Cross-References: CVE-2019-0804
Affected Products:
SUSE Linux Enterprise Module for Public Cloud 15-SP1
SUSE Linux Enterprise Module for Open Buildservice
Development Tools 15-SP1
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for python-azure-agent fixes the following issues:

python-azure-agent was updated to version 2.2.45 (jsc#ECO-80)

+ Add support for Gen2 VM resource disks
+ Use alternate systemd detection
+ Fix /proc/net/route requirement that causes errors on FreeBSD
+ Add cloud-init auto-detect to prevent multiple provisioning mechanisms
from relying on configuration for coordination
+ Disable cgroups when daemon is setup incorrectly
+ Remove upgrade extension loop for the same goal state
+ Add container id for extension telemetry events
+ Be more exact when detecting IMDS service health
+ Changing add_event to start sending missing fields

From 2.2.44 update:

+ Remove outdated extension ZIP packages
+ Improved error handling when starting extensions using systemd
+ Reduce provisioning time of some custom images
+ Improve the handling of extension download errors
+ New API for extension authors to handle errors during extension update
+ Fix handling of errors in calls to openssl
+ Improve logic to determine current distro
+ Reduce verbosity of several logging statements

From 2.2.42 update:

+ Poll for artifact blob, addresses goal state procesing issue

From 2.2.41 update:

+ Rewriting the mechanism to start the extension using systemd-run for
systems using systemd for managing
+ Refactoring of resource monitoring framework using cgroup for both
systemd and non-systemd approaches [#1530, #1534]
+ Telemetry pipeline for resource monitoring data

From 2.2.40 update:

+ Fixed tracking of memory/cpu usage
+ Do not prevent extensions from running if setting up cgroups fails
+ Enable systemd-aware deprovisioning on all versions >= 18.04
+ Add systemd support for Debian Jessie, Stretch, and Buster
+ Support for Linux Openwrt

From 2.2.38 update:

Security issue fixed:
+ CVE-2019-0804: An issue with swapfile handling in the agent creates a
data leak situation that exposes system memory data. (bsc#1127838)
+ Add fixes for handling swap file and other nit fixes

From 2.2.37 update:
+ Improves re-try logic to handle errors while downloading extensions


Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation
methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- SUSE Linux Enterprise Module for Public Cloud 15-SP1:

zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP1-2020-440=1

- SUSE Linux Enterprise Module for Open Buildservice Development Tools
15-SP1:

zypper in -t patch
SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2020-440=1



Package List:

- SUSE Linux Enterprise Module for Public Cloud 15-SP1 (noarch):

python-azure-agent-2.2.45-3.3.1

- SUSE Linux Enterprise Module for Open Buildservice Development Tools
15-SP1 (noarch):

python-azure-agent-test-2.2.45-3.3.1


References:

https://www.suse.com/security/cve/CVE-2019-0804.html
https://bugzilla.suse.com/1127838

_______________________________________________
sle-security-updates mailing list
sle-security-updates@lists.suse.com
http://lists.suse.com/mailman/listinfo/sle-security-updates
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung