Security update for fence-agents SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:1813-1 Final 1 1 2019-07-10T15:42:10Z current 2019-07-10T15:42:10Z 2019-07-10T15:42:10Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for fence-agents This update for fence-agents version 4.4.0 fixes the following issues: Security issue fixed: - CVE-2019-10153: Fixed a denial of service via guest VM comments (bsc#1137314). Non-security issue fixed: - Included timestamps when logging (bsc#1049852). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES15-SAP-Azure-2019-1813,Image SLES15-SAP-Azure-BYOS-2019-1813,Image SLES15-SAP-Azure-LI-BYOS-Production-2019-1813,Image SLES15-SAP-Azure-VLI-BYOS-Production-2019-1813,Image SLES15-SAP-EC2-HVM-2019-1813,Image SLES15-SAP-EC2-HVM-BYOS-2019-1813,Image SLES15-SAP-GCE-2019-1813,Image SLES15-SAP-GCE-BYOS-2019-1813,Image SLES15-SAP-OCI-BYOS-2019-1813,SUSE-2019-1813,SUSE-SLE-Product-HA-15-2019-1813 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20191813-1/ Link for SUSE-SU-2019:1813-1 https://lists.suse.com/pipermail/sle-security-updates/2019-July/005690.html E-Mail link for SUSE-SU-2019:1813-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1049852 SUSE Bug 1049852 https://bugzilla.suse.com/1137314 SUSE Bug 1137314 https://www.suse.com/security/cve/CVE-2019-10153/ SUSE CVE CVE-2019-10153 page Image SLES15-SAP-Azure Image SLES15-SAP-Azure-BYOS Image SLES15-SAP-Azure-LI-BYOS-Production Image SLES15-SAP-Azure-VLI-BYOS-Production Image SLES15-SAP-EC2-HVM Image SLES15-SAP-EC2-HVM-BYOS Image SLES15-SAP-GCE Image SLES15-SAP-GCE-BYOS Image SLES15-SAP-OCI-BYOS SUSE Linux Enterprise High Availability Extension 15 fence-agents-4.4.0+git.1558595666.5f79f9e9-4.6.1 fence-agents-amt_ws-4.4.0+git.1558595666.5f79f9e9-4.6.1 fence-agents-devel-4.4.0+git.1558595666.5f79f9e9-4.6.1 fence-agents-4.4.0+git.1558595666.5f79f9e9-4.6.1 as a component of Image SLES15-SAP-Azure fence-agents-4.4.0+git.1558595666.5f79f9e9-4.6.1 as a component of Image SLES15-SAP-Azure-BYOS fence-agents-4.4.0+git.1558595666.5f79f9e9-4.6.1 as a component of Image SLES15-SAP-Azure-LI-BYOS-Production fence-agents-4.4.0+git.1558595666.5f79f9e9-4.6.1 as a component of Image SLES15-SAP-Azure-VLI-BYOS-Production fence-agents-4.4.0+git.1558595666.5f79f9e9-4.6.1 as a component of Image SLES15-SAP-EC2-HVM fence-agents-4.4.0+git.1558595666.5f79f9e9-4.6.1 as a component of Image SLES15-SAP-EC2-HVM-BYOS fence-agents-4.4.0+git.1558595666.5f79f9e9-4.6.1 as a component of Image SLES15-SAP-GCE fence-agents-4.4.0+git.1558595666.5f79f9e9-4.6.1 as a component of Image SLES15-SAP-GCE-BYOS fence-agents-4.4.0+git.1558595666.5f79f9e9-4.6.1 as a component of Image SLES15-SAP-OCI-BYOS fence-agents-4.4.0+git.1558595666.5f79f9e9-4.6.1 as a component of SUSE Linux Enterprise High Availability Extension 15 fence-agents-devel-4.4.0+git.1558595666.5f79f9e9-4.6.1 as a component of SUSE Linux Enterprise High Availability Extension 15 A flaw was discovered in fence-agents, prior to version 4.3.4, where using non-ASCII characters in a guest VM's comment or other fields would cause fence_rhevm to exit with an exception. In cluster environments, this could lead to preventing automated recovery or otherwise denying service to clusters of which that VM is a member. CVE-2019-10153 Image SLES15-SAP-Azure-BYOS:fence-agents-4.4.0+git.1558595666.5f79f9e9-4.6.1 Image SLES15-SAP-Azure-LI-BYOS-Production:fence-agents-4.4.0+git.1558595666.5f79f9e9-4.6.1 Image SLES15-SAP-Azure-VLI-BYOS-Production:fence-agents-4.4.0+git.1558595666.5f79f9e9-4.6.1 Image SLES15-SAP-Azure:fence-agents-4.4.0+git.1558595666.5f79f9e9-4.6.1 Image SLES15-SAP-EC2-HVM-BYOS:fence-agents-4.4.0+git.1558595666.5f79f9e9-4.6.1 Image SLES15-SAP-EC2-HVM:fence-agents-4.4.0+git.1558595666.5f79f9e9-4.6.1 Image SLES15-SAP-GCE-BYOS:fence-agents-4.4.0+git.1558595666.5f79f9e9-4.6.1 Image SLES15-SAP-GCE:fence-agents-4.4.0+git.1558595666.5f79f9e9-4.6.1 Image SLES15-SAP-OCI-BYOS:fence-agents-4.4.0+git.1558595666.5f79f9e9-4.6.1 SUSE Linux Enterprise High Availability Extension 15:fence-agents-4.4.0+git.1558595666.5f79f9e9-4.6.1 SUSE Linux Enterprise High Availability Extension 15:fence-agents-devel-4.4.0+git.1558595666.5f79f9e9-4.6.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191813-1/ https://www.suse.com/security/cve/CVE-2019-10153.html CVE-2019-10153 https://bugzilla.suse.com/1137314 SUSE Bug 1137314