Security update for python-oslo.cache, python-oslo.concurrency, python-oslo.db, python-oslo.log, python-oslo.messaging, python-oslo.middleware, python-oslo.serialization, python-oslo.service, python-oslo.utils, python-oslo.versionedobjects, python-oslo.vmware, python-oslotest SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:3924-1 Final 1 1 2018-11-27T12:40:17Z current 2018-11-27T12:40:17Z 2018-11-27T12:40:17Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python-oslo.cache, python-oslo.concurrency, python-oslo.db, python-oslo.log, python-oslo.messaging, python-oslo.middleware, python-oslo.serialization, python-oslo.service, python-oslo.utils, python-oslo.versionedobjects, python-oslo.vmware, python-oslotest This update for python-oslo.cache, python-oslo.concurrency, python-oslo.db, python-oslo.log, python-oslo.messaging, python-oslo.middleware, python-oslo.serialization, python-oslo.service, python-oslo.utils, python-oslo.versionedobjects, python-oslo.vmware, python-oslotest fixes the following issues: python-oslo.cache was updated to 1.14.1: - use stable/newton constraints python-oslo.concurrency was updated to version 3.14.1: - Ignore prlimit argument on Windows - Update .gitreview for stable/newton python-oslo.db was updated to version 4.13.6: - Fix marker checking when value is None python-oslo.log was updated to version 3.16.1: - Fix races in unit tests python-oslo.messaging was updated to fix: - Skip logging sensitive information to avoid credential leak - Avoid reconnect to the same AMQP server while trying to error handle the original server error (bsc#1109756) python-oslo.middleware was updated to version 3.19.1: - Filter token data out of catch_errors middleware (CVE-2017-2592 bsc#1022043) python-oslo.serialization was updated to version 2.13.2: - Don't iterate through addresses in netaddr.IPNetwork python-oslo.service was updated to version 1.16.1: - Fix race condition with fast threads python-oslo.utils was updated to version 3.16.1: - Updated from global requirements python-oslo.versionedobjects was updated to version 1.17.1: - update from global requirements python-oslo.vmware was updated to version 2.14.1: - Updated from global requirements python-oslotest was updated to version 2.10.1: - Updated from global requirements The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-OpenStack-Cloud-7-2018-2796 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20183924-1/ Link for SUSE-SU-2018:3924-1 https://lists.suse.com/pipermail/sle-security-updates/2018-November/004896.html E-Mail link for SUSE-SU-2018:3924-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1022043 SUSE Bug 1022043 https://bugzilla.suse.com/1109756 SUSE Bug 1109756 https://www.suse.com/security/cve/CVE-2017-2592/ SUSE CVE CVE-2017-2592 page SUSE OpenStack Cloud 7 python-oslo.cache-1.14.1-3.3.3 python-oslo.concurrency-3.14.1-3.3.3 python-oslo.db-4.13.6-3.3.3 python-oslo.log-3.16.1-3.3.3 python-oslo.messaging-5.10.2-3.6.3 python-oslo.middleware-3.19.1-4.3.4 python-oslo.serialization-2.13.2-3.3.3 python-oslo.service-1.16.1-3.3.1 python-oslo.utils-3.16.1-3.3.3 python-oslo.versionedobjects-1.17.1-3.3.1 python-oslo.vmware-2.14.1-3.3.1 python-oslotest-2.10.1-3.3.1 python-oslo.cache-1.14.1-3.3.3 as a component of SUSE OpenStack Cloud 7 python-oslo.concurrency-3.14.1-3.3.3 as a component of SUSE OpenStack Cloud 7 python-oslo.db-4.13.6-3.3.3 as a component of SUSE OpenStack Cloud 7 python-oslo.log-3.16.1-3.3.3 as a component of SUSE OpenStack Cloud 7 python-oslo.messaging-5.10.2-3.6.3 as a component of SUSE OpenStack Cloud 7 python-oslo.middleware-3.19.1-4.3.4 as a component of SUSE OpenStack Cloud 7 python-oslo.serialization-2.13.2-3.3.3 as a component of SUSE OpenStack Cloud 7 python-oslo.service-1.16.1-3.3.1 as a component of SUSE OpenStack Cloud 7 python-oslo.utils-3.16.1-3.3.3 as a component of SUSE OpenStack Cloud 7 python-oslo.versionedobjects-1.17.1-3.3.1 as a component of SUSE OpenStack Cloud 7 python-oslo.vmware-2.14.1-3.3.1 as a component of SUSE OpenStack Cloud 7 python-oslotest-2.10.1-3.3.1 as a component of SUSE OpenStack Cloud 7 python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens). CVE-2017-2592 SUSE OpenStack Cloud 7:python-oslo.cache-1.14.1-3.3.3 SUSE OpenStack Cloud 7:python-oslo.concurrency-3.14.1-3.3.3 SUSE OpenStack Cloud 7:python-oslo.db-4.13.6-3.3.3 SUSE OpenStack Cloud 7:python-oslo.log-3.16.1-3.3.3 SUSE OpenStack Cloud 7:python-oslo.messaging-5.10.2-3.6.3 SUSE OpenStack Cloud 7:python-oslo.middleware-3.19.1-4.3.4 SUSE OpenStack Cloud 7:python-oslo.serialization-2.13.2-3.3.3 SUSE OpenStack Cloud 7:python-oslo.service-1.16.1-3.3.1 SUSE OpenStack Cloud 7:python-oslo.utils-3.16.1-3.3.3 SUSE OpenStack Cloud 7:python-oslo.versionedobjects-1.17.1-3.3.1 SUSE OpenStack Cloud 7:python-oslo.vmware-2.14.1-3.3.1 SUSE OpenStack Cloud 7:python-oslotest-2.10.1-3.3.1 moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183924-1/ https://www.suse.com/security/cve/CVE-2017-2592.html CVE-2017-2592 https://bugzilla.suse.com/1022043 SUSE Bug 1022043 https://bugzilla.suse.com/1022152 SUSE Bug 1022152