Security update for crowbar-core, crowbar-openstack, openstack-horizon-plugin-monasca-ui, openstack-monasca-api, openstack-monasca-log-api, openstack-neutron, rubygem-puma, rubygem-rest-client SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:0081-1 Final 1 1 2020-01-13T09:38:16Z current 2020-01-13T09:38:16Z 2020-01-13T09:38:16Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for crowbar-core, crowbar-openstack, openstack-horizon-plugin-monasca-ui, openstack-monasca-api, openstack-monasca-log-api, openstack-neutron, rubygem-puma, rubygem-rest-client This update for crowbar-core, crowbar-openstack, openstack-horizon-plugin-monasca-ui, openstack-monasca-api, openstack-monasca-log-api, openstack-neutron, rubygem-puma, rubygem-rest-client contains the following fixes: Security issue fixed for rubygem-puma: - CVE-2019-16770: Fixed a potential denial of service in Puma's reactor (bsc#1158675, jsc#SOC-10999) Security issue fixed for rubygem-rest-client: - CVE-2015-3448: Fixed a plain text local password disclosure. (bsc#917802) Updates for crowbar-core: - Update to version 4.0+git.1574788924.e4a6aeb0c: * Allow pacemaker remotes for upgrade (SOC-10133) - Update to version 4.0+git.1574713660.972029d1a: * Ignore CVE-2019-13117 in CI builds (bsc#1157028) Updates for crowbar-openstack: - Update to version 4.0+git.1574869671.9c7bade2d: * tempest: configure Kibana version (SOC-10131) - Update to version 4.0+git.1574764112.c260c70e5: * horizon: install lbaas horizon dashboard (SOC-10883) Updates for openstack-horizon-plugin-monasca-ui: - Refresh allow-raw-grafana-links.patch - update to version 1.5.5~dev3 * Replace openstack.org git:// URLs with https:// * Fix the partial missing metrics in Create Alarm Definition flow * import zuul job settings from project-config * Fix incorrect splitting of dimension in ProxyView * Fix Alarm status Panel on Overview page * Change IntegerField to ChoiceField for notification period * Imported Translations from Zanata * Display unique metric names for alarm * Fix Alarm Details section in Alarm History view * Fix validators for creating and editing notifications * Center the text for the button Deterministic * Adding title to Filter Alarms pop-up * Fix misleading validation error * Fix nit found in monasca-ui * Fix Breadcrumbs * Fix description for name field * Fixing 'Create Alarm Definition' for IE11 * Imported Translations from Zanata Updates to openstack-monasca-api: - added fix-metric-name-offset.patch (SOC-10131) - removed 0001-Fix-InfluxDB-repository-list_dimension_values-to-sup.patch (merged upstream) - update to version 1.7.1~dev18 * Replace openstack.org git:// URLs with https:// * import zuul job settings from project-config * Upgrade Apache Storm to 1.0.6 * Zuul: Remove project name Updates to openstack-monasca-log-api: - added fix-tempest-region.patch (SOC-10131) - update to version 1.4.3~dev3 * Replace openstack.org git:// URLs with https:// * import zuul job settings from project-config * Avoid tox\_install.sh for constraints support Updates to openstack-neutron: - neutron: Remove stop action from ovs-cleanup (bsc#1157482) backport of https://review.opendev.org/#/c/695867/ The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-81,SUSE-OpenStack-Cloud-7-2020-81 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20200081-1/ Link for SUSE-SU-2020:0081-1 https://lists.suse.com/pipermail/sle-security-updates/2020-January/006330.html E-Mail link for SUSE-SU-2020:0081-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1157028 SUSE Bug 1157028 https://bugzilla.suse.com/1157482 SUSE Bug 1157482 https://bugzilla.suse.com/1158675 SUSE Bug 1158675 https://bugzilla.suse.com/917802 SUSE Bug 917802 https://www.suse.com/security/cve/CVE-2015-3448/ SUSE CVE CVE-2015-3448 page https://www.suse.com/security/cve/CVE-2019-13117/ SUSE CVE CVE-2019-13117 page https://www.suse.com/security/cve/CVE-2019-16770/ SUSE CVE CVE-2019-16770 page https://bugzilla.suse.com/SOC-10131 SUSE Bug SOC-10131 https://bugzilla.suse.com/SOC-10133 SUSE Bug SOC-10133 https://bugzilla.suse.com/SOC-10883 SUSE Bug SOC-10883 https://bugzilla.suse.com/SOC-10999 SUSE Bug SOC-10999 SUSE OpenStack Cloud 7 crowbar-core-4.0+git.1574788924.e4a6aeb0c-9.60.2 crowbar-core-branding-upstream-4.0+git.1574788924.e4a6aeb0c-9.60.2 crowbar-core-devel-4.0+git.1574788924.e4a6aeb0c-9.60.2 crowbar-openstack-4.0+git.1574869671.9c7bade2d-9.65.1 grafana-monasca-ui-drilldown-1.5.5~dev3-8.1 openstack-horizon-plugin-monasca-ui-1.5.5~dev3-8.1 openstack-monasca-api-1.7.1~dev18-12.1 openstack-monasca-log-api-1.4.3~dev3-5.1 openstack-neutron-9.4.2~dev21-7.38.1 openstack-neutron-dhcp-agent-9.4.2~dev21-7.38.1 openstack-neutron-doc-9.4.2~dev21-7.38.1 openstack-neutron-ha-tool-9.4.2~dev21-7.38.1 openstack-neutron-l3-agent-9.4.2~dev21-7.38.1 openstack-neutron-linuxbridge-agent-9.4.2~dev21-7.38.1 openstack-neutron-macvtap-agent-9.4.2~dev21-7.38.1 openstack-neutron-metadata-agent-9.4.2~dev21-7.38.1 openstack-neutron-metering-agent-9.4.2~dev21-7.38.1 openstack-neutron-openvswitch-agent-9.4.2~dev21-7.38.1 openstack-neutron-server-9.4.2~dev21-7.38.1 openstack-neutron-test-9.4.2~dev21-7.38.1 python-horizon-plugin-monasca-ui-1.5.5~dev3-8.1 python-monasca-api-1.7.1~dev18-12.1 python-monasca-log-api-1.4.3~dev3-5.1 python-neutron-9.4.2~dev21-7.38.1 ruby2.1-rubygem-puma-2.16.0-4.3.1 ruby2.1-rubygem-puma-doc-2.16.0-4.3.1 ruby2.1-rubygem-rest-client-1_6-1.6.7-3.3.1 ruby2.1-rubygem-rest-client-doc-1_6-1.6.7-3.3.1 ruby2.1-rubygem-rest-client-testsuite-1_6-1.6.7-3.3.1 crowbar-core-4.0+git.1574788924.e4a6aeb0c-9.60.2 as a component of SUSE OpenStack Cloud 7 crowbar-core-branding-upstream-4.0+git.1574788924.e4a6aeb0c-9.60.2 as a component of SUSE OpenStack Cloud 7 crowbar-openstack-4.0+git.1574869671.9c7bade2d-9.65.1 as a component of SUSE OpenStack Cloud 7 grafana-monasca-ui-drilldown-1.5.5~dev3-8.1 as a component of SUSE OpenStack Cloud 7 openstack-horizon-plugin-monasca-ui-1.5.5~dev3-8.1 as a component of SUSE OpenStack Cloud 7 openstack-monasca-api-1.7.1~dev18-12.1 as a component of SUSE OpenStack Cloud 7 openstack-monasca-log-api-1.4.3~dev3-5.1 as a component of SUSE OpenStack Cloud 7 openstack-neutron-9.4.2~dev21-7.38.1 as a component of SUSE OpenStack Cloud 7 openstack-neutron-dhcp-agent-9.4.2~dev21-7.38.1 as a component of SUSE OpenStack Cloud 7 openstack-neutron-doc-9.4.2~dev21-7.38.1 as a component of SUSE OpenStack Cloud 7 openstack-neutron-ha-tool-9.4.2~dev21-7.38.1 as a component of SUSE OpenStack Cloud 7 openstack-neutron-l3-agent-9.4.2~dev21-7.38.1 as a component of SUSE OpenStack Cloud 7 openstack-neutron-linuxbridge-agent-9.4.2~dev21-7.38.1 as a component of SUSE OpenStack Cloud 7 openstack-neutron-macvtap-agent-9.4.2~dev21-7.38.1 as a component of SUSE OpenStack Cloud 7 openstack-neutron-metadata-agent-9.4.2~dev21-7.38.1 as a component of SUSE OpenStack Cloud 7 openstack-neutron-metering-agent-9.4.2~dev21-7.38.1 as a component of SUSE OpenStack Cloud 7 openstack-neutron-openvswitch-agent-9.4.2~dev21-7.38.1 as a component of SUSE OpenStack Cloud 7 openstack-neutron-server-9.4.2~dev21-7.38.1 as a component of SUSE OpenStack Cloud 7 python-horizon-plugin-monasca-ui-1.5.5~dev3-8.1 as a component of SUSE OpenStack Cloud 7 python-monasca-api-1.7.1~dev18-12.1 as a component of SUSE OpenStack Cloud 7 python-monasca-log-api-1.4.3~dev3-5.1 as a component of SUSE OpenStack Cloud 7 python-neutron-9.4.2~dev21-7.38.1 as a component of SUSE OpenStack Cloud 7 ruby2.1-rubygem-puma-2.16.0-4.3.1 as a component of SUSE OpenStack Cloud 7 REST client for Ruby (aka rest-client) before 1.7.3 logs usernames and passwords, which allows local users to obtain sensitive information by reading the log. CVE-2015-3448 SUSE OpenStack Cloud 7:crowbar-core-4.0+git.1574788924.e4a6aeb0c-9.60.2 SUSE OpenStack Cloud 7:crowbar-core-branding-upstream-4.0+git.1574788924.e4a6aeb0c-9.60.2 SUSE OpenStack Cloud 7:crowbar-openstack-4.0+git.1574869671.9c7bade2d-9.65.1 SUSE OpenStack Cloud 7:grafana-monasca-ui-drilldown-1.5.5~dev3-8.1 SUSE OpenStack Cloud 7:openstack-horizon-plugin-monasca-ui-1.5.5~dev3-8.1 SUSE OpenStack Cloud 7:openstack-monasca-api-1.7.1~dev18-12.1 SUSE OpenStack Cloud 7:openstack-monasca-log-api-1.4.3~dev3-5.1 SUSE OpenStack Cloud 7:openstack-neutron-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:openstack-neutron-dhcp-agent-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:openstack-neutron-doc-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:openstack-neutron-ha-tool-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:openstack-neutron-l3-agent-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:openstack-neutron-linuxbridge-agent-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:openstack-neutron-macvtap-agent-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:openstack-neutron-metadata-agent-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:openstack-neutron-metering-agent-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:openstack-neutron-openvswitch-agent-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:openstack-neutron-server-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:python-horizon-plugin-monasca-ui-1.5.5~dev3-8.1 SUSE OpenStack Cloud 7:python-monasca-api-1.7.1~dev18-12.1 SUSE OpenStack Cloud 7:python-monasca-log-api-1.4.3~dev3-5.1 SUSE OpenStack Cloud 7:python-neutron-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-puma-2.16.0-4.3.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200081-1/ https://www.suse.com/security/cve/CVE-2015-3448.html CVE-2015-3448 https://bugzilla.suse.com/917802 SUSE Bug 917802 In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character. CVE-2019-13117 SUSE OpenStack Cloud 7:crowbar-core-4.0+git.1574788924.e4a6aeb0c-9.60.2 SUSE OpenStack Cloud 7:crowbar-core-branding-upstream-4.0+git.1574788924.e4a6aeb0c-9.60.2 SUSE OpenStack Cloud 7:crowbar-openstack-4.0+git.1574869671.9c7bade2d-9.65.1 SUSE OpenStack Cloud 7:grafana-monasca-ui-drilldown-1.5.5~dev3-8.1 SUSE OpenStack Cloud 7:openstack-horizon-plugin-monasca-ui-1.5.5~dev3-8.1 SUSE OpenStack Cloud 7:openstack-monasca-api-1.7.1~dev18-12.1 SUSE OpenStack Cloud 7:openstack-monasca-log-api-1.4.3~dev3-5.1 SUSE OpenStack Cloud 7:openstack-neutron-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:openstack-neutron-dhcp-agent-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:openstack-neutron-doc-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:openstack-neutron-ha-tool-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:openstack-neutron-l3-agent-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:openstack-neutron-linuxbridge-agent-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:openstack-neutron-macvtap-agent-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:openstack-neutron-metadata-agent-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:openstack-neutron-metering-agent-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:openstack-neutron-openvswitch-agent-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:openstack-neutron-server-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:python-horizon-plugin-monasca-ui-1.5.5~dev3-8.1 SUSE OpenStack Cloud 7:python-monasca-api-1.7.1~dev18-12.1 SUSE OpenStack Cloud 7:python-monasca-log-api-1.4.3~dev3-5.1 SUSE OpenStack Cloud 7:python-neutron-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-puma-2.16.0-4.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200081-1/ https://www.suse.com/security/cve/CVE-2019-13117.html CVE-2019-13117 https://bugzilla.suse.com/1140095 SUSE Bug 1140095 https://bugzilla.suse.com/1157028 SUSE Bug 1157028 https://bugzilla.suse.com/1160968 SUSE Bug 1160968 In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough. This vulnerability is patched in Puma 4.3.1 and 3.12.2. CVE-2019-16770 SUSE OpenStack Cloud 7:crowbar-core-4.0+git.1574788924.e4a6aeb0c-9.60.2 SUSE OpenStack Cloud 7:crowbar-core-branding-upstream-4.0+git.1574788924.e4a6aeb0c-9.60.2 SUSE OpenStack Cloud 7:crowbar-openstack-4.0+git.1574869671.9c7bade2d-9.65.1 SUSE OpenStack Cloud 7:grafana-monasca-ui-drilldown-1.5.5~dev3-8.1 SUSE OpenStack Cloud 7:openstack-horizon-plugin-monasca-ui-1.5.5~dev3-8.1 SUSE OpenStack Cloud 7:openstack-monasca-api-1.7.1~dev18-12.1 SUSE OpenStack Cloud 7:openstack-monasca-log-api-1.4.3~dev3-5.1 SUSE OpenStack Cloud 7:openstack-neutron-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:openstack-neutron-dhcp-agent-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:openstack-neutron-doc-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:openstack-neutron-ha-tool-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:openstack-neutron-l3-agent-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:openstack-neutron-linuxbridge-agent-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:openstack-neutron-macvtap-agent-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:openstack-neutron-metadata-agent-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:openstack-neutron-metering-agent-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:openstack-neutron-openvswitch-agent-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:openstack-neutron-server-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:python-horizon-plugin-monasca-ui-1.5.5~dev3-8.1 SUSE OpenStack Cloud 7:python-monasca-api-1.7.1~dev18-12.1 SUSE OpenStack Cloud 7:python-monasca-log-api-1.4.3~dev3-5.1 SUSE OpenStack Cloud 7:python-neutron-9.4.2~dev21-7.38.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-puma-2.16.0-4.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200081-1/ https://www.suse.com/security/cve/CVE-2019-16770.html CVE-2019-16770 https://bugzilla.suse.com/1158675 SUSE Bug 1158675 https://bugzilla.suse.com/1188527 SUSE Bug 1188527