Security update for grafana, kafka, logstash, openstack-monasca-installer SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:2317-1 Final 1 1 2018-08-14T06:03:57Z current 2018-08-14T06:03:57Z 2018-08-14T06:03:57Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for grafana, kafka, logstash, openstack-monasca-installer This update for grafana, kafka, logstash, openstack-monasca-installer fixes the following issues: Security issues fixed: - CVE-2018-12099: grafana: Fix XSS vulnerabilities in dashboard links (bsc#1096985). - CVE-2018-3817: logstash: Fix inadvertently logging of sensitive information (bsc#1090849). Bug fixes: - bsc#1095603: Disable jmxremote debugging. - bsc#1097847: Make time series database schema setup conditional. - bsc#1094448: Set log rotation options. - bsc#1090336: Add complete set of elasticsearch performance tunables. - bsc#1101366: Fix build issues with s390x, ppc64le and aarch64. - Fix various spec errors affecting Leap 15 and Tumbleweed The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). HPE-Helion-OpenStack-8-2018-1553,SUSE-OpenStack-Cloud-8-2018-1553,SUSE-OpenStack-Cloud-Crowbar-8-2018-1553 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20182317-1/ Link for SUSE-SU-2018:2317-1 https://lists.suse.com/pipermail/sle-security-updates/2018-August/004406.html E-Mail link for SUSE-SU-2018:2317-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1090336 SUSE Bug 1090336 https://bugzilla.suse.com/1090849 SUSE Bug 1090849 https://bugzilla.suse.com/1094448 SUSE Bug 1094448 https://bugzilla.suse.com/1095603 SUSE Bug 1095603 https://bugzilla.suse.com/1096985 SUSE Bug 1096985 https://bugzilla.suse.com/1097847 SUSE Bug 1097847 https://bugzilla.suse.com/1101366 SUSE Bug 1101366 https://www.suse.com/security/cve/CVE-2018-12099/ SUSE CVE CVE-2018-12099 page https://www.suse.com/security/cve/CVE-2018-3817/ SUSE CVE CVE-2018-3817 page HPE Helion OpenStack 8 SUSE OpenStack Cloud 8 SUSE OpenStack Cloud Crowbar 8 grafana-4.5.1-4.3.1 kafka-0.9.0.1-5.3.1 logstash-2.4.1-5.4.1 openstack-monasca-installer-20180622_15.06-3.6.1 grafana-4.5.1-4.3.1 as a component of HPE Helion OpenStack 8 kafka-0.9.0.1-5.3.1 as a component of HPE Helion OpenStack 8 logstash-2.4.1-5.4.1 as a component of HPE Helion OpenStack 8 openstack-monasca-installer-20180622_15.06-3.6.1 as a component of HPE Helion OpenStack 8 grafana-4.5.1-4.3.1 as a component of SUSE OpenStack Cloud 8 kafka-0.9.0.1-5.3.1 as a component of SUSE OpenStack Cloud 8 logstash-2.4.1-5.4.1 as a component of SUSE OpenStack Cloud 8 openstack-monasca-installer-20180622_15.06-3.6.1 as a component of SUSE OpenStack Cloud 8 grafana-4.5.1-4.3.1 as a component of SUSE OpenStack Cloud Crowbar 8 kafka-0.9.0.1-5.3.1 as a component of SUSE OpenStack Cloud Crowbar 8 logstash-2.4.1-5.4.1 as a component of SUSE OpenStack Cloud Crowbar 8 openstack-monasca-installer-20180622_15.06-3.6.1 as a component of SUSE OpenStack Cloud Crowbar 8 Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links. CVE-2018-12099 HPE Helion OpenStack 8:grafana-4.5.1-4.3.1 HPE Helion OpenStack 8:kafka-0.9.0.1-5.3.1 HPE Helion OpenStack 8:logstash-2.4.1-5.4.1 HPE Helion OpenStack 8:openstack-monasca-installer-20180622_15.06-3.6.1 SUSE OpenStack Cloud 8:grafana-4.5.1-4.3.1 SUSE OpenStack Cloud 8:kafka-0.9.0.1-5.3.1 SUSE OpenStack Cloud 8:logstash-2.4.1-5.4.1 SUSE OpenStack Cloud 8:openstack-monasca-installer-20180622_15.06-3.6.1 SUSE OpenStack Cloud Crowbar 8:grafana-4.5.1-4.3.1 SUSE OpenStack Cloud Crowbar 8:kafka-0.9.0.1-5.3.1 SUSE OpenStack Cloud Crowbar 8:logstash-2.4.1-5.4.1 SUSE OpenStack Cloud Crowbar 8:openstack-monasca-installer-20180622_15.06-3.6.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182317-1/ https://www.suse.com/security/cve/CVE-2018-12099.html CVE-2018-12099 https://bugzilla.suse.com/1096985 SUSE Bug 1096985 https://bugzilla.suse.com/1172450 SUSE Bug 1172450 https://bugzilla.suse.com/1174583 SUSE Bug 1174583 https://bugzilla.suse.com/1175951 SUSE Bug 1175951 When logging warnings regarding deprecated settings, Logstash before 5.6.6 and 6.x before 6.1.2 could inadvertently log sensitive information. CVE-2018-3817 HPE Helion OpenStack 8:grafana-4.5.1-4.3.1 HPE Helion OpenStack 8:kafka-0.9.0.1-5.3.1 HPE Helion OpenStack 8:logstash-2.4.1-5.4.1 HPE Helion OpenStack 8:openstack-monasca-installer-20180622_15.06-3.6.1 SUSE OpenStack Cloud 8:grafana-4.5.1-4.3.1 SUSE OpenStack Cloud 8:kafka-0.9.0.1-5.3.1 SUSE OpenStack Cloud 8:logstash-2.4.1-5.4.1 SUSE OpenStack Cloud 8:openstack-monasca-installer-20180622_15.06-3.6.1 SUSE OpenStack Cloud Crowbar 8:grafana-4.5.1-4.3.1 SUSE OpenStack Cloud Crowbar 8:kafka-0.9.0.1-5.3.1 SUSE OpenStack Cloud Crowbar 8:logstash-2.4.1-5.4.1 SUSE OpenStack Cloud Crowbar 8:openstack-monasca-installer-20180622_15.06-3.6.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182317-1/ https://www.suse.com/security/cve/CVE-2018-3817.html CVE-2018-3817 https://bugzilla.suse.com/1090849 SUSE Bug 1090849