Security update for crowbar-openstack, grafana, influxdb, python-urllib3 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:3624-1 Final 1 1 2020-12-04T11:50:23Z current 2020-12-04T11:50:23Z 2020-12-04T11:50:23Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for crowbar-openstack, grafana, influxdb, python-urllib3 This update for crowbar-openstack, grafana, influxdb, python-urllib3 contains the following fixes: Security fixes included in this update: openstack-glance - CVE-2016-8611: Added rate limiting for glance api (bnc#1005886) grafana - CVE-2020-24303: Fixed an XSS via a query alias for the ElasticSearch datasource (#bnc#1178243) influxdb - CVE-2019-20933: Fixed an authentication bypass (bnc#1178988) python-urlib3 - CVE-2019-9740: Fixed a CRLF injection in urllib3 (bnc#1129071). - CVE-2020-26137: Fixed a CRLF injection via HTTP request method (bnc#1177120) memcached - CVE-2018-1000115: Fixed a issue where a UDP server allowed spoofed traffic amplification DoS (bnc#1083903). Non-security fixes included in this update: Changes in crowbar-openstack: - Update to version 4.0+git.1604938545.30c10db18: * rabbitmq: Fix crm running check (SOC-11240) Changes in grafana: - Fix bnc#1178243 CVE-2020-24303 by adding 25401-Fix-XSS-vulnerability-with-series-overrides.patch Changes in influxdb: - Add CVE-2019-20933.patch (bnc#1178988, CVE-2019-20933) to fix authentication bypass_ - Declare license files correctly - Version 1.2.4: * The stress tool influx_stress will be removed in a subsequent release. * Remove the override of GOMAXPROCS. * Uncomment section headers from the default configuration file. * Improve write performance significantly. * Prune data in meta store for deleted shards. * Update latest dependencies with Godeps. * Introduce syntax for marking a partial response with chunking. * Use X-Forwarded-For IP address in HTTP logger if present. * Add support for secure transmission via collectd. * Switch logging to use structured logging everywhere. * [CLI feature request] USE retention policy for queries. * Add clear command to cli. * Adding ability to use parameters in queries in the v2 client using the Parameters map in the Query struct. * Allow add items to array config via ENV * Support subquery execution in the query language. * Verbose output for SSL connection errors. * Cache snapshotting performance improvements - Partially revert previous change to fix build for Leap Changes in python-urllib3: - Update urllib3-fix-test-urls.patch. Adjust to match upstream solution. - Add urllib3-fix-test-urls.patch. Fix tests failing on python checks for CVE-2019-9740. - Add urllib3-cve-2020-26137.patch. Don't allow control chars in request method. (bnc#1177120, CVE-2020-26137) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-3624,SUSE-OpenStack-Cloud-7-2020-3624 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20203624-1/ Link for SUSE-SU-2020:3624-1 https://lists.suse.com/pipermail/sle-security-updates/2020-December/007916.html E-Mail link for SUSE-SU-2020:3624-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1005886 SUSE Bug 1005886 https://bugzilla.suse.com/1170479 SUSE Bug 1170479 https://bugzilla.suse.com/1177120 SUSE Bug 1177120 https://bugzilla.suse.com/1178243 SUSE Bug 1178243 https://bugzilla.suse.com/1178988 SUSE Bug 1178988 https://www.suse.com/security/cve/CVE-2016-8611/ SUSE CVE CVE-2016-8611 page https://www.suse.com/security/cve/CVE-2019-20933/ SUSE CVE CVE-2019-20933 page https://www.suse.com/security/cve/CVE-2019-9740/ SUSE CVE CVE-2019-9740 page https://www.suse.com/security/cve/CVE-2020-24303/ SUSE CVE CVE-2020-24303 page https://www.suse.com/security/cve/CVE-2020-26137/ SUSE CVE CVE-2020-26137 page SUSE OpenStack Cloud 7 crowbar-openstack-4.0+git.1604938545.30c10db18-9.77.1 grafana-6.7.4-1.20.1 influxdb-1.2.4-5.1 influxdb-devel-1.2.4-5.1 python-urllib3-1.16-3.12.1 crowbar-openstack-4.0+git.1604938545.30c10db18-9.77.1 as a component of SUSE OpenStack Cloud 7 grafana-6.7.4-1.20.1 as a component of SUSE OpenStack Cloud 7 influxdb-1.2.4-5.1 as a component of SUSE OpenStack Cloud 7 python-urllib3-1.16-3.12.1 as a component of SUSE OpenStack Cloud 7 A vulnerability was found in Openstack Glance. No limits are enforced within the Glance image service for both v1 and v2 `/images` API POST method for authenticated users, resulting in possible denial of service attacks through database table saturation. CVE-2016-8611 SUSE OpenStack Cloud 7:crowbar-openstack-4.0+git.1604938545.30c10db18-9.77.1 SUSE OpenStack Cloud 7:grafana-6.7.4-1.20.1 SUSE OpenStack Cloud 7:influxdb-1.2.4-5.1 SUSE OpenStack Cloud 7:python-urllib3-1.16-3.12.1 low 4 AV:N/AC:L/Au:S/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20203624-1/ https://www.suse.com/security/cve/CVE-2016-8611.html CVE-2016-8611 https://bugzilla.suse.com/1005886 SUSE Bug 1005886 InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret). CVE-2019-20933 SUSE OpenStack Cloud 7:crowbar-openstack-4.0+git.1604938545.30c10db18-9.77.1 SUSE OpenStack Cloud 7:grafana-6.7.4-1.20.1 SUSE OpenStack Cloud 7:influxdb-1.2.4-5.1 SUSE OpenStack Cloud 7:python-urllib3-1.16-3.12.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20203624-1/ https://www.suse.com/security/cve/CVE-2019-20933.html CVE-2019-20933 https://bugzilla.suse.com/1178988 SUSE Bug 1178988 An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9. CVE-2019-9740 SUSE OpenStack Cloud 7:crowbar-openstack-4.0+git.1604938545.30c10db18-9.77.1 SUSE OpenStack Cloud 7:grafana-6.7.4-1.20.1 SUSE OpenStack Cloud 7:influxdb-1.2.4-5.1 SUSE OpenStack Cloud 7:python-urllib3-1.16-3.12.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20203624-1/ https://www.suse.com/security/cve/CVE-2019-9740.html CVE-2019-9740 https://bugzilla.suse.com/1129071 SUSE Bug 1129071 https://bugzilla.suse.com/1130840 SUSE Bug 1130840 https://bugzilla.suse.com/1132663 SUSE Bug 1132663 Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource. CVE-2020-24303 SUSE OpenStack Cloud 7:crowbar-openstack-4.0+git.1604938545.30c10db18-9.77.1 SUSE OpenStack Cloud 7:grafana-6.7.4-1.20.1 SUSE OpenStack Cloud 7:influxdb-1.2.4-5.1 SUSE OpenStack Cloud 7:python-urllib3-1.16-3.12.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20203624-1/ https://www.suse.com/security/cve/CVE-2020-24303.html CVE-2020-24303 https://bugzilla.suse.com/1178243 SUSE Bug 1178243 urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116. CVE-2020-26137 SUSE OpenStack Cloud 7:crowbar-openstack-4.0+git.1604938545.30c10db18-9.77.1 SUSE OpenStack Cloud 7:grafana-6.7.4-1.20.1 SUSE OpenStack Cloud 7:influxdb-1.2.4-5.1 SUSE OpenStack Cloud 7:python-urllib3-1.16-3.12.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20203624-1/ https://www.suse.com/security/cve/CVE-2020-26137.html CVE-2020-26137 https://bugzilla.suse.com/1177120 SUSE Bug 1177120 https://bugzilla.suse.com/1177211 SUSE Bug 1177211