Security update for crowbar-openstack SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:1103-1 Final 1 1 2018-04-27T15:38:23Z current 2018-04-27T15:38:23Z 2018-04-27T15:38:23Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for crowbar-openstack This update for crowbar-openstack provides the following fixes: - memcached: Disable UDP by default to prevent spoofed traffic amplification DoS (bsc#1083903, CVE-2018-1000115) - nova: Add resource limits for api and compute (bsc#1057086) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-OpenStack-Cloud-6-2018-752 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20181103-1/ Link for SUSE-SU-2018:1103-1 https://lists.suse.com/pipermail/sle-security-updates/2018-April/003966.html E-Mail link for SUSE-SU-2018:1103-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1057086 SUSE Bug 1057086 https://bugzilla.suse.com/1083903 SUSE Bug 1083903 https://www.suse.com/security/cve/CVE-2018-1000115/ SUSE CVE CVE-2018-1000115 page SUSE OpenStack Cloud 6 crowbar-openstack-3.0+git.1521471181.2b39130da-39.10.1 crowbar-openstack-3.0+git.1521471181.2b39130da-39.10.1 as a component of SUSE OpenStack Cloud 6 Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default. CVE-2018-1000115 SUSE OpenStack Cloud 6:crowbar-openstack-3.0+git.1521471181.2b39130da-39.10.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20181103-1/ https://www.suse.com/security/cve/CVE-2018-1000115.html CVE-2018-1000115 https://bugzilla.suse.com/1083903 SUSE Bug 1083903