Security update for OpenStack SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:2576-1 Final 1 1 2018-08-31T12:16:48Z current 2018-08-31T12:16:48Z 2018-08-31T12:16:48Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for OpenStack This update for OpenStack fixes the following issues: The following security issue with openstack-keystone has been fixed: - CVE-2018-14432: Reduce duplication in federated authentication APIs. (bsc#1102151) Additionally, the following non-security issues have been fixed: openstack-dashboard: - Fetch and show Cinder availability zones list during volume creation and volume creation from image. (bsc#1100751) openstack-heat: - Add Trunk resource support. openstack-horizon-plugin-designate-ui: - Install all designate panels that are available. openstack-nova: - Stop _undefine_domain erroring if domain not found. (bsc#1099902) - Fix Nova to allow using cinder v3 endpoint. (bsc#1095482) python-os-vif: - Check if interface belongs to a Linux Bridge before removing. (bsc#1084724) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-OpenStack-Cloud-7-2018-1808 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20182576-1/ Link for SUSE-SU-2018:2576-1 https://lists.suse.com/pipermail/sle-security-updates/2018-August/004522.html E-Mail link for SUSE-SU-2018:2576-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1084724 SUSE Bug 1084724 https://bugzilla.suse.com/1095482 SUSE Bug 1095482 https://bugzilla.suse.com/1099902 SUSE Bug 1099902 https://bugzilla.suse.com/1100751 SUSE Bug 1100751 https://bugzilla.suse.com/1102151 SUSE Bug 1102151 https://www.suse.com/security/cve/CVE-2018-14432/ SUSE CVE CVE-2018-14432 page SUSE OpenStack Cloud 7 openstack-dashboard-10.0.6~dev4-4.15.1 openstack-heat-7.0.7~dev10-5.12.1 openstack-heat-api-7.0.7~dev10-5.12.1 openstack-heat-api-cfn-7.0.7~dev10-5.12.1 openstack-heat-api-cloudwatch-7.0.7~dev10-5.12.1 openstack-heat-doc-7.0.7~dev10-5.12.1 openstack-heat-engine-7.0.7~dev10-5.12.1 openstack-heat-plugin-heat_docker-7.0.7~dev10-5.12.1 openstack-heat-test-7.0.7~dev10-5.12.1 openstack-horizon-plugin-designate-ui-3.0.2~dev1-3.6.1 openstack-keystone-10.0.3~dev9-7.12.1 openstack-keystone-doc-10.0.3~dev9-7.12.1 openstack-nova-14.0.11~dev13-4.25.1 openstack-nova-api-14.0.11~dev13-4.25.1 openstack-nova-cells-14.0.11~dev13-4.25.1 openstack-nova-cert-14.0.11~dev13-4.25.1 openstack-nova-compute-14.0.11~dev13-4.25.1 openstack-nova-conductor-14.0.11~dev13-4.25.1 openstack-nova-console-14.0.11~dev13-4.25.1 openstack-nova-consoleauth-14.0.11~dev13-4.25.1 openstack-nova-doc-14.0.11~dev13-4.25.1 openstack-nova-novncproxy-14.0.11~dev13-4.25.1 openstack-nova-placement-api-14.0.11~dev13-4.25.1 openstack-nova-scheduler-14.0.11~dev13-4.25.1 openstack-nova-serialproxy-14.0.11~dev13-4.25.1 openstack-nova-vncproxy-14.0.11~dev13-4.25.1 python-heat-7.0.7~dev10-5.12.1 python-horizon-10.0.6~dev4-4.15.1 python-horizon-plugin-designate-ui-3.0.2~dev1-3.6.1 python-keystone-10.0.3~dev9-7.12.1 python-nova-14.0.11~dev13-4.25.1 python-os-vif-1.2.1-3.3.1 openstack-dashboard-10.0.6~dev4-4.15.1 as a component of SUSE OpenStack Cloud 7 openstack-heat-7.0.7~dev10-5.12.1 as a component of SUSE OpenStack Cloud 7 openstack-heat-api-7.0.7~dev10-5.12.1 as a component of SUSE OpenStack Cloud 7 openstack-heat-api-cfn-7.0.7~dev10-5.12.1 as a component of SUSE OpenStack Cloud 7 openstack-heat-api-cloudwatch-7.0.7~dev10-5.12.1 as a component of SUSE OpenStack Cloud 7 openstack-heat-doc-7.0.7~dev10-5.12.1 as a component of SUSE OpenStack Cloud 7 openstack-heat-engine-7.0.7~dev10-5.12.1 as a component of SUSE OpenStack Cloud 7 openstack-heat-plugin-heat_docker-7.0.7~dev10-5.12.1 as a component of SUSE OpenStack Cloud 7 openstack-heat-test-7.0.7~dev10-5.12.1 as a component of SUSE OpenStack Cloud 7 openstack-horizon-plugin-designate-ui-3.0.2~dev1-3.6.1 as a component of SUSE OpenStack Cloud 7 openstack-keystone-10.0.3~dev9-7.12.1 as a component of SUSE OpenStack Cloud 7 openstack-keystone-doc-10.0.3~dev9-7.12.1 as a component of SUSE OpenStack Cloud 7 openstack-nova-14.0.11~dev13-4.25.1 as a component of SUSE OpenStack Cloud 7 openstack-nova-api-14.0.11~dev13-4.25.1 as a component of SUSE OpenStack Cloud 7 openstack-nova-cells-14.0.11~dev13-4.25.1 as a component of SUSE OpenStack Cloud 7 openstack-nova-cert-14.0.11~dev13-4.25.1 as a component of SUSE OpenStack Cloud 7 openstack-nova-compute-14.0.11~dev13-4.25.1 as a component of SUSE OpenStack Cloud 7 openstack-nova-conductor-14.0.11~dev13-4.25.1 as a component of SUSE OpenStack Cloud 7 openstack-nova-console-14.0.11~dev13-4.25.1 as a component of SUSE OpenStack Cloud 7 openstack-nova-consoleauth-14.0.11~dev13-4.25.1 as a component of SUSE OpenStack Cloud 7 openstack-nova-doc-14.0.11~dev13-4.25.1 as a component of SUSE OpenStack Cloud 7 openstack-nova-novncproxy-14.0.11~dev13-4.25.1 as a component of SUSE OpenStack Cloud 7 openstack-nova-placement-api-14.0.11~dev13-4.25.1 as a component of SUSE OpenStack Cloud 7 openstack-nova-scheduler-14.0.11~dev13-4.25.1 as a component of SUSE OpenStack Cloud 7 openstack-nova-serialproxy-14.0.11~dev13-4.25.1 as a component of SUSE OpenStack Cloud 7 openstack-nova-vncproxy-14.0.11~dev13-4.25.1 as a component of SUSE OpenStack Cloud 7 python-heat-7.0.7~dev10-5.12.1 as a component of SUSE OpenStack Cloud 7 python-horizon-10.0.6~dev4-4.15.1 as a component of SUSE OpenStack Cloud 7 python-horizon-plugin-designate-ui-3.0.2~dev1-3.6.1 as a component of SUSE OpenStack Cloud 7 python-keystone-10.0.3~dev9-7.12.1 as a component of SUSE OpenStack Cloud 7 python-nova-14.0.11~dev13-4.25.1 as a component of SUSE OpenStack Cloud 7 python-os-vif-1.2.1-3.3.1 as a component of SUSE OpenStack Cloud 7 In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected. CVE-2018-14432 SUSE OpenStack Cloud 7:openstack-dashboard-10.0.6~dev4-4.15.1 SUSE OpenStack Cloud 7:openstack-heat-7.0.7~dev10-5.12.1 SUSE OpenStack Cloud 7:openstack-heat-api-7.0.7~dev10-5.12.1 SUSE OpenStack Cloud 7:openstack-heat-api-cfn-7.0.7~dev10-5.12.1 SUSE OpenStack Cloud 7:openstack-heat-api-cloudwatch-7.0.7~dev10-5.12.1 SUSE OpenStack Cloud 7:openstack-heat-doc-7.0.7~dev10-5.12.1 SUSE OpenStack Cloud 7:openstack-heat-engine-7.0.7~dev10-5.12.1 SUSE OpenStack Cloud 7:openstack-heat-plugin-heat_docker-7.0.7~dev10-5.12.1 SUSE OpenStack Cloud 7:openstack-heat-test-7.0.7~dev10-5.12.1 SUSE OpenStack Cloud 7:openstack-horizon-plugin-designate-ui-3.0.2~dev1-3.6.1 SUSE OpenStack Cloud 7:openstack-keystone-10.0.3~dev9-7.12.1 SUSE OpenStack Cloud 7:openstack-keystone-doc-10.0.3~dev9-7.12.1 SUSE OpenStack Cloud 7:openstack-nova-14.0.11~dev13-4.25.1 SUSE OpenStack Cloud 7:openstack-nova-api-14.0.11~dev13-4.25.1 SUSE OpenStack Cloud 7:openstack-nova-cells-14.0.11~dev13-4.25.1 SUSE OpenStack Cloud 7:openstack-nova-cert-14.0.11~dev13-4.25.1 SUSE OpenStack Cloud 7:openstack-nova-compute-14.0.11~dev13-4.25.1 SUSE OpenStack Cloud 7:openstack-nova-conductor-14.0.11~dev13-4.25.1 SUSE OpenStack Cloud 7:openstack-nova-console-14.0.11~dev13-4.25.1 SUSE OpenStack Cloud 7:openstack-nova-consoleauth-14.0.11~dev13-4.25.1 SUSE OpenStack Cloud 7:openstack-nova-doc-14.0.11~dev13-4.25.1 SUSE OpenStack Cloud 7:openstack-nova-novncproxy-14.0.11~dev13-4.25.1 SUSE OpenStack Cloud 7:openstack-nova-placement-api-14.0.11~dev13-4.25.1 SUSE OpenStack Cloud 7:openstack-nova-scheduler-14.0.11~dev13-4.25.1 SUSE OpenStack Cloud 7:openstack-nova-serialproxy-14.0.11~dev13-4.25.1 SUSE OpenStack Cloud 7:openstack-nova-vncproxy-14.0.11~dev13-4.25.1 SUSE OpenStack Cloud 7:python-heat-7.0.7~dev10-5.12.1 SUSE OpenStack Cloud 7:python-horizon-10.0.6~dev4-4.15.1 SUSE OpenStack Cloud 7:python-horizon-plugin-designate-ui-3.0.2~dev1-3.6.1 SUSE OpenStack Cloud 7:python-keystone-10.0.3~dev9-7.12.1 SUSE OpenStack Cloud 7:python-nova-14.0.11~dev13-4.25.1 SUSE OpenStack Cloud 7:python-os-vif-1.2.1-3.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182576-1/ https://www.suse.com/security/cve/CVE-2018-14432.html CVE-2018-14432 https://bugzilla.suse.com/1102151 SUSE Bug 1102151