Security update for crowbar-openstack, grafana, kibana, monasca-installer, python-Django, python-py, rubygem-activerecord-session_store SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:1963-1 Final 1 1 2021-06-11T13:14:14Z current 2021-06-11T13:14:14Z 2021-06-11T13:14:14Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for crowbar-openstack, grafana, kibana, monasca-installer, python-Django, python-py, rubygem-activerecord-session_store This update for crowbar-openstack, grafana, kibana, monasca-installer, python-Django, python-py, rubygem-activerecord-session_store contains the following fixes: Security fixes included in this update: crowbar-openstack: - CVE-2016-8611: Added rate limiting for the '/images' API POST method (bsc#1005886). grafana: - CVE-2021-27358: Fixed a denial of service via remote API call (bsc#1183803) kibana: - CVE-2017-11499: Fixed a vulnerability in nodejs, related to the HashTable implementation, which could cause a denial of service (bsc#1044849) - CVE-2017-11481: Fixed a cross site scripting vulnerability via via URL fields (bsc#1044849) python-Django: - CVE-2021-3281: Fixed a directory traversal via archive.extract() (bsc#1181379) - CVE-2021-28658: Fixed a directory traversal via uploaded files (bsc#1184148) - CVE-2021-31542: Fixed a directory traversal via uploaded files with suitably crafted file names (bsc#1185623) - CVE-2021-33203:Fixed potential path-traversal via admindocs' TemplateDetailView (bsc#1186608) - CVE-2021-33571: Tighten validator checks to not allow leading zeros in IPv4 addresses, which potentially leads to further attacks (bsc#1186611) python-py: - CVE-2020-29651: Fixed a denial of service via regular expressions (bsc#1179805) rubygem-activerecord-session_store: - CVE-2019-25025: Fixed a timing attacks targeting the session id which could allow an attack to hijack sessions (bsc#1183174) Non-security fixes included in this update: Changes in crowbar-openstack: - Update to version 4.0+git.1616146720.44daffca0: * monasca: restart Kibana on update (bsc#1044849) Changes in grafana_Update: - Add CVE-2021-27358.patch (bsc#1183803, CVE-2021-27358) * Prevent unauthenticated remote attackers from causing a DoS through the snapshots API. Changes in kibana_Update: - Ensure /etc/sysconfig/kibana is present - Update to Kibana 4.6.6 (bsc#1044849, CVE-2017-11499, ESA-2017-14, ESA-2017-16) * [4.6] ignore forked code for babel transpile build phase (#13483) * Allow more than match queries in custom filters (#8614) (#10857) * [state] don't make extra $location.replace() calls (#9954) * [optimizer] move to querystring-browser package for up-to-date api * [state/unhashUrl] use encode-uri-query to generate cleanly encoded urls * server: refactor log_interceptor to be more DRY (#9617) * server: downgrade ECANCELED logs to debug (#9616) * server: do not treat logged warnings as errors (#8746) (#9610) * [server/logger] downgrade EPIPE errors to debug level (#9023) * Add basepath when redirecting from a trailling slash (#9035) * [es/kibanaIndex] use unmapped_type rather than ignore_unmapped (#8968) * [server/shortUrl] validate urls before shortening them - Add CVE-2017-11481.patch (bsc#1044849, CVE-2017-11481) * This fixes an XSS vulnerability in URL fields - Remove %dir declaration from /opt/kibana/optimize to ensure no files owned by root end up in there - Exclude /opt/kibana/optimize from %fdupes - Restart service on upgrade - Do not copy LICENSE.txt and README.txt to /opt/kibana - Fix rpmlint warnings/errors - Switch to explicit patch application - Fix source URL - Fix logic for systemd/systemv detection Changes in monasca-installer_Update: - Add support-influxdb-1.2.patch (SOC-11435) Changes in python-Django_Update: - Fixed potential path-traversal via admindocs' TemplateDetailView.(bsc#1186608, CVE-2021-33203) - Prevented leading zeros in IPv4 addresses. (bsc#1186611, CVE-2021-33571) - Add delegate-os-path-filename-generation-to-storage.patch (bsc#1185623) * Needed for CVE-2021-31542.patch to apply - Tightened path & file name sanitation in file uploads. (bsc#1185623, CVE-2021-31542) - Fixed potential directory-traversal via uploaded files. (bsc#1184148, CVE-2021-28658) - Fixes a potential directory traversal when extracting archives. (bsc#1181379, CVE-2021-3281) Changes in python-py_Update: - Add CVE-2020-29651.patch (CVE-2020-29651, bsc#1179805) * svnwc: fix regular expression vulnerable to DoS in blame functionality - Ensure /usr/share/licenses exists Changes in rubygem-activerecord-session_store_Update: - added CVE-2019-25025.patch (CVE-2019-25025, bsc#1183174) * This requires CVE-2019-16782.patch to be included in rubygem-actionpack-4_2 to work correctly. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2021-1963,SUSE-OpenStack-Cloud-7-2021-1963 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20211963-1/ Link for SUSE-SU-2021:1963-1 https://lists.suse.com/pipermail/sle-security-updates/2021-June/008999.html E-Mail link for SUSE-SU-2021:1963-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1044849 SUSE Bug 1044849 https://bugzilla.suse.com/1179805 SUSE Bug 1179805 https://bugzilla.suse.com/1181379 SUSE Bug 1181379 https://bugzilla.suse.com/1183803 SUSE Bug 1183803 https://bugzilla.suse.com/1184148 SUSE Bug 1184148 https://bugzilla.suse.com/1185623 SUSE Bug 1185623 https://bugzilla.suse.com/1186608 SUSE Bug 1186608 https://bugzilla.suse.com/1186611 SUSE Bug 1186611 https://www.suse.com/security/cve/CVE-2017-11481/ SUSE CVE CVE-2017-11481 page https://www.suse.com/security/cve/CVE-2017-11499/ SUSE CVE CVE-2017-11499 page https://www.suse.com/security/cve/CVE-2019-25025/ SUSE CVE CVE-2019-25025 page https://www.suse.com/security/cve/CVE-2020-29651/ SUSE CVE CVE-2020-29651 page https://www.suse.com/security/cve/CVE-2021-27358/ SUSE CVE CVE-2021-27358 page https://www.suse.com/security/cve/CVE-2021-28658/ SUSE CVE CVE-2021-28658 page https://www.suse.com/security/cve/CVE-2021-31542/ SUSE CVE CVE-2021-31542 page https://www.suse.com/security/cve/CVE-2021-3281/ SUSE CVE CVE-2021-3281 page https://www.suse.com/security/cve/CVE-2021-33203/ SUSE CVE CVE-2021-33203 page https://www.suse.com/security/cve/CVE-2021-33571/ SUSE CVE CVE-2021-33571 page SUSE OpenStack Cloud 7 crowbar-openstack-4.0+git.1616146720.44daffca0-9.81.2 grafana-6.7.4-1.24.2 kibana-4.6.6-9.2 monasca-installer-20180608_12.47-16.2 python-Django-1.8.19-3.29.1 python-py-1.8.1-11.16.2 python3-py-1.8.1-11.16.2 ruby2.1-rubygem-activerecord-session_store-0.1.2-3.4.2 ruby2.1-rubygem-activerecord-session_store-doc-0.1.2-3.4.2 crowbar-openstack-4.0+git.1616146720.44daffca0-9.81.2 as a component of SUSE OpenStack Cloud 7 grafana-6.7.4-1.24.2 as a component of SUSE OpenStack Cloud 7 kibana-4.6.6-9.2 as a component of SUSE OpenStack Cloud 7 monasca-installer-20180608_12.47-16.2 as a component of SUSE OpenStack Cloud 7 python-Django-1.8.19-3.29.1 as a component of SUSE OpenStack Cloud 7 python-py-1.8.1-11.16.2 as a component of SUSE OpenStack Cloud 7 ruby2.1-rubygem-activerecord-session_store-0.1.2-3.4.2 as a component of SUSE OpenStack Cloud 7 Kibana versions prior to 6.0.1 and 5.6.5 had a cross-site scripting (XSS) vulnerability via URL fields that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users. CVE-2017-11481 SUSE OpenStack Cloud 7:crowbar-openstack-4.0+git.1616146720.44daffca0-9.81.2 SUSE OpenStack Cloud 7:grafana-6.7.4-1.24.2 SUSE OpenStack Cloud 7:kibana-4.6.6-9.2 SUSE OpenStack Cloud 7:monasca-installer-20180608_12.47-16.2 SUSE OpenStack Cloud 7:python-Django-1.8.19-3.29.1 SUSE OpenStack Cloud 7:python-py-1.8.1-11.16.2 SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-session_store-0.1.2-3.4.2 moderate 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211963-1/ https://www.suse.com/security/cve/CVE-2017-11481.html CVE-2017-11481 https://bugzilla.suse.com/1044849 SUSE Bug 1044849 https://bugzilla.suse.com/1072315 SUSE Bug 1072315 Node.js v4.0 through v4.8.3, all versions of v5.x, v6.0 through v6.11.0, v7.0 through v7.10.0, and v8.0 through v8.1.3 was susceptible to hash flooding remote DoS attacks as the HashTable seed was constant across a given released version of Node.js. This was a result of building with V8 snapshots enabled by default which caused the initially randomized seed to be overwritten on startup. CVE-2017-11499 SUSE OpenStack Cloud 7:crowbar-openstack-4.0+git.1616146720.44daffca0-9.81.2 SUSE OpenStack Cloud 7:grafana-6.7.4-1.24.2 SUSE OpenStack Cloud 7:kibana-4.6.6-9.2 SUSE OpenStack Cloud 7:monasca-installer-20180608_12.47-16.2 SUSE OpenStack Cloud 7:python-Django-1.8.19-3.29.1 SUSE OpenStack Cloud 7:python-py-1.8.1-11.16.2 SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-session_store-0.1.2-3.4.2 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211963-1/ https://www.suse.com/security/cve/CVE-2017-11499.html CVE-2017-11499 https://bugzilla.suse.com/1044849 SUSE Bug 1044849 https://bugzilla.suse.com/1048299 SUSE Bug 1048299 https://bugzilla.suse.com/1051117 SUSE Bug 1051117 The activerecord-session_store (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a correct guess in a relatively short amount of time. This is a related issue to CVE-2019-16782. CVE-2019-25025 SUSE OpenStack Cloud 7:crowbar-openstack-4.0+git.1616146720.44daffca0-9.81.2 SUSE OpenStack Cloud 7:grafana-6.7.4-1.24.2 SUSE OpenStack Cloud 7:kibana-4.6.6-9.2 SUSE OpenStack Cloud 7:monasca-installer-20180608_12.47-16.2 SUSE OpenStack Cloud 7:python-Django-1.8.19-3.29.1 SUSE OpenStack Cloud 7:python-py-1.8.1-11.16.2 SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-session_store-0.1.2-3.4.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211963-1/ https://www.suse.com/security/cve/CVE-2019-25025.html CVE-2019-25025 https://bugzilla.suse.com/1159548 SUSE Bug 1159548 https://bugzilla.suse.com/1183174 SUSE Bug 1183174 A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through 1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious input to the blame functionality. CVE-2020-29651 SUSE OpenStack Cloud 7:crowbar-openstack-4.0+git.1616146720.44daffca0-9.81.2 SUSE OpenStack Cloud 7:grafana-6.7.4-1.24.2 SUSE OpenStack Cloud 7:kibana-4.6.6-9.2 SUSE OpenStack Cloud 7:monasca-installer-20180608_12.47-16.2 SUSE OpenStack Cloud 7:python-Django-1.8.19-3.29.1 SUSE OpenStack Cloud 7:python-py-1.8.1-11.16.2 SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-session_store-0.1.2-3.4.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211963-1/ https://www.suse.com/security/cve/CVE-2020-29651.html CVE-2020-29651 https://bugzilla.suse.com/1179805 SUSE Bug 1179805 The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set. CVE-2021-27358 SUSE OpenStack Cloud 7:crowbar-openstack-4.0+git.1616146720.44daffca0-9.81.2 SUSE OpenStack Cloud 7:grafana-6.7.4-1.24.2 SUSE OpenStack Cloud 7:kibana-4.6.6-9.2 SUSE OpenStack Cloud 7:monasca-installer-20180608_12.47-16.2 SUSE OpenStack Cloud 7:python-Django-1.8.19-3.29.1 SUSE OpenStack Cloud 7:python-py-1.8.1-11.16.2 SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-session_store-0.1.2-3.4.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211963-1/ https://www.suse.com/security/cve/CVE-2021-27358.html CVE-2021-27358 https://bugzilla.suse.com/1183803 SUSE Bug 1183803 In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability. CVE-2021-28658 SUSE OpenStack Cloud 7:crowbar-openstack-4.0+git.1616146720.44daffca0-9.81.2 SUSE OpenStack Cloud 7:grafana-6.7.4-1.24.2 SUSE OpenStack Cloud 7:kibana-4.6.6-9.2 SUSE OpenStack Cloud 7:monasca-installer-20180608_12.47-16.2 SUSE OpenStack Cloud 7:python-Django-1.8.19-3.29.1 SUSE OpenStack Cloud 7:python-py-1.8.1-11.16.2 SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-session_store-0.1.2-3.4.2 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211963-1/ https://www.suse.com/security/cve/CVE-2021-28658.html CVE-2021-28658 https://bugzilla.suse.com/1184148 SUSE Bug 1184148 In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names. CVE-2021-31542 SUSE OpenStack Cloud 7:crowbar-openstack-4.0+git.1616146720.44daffca0-9.81.2 SUSE OpenStack Cloud 7:grafana-6.7.4-1.24.2 SUSE OpenStack Cloud 7:kibana-4.6.6-9.2 SUSE OpenStack Cloud 7:monasca-installer-20180608_12.47-16.2 SUSE OpenStack Cloud 7:python-Django-1.8.19-3.29.1 SUSE OpenStack Cloud 7:python-py-1.8.1-11.16.2 SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-session_store-0.1.2-3.4.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211963-1/ https://www.suse.com/security/cve/CVE-2021-31542.html CVE-2021-31542 https://bugzilla.suse.com/1185623 SUSE Bug 1185623 In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments. CVE-2021-3281 SUSE OpenStack Cloud 7:crowbar-openstack-4.0+git.1616146720.44daffca0-9.81.2 SUSE OpenStack Cloud 7:grafana-6.7.4-1.24.2 SUSE OpenStack Cloud 7:kibana-4.6.6-9.2 SUSE OpenStack Cloud 7:monasca-installer-20180608_12.47-16.2 SUSE OpenStack Cloud 7:python-Django-1.8.19-3.29.1 SUSE OpenStack Cloud 7:python-py-1.8.1-11.16.2 SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-session_store-0.1.2-3.4.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211963-1/ https://www.suse.com/security/cve/CVE-2021-3281.html CVE-2021-3281 https://bugzilla.suse.com/1181379 SUSE Bug 1181379 Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories. CVE-2021-33203 SUSE OpenStack Cloud 7:crowbar-openstack-4.0+git.1616146720.44daffca0-9.81.2 SUSE OpenStack Cloud 7:grafana-6.7.4-1.24.2 SUSE OpenStack Cloud 7:kibana-4.6.6-9.2 SUSE OpenStack Cloud 7:monasca-installer-20180608_12.47-16.2 SUSE OpenStack Cloud 7:python-Django-1.8.19-3.29.1 SUSE OpenStack Cloud 7:python-py-1.8.1-11.16.2 SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-session_store-0.1.2-3.4.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211963-1/ https://www.suse.com/security/cve/CVE-2021-33203.html CVE-2021-33203 https://bugzilla.suse.com/1186608 SUSE Bug 1186608 In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validate_ipv4_address and validate_ipv46_address are unaffected with Python 3.9.5+..) . CVE-2021-33571 SUSE OpenStack Cloud 7:crowbar-openstack-4.0+git.1616146720.44daffca0-9.81.2 SUSE OpenStack Cloud 7:grafana-6.7.4-1.24.2 SUSE OpenStack Cloud 7:kibana-4.6.6-9.2 SUSE OpenStack Cloud 7:monasca-installer-20180608_12.47-16.2 SUSE OpenStack Cloud 7:python-Django-1.8.19-3.29.1 SUSE OpenStack Cloud 7:python-py-1.8.1-11.16.2 SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-session_store-0.1.2-3.4.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211963-1/ https://www.suse.com/security/cve/CVE-2021-33571.html CVE-2021-33571 https://bugzilla.suse.com/1186611 SUSE Bug 1186611