Security update for crowbar-core, crowbar-openstack, openstack-neutron-fwaas, rubygem-crowbar-client SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:0311-1 Final 1 1 2020-02-03T17:18:32Z current 2020-02-03T17:18:32Z 2020-02-03T17:18:32Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for crowbar-core, crowbar-openstack, openstack-neutron-fwaas, rubygem-crowbar-client This update for crowbar-core, crowbar-openstack, openstack-neutron-fwaas, rubygem-crowbar-client contains the following fixes: Security fixes for rubygem-crowbar-client: - CVE-2018-17954: Fixed an issue where crowbar was leaking the secret admin passwords to all nodes (bsc#1117080) Changes in crowbar-core: - Update to version 4.0+git.1578392992.fabfd186c: * Avoid nil crash when provisioner attributes are not set (bsc#1160048) - Update to version 4.0+git.1578294389.acc7385d5: * Adding CVE-2019-16770 to the ignore list, regarding SOC-10999. Changes in crowbar-openstack: - Update to version 4.0+git.1579171175.d53ab6363: * tempest: tempest run filters as templates (SOC-11052) * Add tempest filters based on services (SOC-9801) Changes in openstack-neutron-fwaas: - Remove the patch that was deleting the tempest entry point and enable tempest tests. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-311,SUSE-OpenStack-Cloud-7-2020-311 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20200311-1/ Link for SUSE-SU-2020:0311-1 https://lists.suse.com/pipermail/sle-security-updates/2020-February/006446.html E-Mail link for SUSE-SU-2020:0311-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1117080 SUSE Bug 1117080 https://bugzilla.suse.com/1160048 SUSE Bug 1160048 https://www.suse.com/security/cve/CVE-2018-17954/ SUSE CVE CVE-2018-17954 page https://www.suse.com/security/cve/CVE-2019-16770/ SUSE CVE CVE-2019-16770 page SUSE OpenStack Cloud 7 crowbar-core-4.0+git.1578392992.fabfd186c-9.63.1 crowbar-core-branding-upstream-4.0+git.1578392992.fabfd186c-9.63.1 crowbar-core-devel-4.0+git.1578392992.fabfd186c-9.63.1 crowbar-openstack-4.0+git.1579171175.d53ab6363-9.68.1 openstack-neutron-fwaas-9.0.2~dev5-4.6.1 openstack-neutron-fwaas-doc-9.0.2~dev5-4.6.1 openstack-neutron-fwaas-test-9.0.2~dev5-4.6.1 python-neutron-fwaas-9.0.2~dev5-4.6.1 ruby2.1-rubygem-crowbar-client-3.9.1-7.17.1 ruby2.1-rubygem-crowbar-client-doc-3.9.1-7.17.1 ruby2.1-rubygem-crowbar-client-testsuite-3.9.1-7.17.1 crowbar-core-4.0+git.1578392992.fabfd186c-9.63.1 as a component of SUSE OpenStack Cloud 7 crowbar-core-branding-upstream-4.0+git.1578392992.fabfd186c-9.63.1 as a component of SUSE OpenStack Cloud 7 crowbar-openstack-4.0+git.1579171175.d53ab6363-9.68.1 as a component of SUSE OpenStack Cloud 7 openstack-neutron-fwaas-9.0.2~dev5-4.6.1 as a component of SUSE OpenStack Cloud 7 openstack-neutron-fwaas-doc-9.0.2~dev5-4.6.1 as a component of SUSE OpenStack Cloud 7 python-neutron-fwaas-9.0.2~dev5-4.6.1 as a component of SUSE OpenStack Cloud 7 ruby2.1-rubygem-crowbar-client-3.9.1-7.17.1 as a component of SUSE OpenStack Cloud 7 An Improper Privilege Management in crowbar of SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud 9, SUSE OpenStack Cloud Crowbar 8, SUSE OpenStack Cloud Crowbar 9 allows root users on any crowbar managed node to cause become root on any other node. This issue affects: SUSE OpenStack Cloud 7 crowbar-core versions prior to 4.0+git.1578392992.fabfd186c-9.63.1, crowbar-. SUSE OpenStack Cloud 8 ardana-cinder versions prior to 8.0+git.1579279939.ee7da88-3.39.3, ardana-. SUSE OpenStack Cloud 9 ardana-ansible versions prior to 9.0+git.1581611758.f694f7d-3.16.1, ardana-. SUSE OpenStack Cloud Crowbar 8 crowbar-core versions prior to 5.0+git.1582968668.1a55c77c5-3.35.4, crowbar-. SUSE OpenStack Cloud Crowbar 9 crowbar-core versions prior to 6.0+git.1582892022.cbd70e833-3.19.3, crowbar-. CVE-2018-17954 SUSE OpenStack Cloud 7:crowbar-core-4.0+git.1578392992.fabfd186c-9.63.1 SUSE OpenStack Cloud 7:crowbar-core-branding-upstream-4.0+git.1578392992.fabfd186c-9.63.1 SUSE OpenStack Cloud 7:crowbar-openstack-4.0+git.1579171175.d53ab6363-9.68.1 SUSE OpenStack Cloud 7:openstack-neutron-fwaas-9.0.2~dev5-4.6.1 SUSE OpenStack Cloud 7:openstack-neutron-fwaas-doc-9.0.2~dev5-4.6.1 SUSE OpenStack Cloud 7:python-neutron-fwaas-9.0.2~dev5-4.6.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-crowbar-client-3.9.1-7.17.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200311-1/ https://www.suse.com/security/cve/CVE-2018-17954.html CVE-2018-17954 https://bugzilla.suse.com/1117080 SUSE Bug 1117080 In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough. This vulnerability is patched in Puma 4.3.1 and 3.12.2. CVE-2019-16770 SUSE OpenStack Cloud 7:crowbar-core-4.0+git.1578392992.fabfd186c-9.63.1 SUSE OpenStack Cloud 7:crowbar-core-branding-upstream-4.0+git.1578392992.fabfd186c-9.63.1 SUSE OpenStack Cloud 7:crowbar-openstack-4.0+git.1579171175.d53ab6363-9.68.1 SUSE OpenStack Cloud 7:openstack-neutron-fwaas-9.0.2~dev5-4.6.1 SUSE OpenStack Cloud 7:openstack-neutron-fwaas-doc-9.0.2~dev5-4.6.1 SUSE OpenStack Cloud 7:python-neutron-fwaas-9.0.2~dev5-4.6.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-crowbar-client-3.9.1-7.17.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200311-1/ https://www.suse.com/security/cve/CVE-2019-16770.html CVE-2019-16770 https://bugzilla.suse.com/1158675 SUSE Bug 1158675 https://bugzilla.suse.com/1188527 SUSE Bug 1188527