Security update for storm, storm-kit SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:3000-1 Final 1 1 2017-11-13T10:44:20Z current 2017-11-13T10:44:20Z 2017-11-13T10:44:20Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for storm, storm-kit This update for storm, storm-kit fixes the following issues: - Update storm to version 1.0.5 (bsc#1059463, CVE-2017-9799) - Update storm-kit to version 1.0.5 (bsc#1059463, CVE-2017-9799) - Initial package (bsc#1048688, fate#323204) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-OpenStack-Cloud-7-2017-1854 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20173000-1/ Link for SUSE-SU-2017:3000-1 https://lists.opensuse.org/opensuse-security-announce/2017-11/msg00023.html E-Mail link for SUSE-SU-2017:3000-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1048688 SUSE Bug 1048688 https://bugzilla.suse.com/1059463 SUSE Bug 1059463 https://www.suse.com/security/cve/CVE-2017-9799/ SUSE CVE CVE-2017-9799 page SUSE OpenStack Cloud 7 storm-1.0.5-5.3 storm-nimbus-1.0.5-5.3 storm-supervisor-1.0.5-5.3 storm-1.0.5-5.3 as a component of SUSE OpenStack Cloud 7 storm-nimbus-1.0.5-5.3 as a component of SUSE OpenStack Cloud 7 storm-supervisor-1.0.5-5.3 as a component of SUSE OpenStack Cloud 7 It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure credentials of the other user being compromised. CVE-2017-9799 SUSE OpenStack Cloud 7:storm-1.0.5-5.3 SUSE OpenStack Cloud 7:storm-nimbus-1.0.5-5.3 SUSE OpenStack Cloud 7:storm-supervisor-1.0.5-5.3 important 4 AV:N/AC:H/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173000-1/ https://www.suse.com/security/cve/CVE-2017-9799.html CVE-2017-9799 https://bugzilla.suse.com/1059463 SUSE Bug 1059463