Security update for grafana, kafka, logstash and monasca-installer SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:2536-1 Final 1 1 2018-08-28T09:05:28Z current 2018-08-28T09:05:28Z 2018-08-28T09:05:28Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for grafana, kafka, logstash and monasca-installer This update for grafana, kafka, logstash and monasca-installer fixes the following issues: The following security issues have been fixed: grafana: - CVE-2018-12099: Fix Cross-Site-Scripting (XSS) vulnerabilities in dashboard links. (bsc#1096985) kafka: - CVE-2018-1288: Authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss. (bsc#1102920) logstash: - CVE-2018-3817: Fix potential leak of sensitive data when logging warnings about deprecated options. (bsc#1090849) Additionally, the following non-security issues have been fixed: monasca-installer: - Add complete set of elasticsearch performance tunables. - Update to version Build_20180427_14.04 (bsc#1090192, bsc#1090343) - Fix bad elasticsearch-curator configuration. (bsc#1090192) - Enable bootstrap.memory_lock for Elasticsearch. (bsc#1090343) logstash: - Declare Gemfile as config to prevent loss of installed plugins when updating. - Stop installing prebuilt jruby for non-x86. kafka: - Update to version 0.10.2.2 (bsc#1102920, CVE-2018-1288) - Add noreplace directive for /etc/kafka/server.properties. - Reduce package ownership of tmpfiles.d to bare minium. (SLE12 SP2) - Set log rotation options. (bsc#1094448) - Disable jmxremote debugging. (bsc#1095603) - Increase open file limits. (bsc#1086909) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-OpenStack-Cloud-7-2018-1771 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20182536-1/ Link for SUSE-SU-2018:2536-1 https://lists.suse.com/pipermail/sle-security-updates/2018-August/004502.html E-Mail link for SUSE-SU-2018:2536-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1086909 SUSE Bug 1086909 https://bugzilla.suse.com/1090192 SUSE Bug 1090192 https://bugzilla.suse.com/1090343 SUSE Bug 1090343 https://bugzilla.suse.com/1090849 SUSE Bug 1090849 https://bugzilla.suse.com/1094448 SUSE Bug 1094448 https://bugzilla.suse.com/1095603 SUSE Bug 1095603 https://bugzilla.suse.com/1096985 SUSE Bug 1096985 https://bugzilla.suse.com/1102920 SUSE Bug 1102920 https://www.suse.com/security/cve/CVE-2018-12099/ SUSE CVE CVE-2018-12099 page https://www.suse.com/security/cve/CVE-2018-1288/ SUSE CVE CVE-2018-1288 page https://www.suse.com/security/cve/CVE-2018-3817/ SUSE CVE CVE-2018-3817 page SUSE OpenStack Cloud 7 grafana-4.5.1-1.8.1 kafka-0.10.2.2-5.1 logstash-2.4.1-5.1 monasca-installer-20180608_12.47-9.1 grafana-4.5.1-1.8.1 as a component of SUSE OpenStack Cloud 7 kafka-0.10.2.2-5.1 as a component of SUSE OpenStack Cloud 7 logstash-2.4.1-5.1 as a component of SUSE OpenStack Cloud 7 monasca-installer-20180608_12.47-9.1 as a component of SUSE OpenStack Cloud 7 Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links. CVE-2018-12099 SUSE OpenStack Cloud 7:grafana-4.5.1-1.8.1 SUSE OpenStack Cloud 7:kafka-0.10.2.2-5.1 SUSE OpenStack Cloud 7:logstash-2.4.1-5.1 SUSE OpenStack Cloud 7:monasca-installer-20180608_12.47-9.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182536-1/ https://www.suse.com/security/cve/CVE-2018-12099.html CVE-2018-12099 https://bugzilla.suse.com/1096985 SUSE Bug 1096985 https://bugzilla.suse.com/1172450 SUSE Bug 1172450 https://bugzilla.suse.com/1174583 SUSE Bug 1174583 https://bugzilla.suse.com/1175951 SUSE Bug 1175951 In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss. CVE-2018-1288 SUSE OpenStack Cloud 7:grafana-4.5.1-1.8.1 SUSE OpenStack Cloud 7:kafka-0.10.2.2-5.1 SUSE OpenStack Cloud 7:logstash-2.4.1-5.1 SUSE OpenStack Cloud 7:monasca-installer-20180608_12.47-9.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182536-1/ https://www.suse.com/security/cve/CVE-2018-1288.html CVE-2018-1288 https://bugzilla.suse.com/1102920 SUSE Bug 1102920 When logging warnings regarding deprecated settings, Logstash before 5.6.6 and 6.x before 6.1.2 could inadvertently log sensitive information. CVE-2018-3817 SUSE OpenStack Cloud 7:grafana-4.5.1-1.8.1 SUSE OpenStack Cloud 7:kafka-0.10.2.2-5.1 SUSE OpenStack Cloud 7:logstash-2.4.1-5.1 SUSE OpenStack Cloud 7:monasca-installer-20180608_12.47-9.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182536-1/ https://www.suse.com/security/cve/CVE-2018-3817.html CVE-2018-3817 https://bugzilla.suse.com/1090849 SUSE Bug 1090849