Security update for Cloud7 packages SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:1450-1 Final 1 1 2019-06-07T11:00:52Z current 2019-06-07T11:00:52Z 2019-06-07T11:00:52Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for Cloud7 packages This update provides fixes for the following packages issues: caasp-openstack-heat-templates: - Update to version 1.0+git.1553079189.3bf8922: * SCRD-2813 Add support for CPI parameters - Update to version 1.0+git.1547562889.43707e7: * Switch LB protocol from HTTP to HTTPS crowbar: - Update to version 4.0+git.1551088848.823bcaa3: * install-chef-suse: filter comments from authorized_keys file crowbar-core: - Update to version 4.0+git.1556285635.ab602dd4d: * network: run wicked ifdown for interface cleanup (bsc#1063535) - Update to version 4.0+git.1554931881.d98412e0e: * Fix cloud-mkcloud9-job-backup-restore (SCRD-7126) - Update to version 4.0+git.1552239940.5bc9aaac4: * crowbar: Do not rely on Chef::Util::FileEdit to write the file (bsc#1127752) - Update to version 4.0+git.1550493400.9787ea9ad: * upgrade: Delay status switch after upgrade ends - Update to version 4.0+git.1549474445.d9a35cf52: * fix hound warning * Support RAID 0 - Packaged default upgrade timeouts file - Update to version 4.0+git.1549136953.afcde921f: * apache2: enable sslsessioncache - Update to version 4.0+git.1548859099.0edbbfdc2: * upgrade: Add default upgrade timeouts file crowbar-ha: - Update to version 4.0+git.1556181005.47c643d: * pacemaker: wait more for founder if SBD is configured (SCRD-8462) * pacemaker: don't check cluster members on founder (SCRD-8462) - Update to version 4.0+git.1554215159.8a42a71: * improve galera HA setup (bsc#1122875) crowbar-openstack: - Update to version 4.0+git.1554887450.ff7c30c1c: * neutron: Added option to use L3 HA with Keepalived - Update to version 4.0+git.1554843756.5622551da: * ironic: Fix regression in helper - Update to version 4.0+git.1554814630.ec3c89f25: * ceilometer: Install package which contains cron file (bsc#1130414) - Update to version 4.0+git.1551459192.89433e13b: * rabbit: fix mirroring regex - Update to version 4.0+git.1550582615.f6b433ec7: * ceilometer: Use pacemaker to handle expirer cron link (bsc#1113107) - Update to version 4.0+git.1550262335.9667fa580: * mysql: Do not set a custom logfile for mysqld (bsc#1112767) * mysql: create .my.cnf in root home directory for mysql cmdline - Update to version 4.0+git.1549986893.df836d6cc: * mariadb: Remove installing the xtrabackup package * ssl: Fix ACL setup in ssl_setup provider (bsc#1123709) galera-python-clustercheck: - readtimeout.patch: Add socket read timeout (bsc#1122053) openstack-ceilometer: - Install openstack-ceilometer-expirer.cron into /usr/share/ceilometer This is needed in a clustered environment where multiple ceilometer-collector services are installed on different nodes (and due to that multiple expirer cron jobs installed). That can lead to deadlocks when the cron jobs run in parallel on the different nodes (bsc#1113107) openstack-heat-gbp: - switch to newton branch python-PyKMIP: - Fix a denial-of-service bug by setting the server socket timeout (bsc#1120767 CVE-2018-1000872) python-pysaml2: - Fix for the authentication bypass due to optimizations (CVE-2017-1000433, bsc#1074662) rubygem-crowbar-client: - Update to 3.9.0 - Add support for the restricted APIs - Add --raw to 'proposal show' and 'proposal edit' - Correctly parse error messages that we don't handle natively - Better upgrade repocheck output - Update to 3.7.0 - upgrade: Use cloud_version config for upgrade - ses: Add ses upload subcommand - Add cloud_version config field. - Wrap os-release file parsing for better reuse. - upgrade: Fix repocheck component in error message - upgrade: Better repocheck output - updated to version 3.6.1 * Hide the database step when it is not used (bsc#1118004) * Fix help strings * Describe how to upgrade more nodes with one command The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2019-1450,SUSE-OpenStack-Cloud-7-2019-1450,SUSE-Storage-4-2019-1450 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20191450-1/ Link for SUSE-SU-2019:1450-1 https://lists.suse.com/pipermail/sle-security-updates/2019-June/005539.html E-Mail link for SUSE-SU-2019:1450-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1063535 SUSE Bug 1063535 https://bugzilla.suse.com/1074662 SUSE Bug 1074662 https://bugzilla.suse.com/1112767 SUSE Bug 1112767 https://bugzilla.suse.com/1113107 SUSE Bug 1113107 https://bugzilla.suse.com/1118004 SUSE Bug 1118004 https://bugzilla.suse.com/1120767 SUSE Bug 1120767 https://bugzilla.suse.com/1122053 SUSE Bug 1122053 https://bugzilla.suse.com/1122875 SUSE Bug 1122875 https://bugzilla.suse.com/1123709 SUSE Bug 1123709 https://bugzilla.suse.com/1127558 SUSE Bug 1127558 https://bugzilla.suse.com/1127752 SUSE Bug 1127752 https://bugzilla.suse.com/1128954 SUSE Bug 1128954 https://bugzilla.suse.com/1128987 SUSE Bug 1128987 https://bugzilla.suse.com/1130414 SUSE Bug 1130414 https://bugzilla.suse.com/1131053 SUSE Bug 1131053 https://www.suse.com/security/cve/CVE-2017-1000433/ SUSE CVE CVE-2017-1000433 page https://www.suse.com/security/cve/CVE-2018-1000872/ SUSE CVE CVE-2018-1000872 page https://bugzilla.suse.com/SCRD-2813 SUSE Bug SCRD-2813 https://bugzilla.suse.com/SCRD-7126 SUSE Bug SCRD-7126 https://bugzilla.suse.com/SCRD-8462 SUSE Bug SCRD-8462 SUSE Enterprise Storage 4 SUSE OpenStack Cloud 7 caasp-openstack-heat-templates-1.0+git.1553079189.3bf8922-1.6.2 crowbar-4.0+git.1551088848.823bcaa3-7.29.2 crowbar-core-4.0+git.1556285635.ab602dd4d-9.46.3 crowbar-core-branding-upstream-4.0+git.1556285635.ab602dd4d-9.46.3 crowbar-core-devel-4.0+git.1556285635.ab602dd4d-9.46.3 crowbar-devel-4.0+git.1551088848.823bcaa3-7.29.2 crowbar-ha-4.0+git.1556181005.47c643d-4.46.3 crowbar-openstack-4.0+git.1554887450.ff7c30c1c-9.51.3 galera-python-clustercheck-0.0+git.1506329536.8f5878c-1.6.2 openstack-ceilometer-7.1.1~dev4-4.15.3 openstack-ceilometer-agent-central-7.1.1~dev4-4.15.3 openstack-ceilometer-agent-compute-7.1.1~dev4-4.15.3 openstack-ceilometer-agent-ipmi-7.1.1~dev4-4.15.3 openstack-ceilometer-agent-notification-7.1.1~dev4-4.15.3 openstack-ceilometer-api-7.1.1~dev4-4.15.3 openstack-ceilometer-collector-7.1.1~dev4-4.15.3 openstack-ceilometer-doc-7.1.1~dev4-4.15.3 openstack-ceilometer-polling-7.1.1~dev4-4.15.3 openstack-ceilometer-test-7.1.1~dev4-4.15.3 openstack-heat-gbp-5.1.1~dev1-2.6.3 openstack-heat-gbp-test-5.1.1~dev1-2.6.3 python-PyKMIP-0.5.0-3.3.3 python-ceilometer-7.1.1~dev4-4.15.3 python-heat-gbp-5.1.1~dev1-2.6.3 python-pysaml2-4.0.2-3.6.3 ruby2.1-rubygem-crowbar-client-3.9.0-7.14.2 ruby2.1-rubygem-crowbar-client-doc-3.9.0-7.14.2 ruby2.1-rubygem-crowbar-client-testsuite-3.9.0-7.14.2 crowbar-4.0+git.1551088848.823bcaa3-7.29.2 as a component of SUSE Enterprise Storage 4 crowbar-core-4.0+git.1556285635.ab602dd4d-9.46.3 as a component of SUSE Enterprise Storage 4 ruby2.1-rubygem-crowbar-client-3.9.0-7.14.2 as a component of SUSE Enterprise Storage 4 caasp-openstack-heat-templates-1.0+git.1553079189.3bf8922-1.6.2 as a component of SUSE OpenStack Cloud 7 crowbar-4.0+git.1551088848.823bcaa3-7.29.2 as a component of SUSE OpenStack Cloud 7 crowbar-core-4.0+git.1556285635.ab602dd4d-9.46.3 as a component of SUSE OpenStack Cloud 7 crowbar-core-branding-upstream-4.0+git.1556285635.ab602dd4d-9.46.3 as a component of SUSE OpenStack Cloud 7 crowbar-devel-4.0+git.1551088848.823bcaa3-7.29.2 as a component of SUSE OpenStack Cloud 7 crowbar-ha-4.0+git.1556181005.47c643d-4.46.3 as a component of SUSE OpenStack Cloud 7 crowbar-openstack-4.0+git.1554887450.ff7c30c1c-9.51.3 as a component of SUSE OpenStack Cloud 7 galera-python-clustercheck-0.0+git.1506329536.8f5878c-1.6.2 as a component of SUSE OpenStack Cloud 7 openstack-ceilometer-7.1.1~dev4-4.15.3 as a component of SUSE OpenStack Cloud 7 openstack-ceilometer-agent-central-7.1.1~dev4-4.15.3 as a component of SUSE OpenStack Cloud 7 openstack-ceilometer-agent-compute-7.1.1~dev4-4.15.3 as a component of SUSE OpenStack Cloud 7 openstack-ceilometer-agent-ipmi-7.1.1~dev4-4.15.3 as a component of SUSE OpenStack Cloud 7 openstack-ceilometer-agent-notification-7.1.1~dev4-4.15.3 as a component of SUSE OpenStack Cloud 7 openstack-ceilometer-api-7.1.1~dev4-4.15.3 as a component of SUSE OpenStack Cloud 7 openstack-ceilometer-collector-7.1.1~dev4-4.15.3 as a component of SUSE OpenStack Cloud 7 openstack-ceilometer-doc-7.1.1~dev4-4.15.3 as a component of SUSE OpenStack Cloud 7 openstack-ceilometer-polling-7.1.1~dev4-4.15.3 as a component of SUSE OpenStack Cloud 7 openstack-heat-gbp-5.1.1~dev1-2.6.3 as a component of SUSE OpenStack Cloud 7 python-PyKMIP-0.5.0-3.3.3 as a component of SUSE OpenStack Cloud 7 python-ceilometer-7.1.1~dev4-4.15.3 as a component of SUSE OpenStack Cloud 7 python-heat-gbp-5.1.1~dev1-2.6.3 as a component of SUSE OpenStack Cloud 7 python-pysaml2-4.0.2-3.6.3 as a component of SUSE OpenStack Cloud 7 ruby2.1-rubygem-crowbar-client-3.9.0-7.14.2 as a component of SUSE OpenStack Cloud 7 pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password. CVE-2017-1000433 SUSE Enterprise Storage 4:crowbar-4.0+git.1551088848.823bcaa3-7.29.2 SUSE Enterprise Storage 4:crowbar-core-4.0+git.1556285635.ab602dd4d-9.46.3 SUSE Enterprise Storage 4:ruby2.1-rubygem-crowbar-client-3.9.0-7.14.2 SUSE OpenStack Cloud 7:caasp-openstack-heat-templates-1.0+git.1553079189.3bf8922-1.6.2 SUSE OpenStack Cloud 7:crowbar-4.0+git.1551088848.823bcaa3-7.29.2 SUSE OpenStack Cloud 7:crowbar-core-4.0+git.1556285635.ab602dd4d-9.46.3 SUSE OpenStack Cloud 7:crowbar-core-branding-upstream-4.0+git.1556285635.ab602dd4d-9.46.3 SUSE OpenStack Cloud 7:crowbar-devel-4.0+git.1551088848.823bcaa3-7.29.2 SUSE OpenStack Cloud 7:crowbar-ha-4.0+git.1556181005.47c643d-4.46.3 SUSE OpenStack Cloud 7:crowbar-openstack-4.0+git.1554887450.ff7c30c1c-9.51.3 SUSE OpenStack Cloud 7:galera-python-clustercheck-0.0+git.1506329536.8f5878c-1.6.2 SUSE OpenStack Cloud 7:openstack-ceilometer-7.1.1~dev4-4.15.3 SUSE OpenStack Cloud 7:openstack-ceilometer-agent-central-7.1.1~dev4-4.15.3 SUSE OpenStack Cloud 7:openstack-ceilometer-agent-compute-7.1.1~dev4-4.15.3 SUSE OpenStack Cloud 7:openstack-ceilometer-agent-ipmi-7.1.1~dev4-4.15.3 SUSE OpenStack Cloud 7:openstack-ceilometer-agent-notification-7.1.1~dev4-4.15.3 SUSE OpenStack Cloud 7:openstack-ceilometer-api-7.1.1~dev4-4.15.3 SUSE OpenStack Cloud 7:openstack-ceilometer-collector-7.1.1~dev4-4.15.3 SUSE OpenStack Cloud 7:openstack-ceilometer-doc-7.1.1~dev4-4.15.3 SUSE OpenStack Cloud 7:openstack-ceilometer-polling-7.1.1~dev4-4.15.3 SUSE OpenStack Cloud 7:openstack-heat-gbp-5.1.1~dev1-2.6.3 SUSE OpenStack Cloud 7:python-PyKMIP-0.5.0-3.3.3 SUSE OpenStack Cloud 7:python-ceilometer-7.1.1~dev4-4.15.3 SUSE OpenStack Cloud 7:python-heat-gbp-5.1.1~dev1-2.6.3 SUSE OpenStack Cloud 7:python-pysaml2-4.0.2-3.6.3 SUSE OpenStack Cloud 7:ruby2.1-rubygem-crowbar-client-3.9.0-7.14.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191450-1/ https://www.suse.com/security/cve/CVE-2017-1000433.html CVE-2017-1000433 https://bugzilla.suse.com/1074662 SUSE Bug 1074662 OpenKMIP PyKMIP version All versions before 0.8.0 contains a CWE 399: Resource Management Errors (similar issue to CVE-2015-5262) vulnerability in PyKMIP server that can result in DOS: the server can be made unavailable by one or more clients opening all of the available sockets. This attack appear to be exploitable via A client or clients open sockets with the server and then never close them. This vulnerability appears to have been fixed in 0.8.0. CVE-2018-1000872 SUSE Enterprise Storage 4:crowbar-4.0+git.1551088848.823bcaa3-7.29.2 SUSE Enterprise Storage 4:crowbar-core-4.0+git.1556285635.ab602dd4d-9.46.3 SUSE Enterprise Storage 4:ruby2.1-rubygem-crowbar-client-3.9.0-7.14.2 SUSE OpenStack Cloud 7:caasp-openstack-heat-templates-1.0+git.1553079189.3bf8922-1.6.2 SUSE OpenStack Cloud 7:crowbar-4.0+git.1551088848.823bcaa3-7.29.2 SUSE OpenStack Cloud 7:crowbar-core-4.0+git.1556285635.ab602dd4d-9.46.3 SUSE OpenStack Cloud 7:crowbar-core-branding-upstream-4.0+git.1556285635.ab602dd4d-9.46.3 SUSE OpenStack Cloud 7:crowbar-devel-4.0+git.1551088848.823bcaa3-7.29.2 SUSE OpenStack Cloud 7:crowbar-ha-4.0+git.1556181005.47c643d-4.46.3 SUSE OpenStack Cloud 7:crowbar-openstack-4.0+git.1554887450.ff7c30c1c-9.51.3 SUSE OpenStack Cloud 7:galera-python-clustercheck-0.0+git.1506329536.8f5878c-1.6.2 SUSE OpenStack Cloud 7:openstack-ceilometer-7.1.1~dev4-4.15.3 SUSE OpenStack Cloud 7:openstack-ceilometer-agent-central-7.1.1~dev4-4.15.3 SUSE OpenStack Cloud 7:openstack-ceilometer-agent-compute-7.1.1~dev4-4.15.3 SUSE OpenStack Cloud 7:openstack-ceilometer-agent-ipmi-7.1.1~dev4-4.15.3 SUSE OpenStack Cloud 7:openstack-ceilometer-agent-notification-7.1.1~dev4-4.15.3 SUSE OpenStack Cloud 7:openstack-ceilometer-api-7.1.1~dev4-4.15.3 SUSE OpenStack Cloud 7:openstack-ceilometer-collector-7.1.1~dev4-4.15.3 SUSE OpenStack Cloud 7:openstack-ceilometer-doc-7.1.1~dev4-4.15.3 SUSE OpenStack Cloud 7:openstack-ceilometer-polling-7.1.1~dev4-4.15.3 SUSE OpenStack Cloud 7:openstack-heat-gbp-5.1.1~dev1-2.6.3 SUSE OpenStack Cloud 7:python-PyKMIP-0.5.0-3.3.3 SUSE OpenStack Cloud 7:python-ceilometer-7.1.1~dev4-4.15.3 SUSE OpenStack Cloud 7:python-heat-gbp-5.1.1~dev1-2.6.3 SUSE OpenStack Cloud 7:python-pysaml2-4.0.2-3.6.3 SUSE OpenStack Cloud 7:ruby2.1-rubygem-crowbar-client-3.9.0-7.14.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191450-1/ https://www.suse.com/security/cve/CVE-2018-1000872.html CVE-2018-1000872 https://bugzilla.suse.com/1120767 SUSE Bug 1120767