Security update for openstack-dashboard, release-notes-suse-openstack-cloud SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:0099-1 Final 1 1 2021-01-12T18:47:08Z current 2021-01-12T18:47:08Z 2021-01-12T18:47:08Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for openstack-dashboard, release-notes-suse-openstack-cloud This update for openstack-dashboard, release-notes-suse-openstack-cloud fixes the following issues: - Fix open redirect (OSSA-2020-008, CVE-2020-29565) - Fix horizon-nodejs jobs. - Add workaround for secure boot issue when shim package is updated. (bsc#1179955) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). HPE-Helion-OpenStack-8-2021-99,SUSE-2021-99,SUSE-OpenStack-Cloud-8-2021-99,SUSE-OpenStack-Cloud-Crowbar-8-2021-99 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20210099-1/ Link for SUSE-SU-2021:0099-1 https://lists.suse.com/pipermail/sle-security-updates/2021-January/008190.html E-Mail link for SUSE-SU-2021:0099-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1179955 SUSE Bug 1179955 https://www.suse.com/security/cve/CVE-2020-29565/ SUSE CVE CVE-2020-29565 page HPE Helion OpenStack 8 SUSE OpenStack Cloud 8 SUSE OpenStack Cloud Crowbar 8 openstack-dashboard-12.0.5~dev6-3.29.1 python-horizon-12.0.5~dev6-3.29.1 release-notes-hpe-helion-openstack-8.20201214-3.26.1 openstack-dashboard-test-12.0.5~dev6-3.29.1 release-notes-suse-openstack-cloud-8.20201214-3.26.1 openstack-dashboard-12.0.5~dev6-3.29.1 as a component of HPE Helion OpenStack 8 python-horizon-12.0.5~dev6-3.29.1 as a component of HPE Helion OpenStack 8 release-notes-hpe-helion-openstack-8.20201214-3.26.1 as a component of HPE Helion OpenStack 8 openstack-dashboard-12.0.5~dev6-3.29.1 as a component of SUSE OpenStack Cloud 8 python-horizon-12.0.5~dev6-3.29.1 as a component of SUSE OpenStack Cloud 8 release-notes-suse-openstack-cloud-8.20201214-3.26.1 as a component of SUSE OpenStack Cloud 8 openstack-dashboard-12.0.5~dev6-3.29.1 as a component of SUSE OpenStack Cloud Crowbar 8 python-horizon-12.0.5~dev6-3.29.1 as a component of SUSE OpenStack Cloud Crowbar 8 release-notes-suse-openstack-cloud-8.20201214-3.26.1 as a component of SUSE OpenStack Cloud Crowbar 8 An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL. CVE-2020-29565 HPE Helion OpenStack 8:openstack-dashboard-12.0.5~dev6-3.29.1 HPE Helion OpenStack 8:python-horizon-12.0.5~dev6-3.29.1 HPE Helion OpenStack 8:release-notes-hpe-helion-openstack-8.20201214-3.26.1 SUSE OpenStack Cloud 8:openstack-dashboard-12.0.5~dev6-3.29.1 SUSE OpenStack Cloud 8:python-horizon-12.0.5~dev6-3.29.1 SUSE OpenStack Cloud 8:release-notes-suse-openstack-cloud-8.20201214-3.26.1 SUSE OpenStack Cloud Crowbar 8:openstack-dashboard-12.0.5~dev6-3.29.1 SUSE OpenStack Cloud Crowbar 8:python-horizon-12.0.5~dev6-3.29.1 SUSE OpenStack Cloud Crowbar 8:release-notes-suse-openstack-cloud-8.20201214-3.26.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20210099-1/ https://www.suse.com/security/cve/CVE-2020-29565.html CVE-2020-29565 https://bugzilla.suse.com/1181019 SUSE Bug 1181019