Security update for storm SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:4096-1 Final 1 1 2021-12-15T10:31:48Z current 2021-12-15T10:31:48Z 2021-12-15T10:31:48Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for storm This update for storm fixes the following issues: - Remove JndiLookup from log4j 2.x jars during build to prevent 'log4shell' code injection. (bsc#1193641, bsc#1193611, CVE-2021-44228) - Remove JMSAppender from log4j 1.2.x jars during build to prevent attacks when JMS is enabled (bsc#1193641, bsc#1193662, CVE-2021-4104) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). HPE-Helion-OpenStack-8-2021-4096,SUSE-2021-4096,SUSE-OpenStack-Cloud-8-2021-4096,SUSE-OpenStack-Cloud-Crowbar-8-2021-4096 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20214096-1/ Link for SUSE-SU-2021:4096-1 https://lists.suse.com/pipermail/sle-security-updates/2021-December/009911.html E-Mail link for SUSE-SU-2021:4096-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1193611 SUSE Bug 1193611 https://bugzilla.suse.com/1193641 SUSE Bug 1193641 https://bugzilla.suse.com/1193662 SUSE Bug 1193662 https://www.suse.com/security/cve/CVE-2021-4104/ SUSE CVE CVE-2021-4104 page https://www.suse.com/security/cve/CVE-2021-44228/ SUSE CVE CVE-2021-44228 page HPE Helion OpenStack 8 SUSE OpenStack Cloud 8 SUSE OpenStack Cloud Crowbar 8 storm-1.2.3-3.8.2 storm-nimbus-1.2.3-3.8.2 storm-supervisor-1.2.3-3.8.2 venv-openstack-monasca-x86_64-2.2.2~dev1-11.32.1 storm-doc-1.2.3-3.8.2 storm-kit-1.2.3-3.10.1 storm-logviewer-1.2.3-3.8.2 storm-pacemaker-1.2.3-3.8.2 storm-ui-1.2.3-3.8.2 storm-zookeeper-1.2.3-3.8.2 venv-openstack-monasca-aarch64-2.2.2~dev1-11.32.1 venv-openstack-monasca-ppc64le-2.2.2~dev1-11.32.1 venv-openstack-monasca-s390x-2.2.2~dev1-11.32.1 storm-1.2.3-3.8.2 as a component of HPE Helion OpenStack 8 storm-nimbus-1.2.3-3.8.2 as a component of HPE Helion OpenStack 8 storm-supervisor-1.2.3-3.8.2 as a component of HPE Helion OpenStack 8 venv-openstack-monasca-x86_64-2.2.2~dev1-11.32.1 as a component of HPE Helion OpenStack 8 storm-1.2.3-3.8.2 as a component of SUSE OpenStack Cloud 8 storm-nimbus-1.2.3-3.8.2 as a component of SUSE OpenStack Cloud 8 storm-supervisor-1.2.3-3.8.2 as a component of SUSE OpenStack Cloud 8 venv-openstack-monasca-x86_64-2.2.2~dev1-11.32.1 as a component of SUSE OpenStack Cloud 8 storm-1.2.3-3.8.2 as a component of SUSE OpenStack Cloud Crowbar 8 storm-nimbus-1.2.3-3.8.2 as a component of SUSE OpenStack Cloud Crowbar 8 storm-supervisor-1.2.3-3.8.2 as a component of SUSE OpenStack Cloud Crowbar 8 JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions. CVE-2021-4104 HPE Helion OpenStack 8:storm-1.2.3-3.8.2 HPE Helion OpenStack 8:storm-nimbus-1.2.3-3.8.2 HPE Helion OpenStack 8:storm-supervisor-1.2.3-3.8.2 HPE Helion OpenStack 8:venv-openstack-monasca-x86_64-2.2.2~dev1-11.32.1 SUSE OpenStack Cloud 8:storm-1.2.3-3.8.2 SUSE OpenStack Cloud 8:storm-nimbus-1.2.3-3.8.2 SUSE OpenStack Cloud 8:storm-supervisor-1.2.3-3.8.2 SUSE OpenStack Cloud 8:venv-openstack-monasca-x86_64-2.2.2~dev1-11.32.1 SUSE OpenStack Cloud Crowbar 8:storm-1.2.3-3.8.2 SUSE OpenStack Cloud Crowbar 8:storm-nimbus-1.2.3-3.8.2 SUSE OpenStack Cloud Crowbar 8:storm-supervisor-1.2.3-3.8.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20214096-1/ https://www.suse.com/security/cve/CVE-2021-4104.html CVE-2021-4104 https://bugzilla.suse.com/1193662 SUSE Bug 1193662 https://bugzilla.suse.com/1193978 SUSE Bug 1193978 https://bugzilla.suse.com/1194016 SUSE Bug 1194016 https://bugzilla.suse.com/1194842 SUSE Bug 1194842 Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. CVE-2021-44228 HPE Helion OpenStack 8:storm-1.2.3-3.8.2 HPE Helion OpenStack 8:storm-nimbus-1.2.3-3.8.2 HPE Helion OpenStack 8:storm-supervisor-1.2.3-3.8.2 HPE Helion OpenStack 8:venv-openstack-monasca-x86_64-2.2.2~dev1-11.32.1 SUSE OpenStack Cloud 8:storm-1.2.3-3.8.2 SUSE OpenStack Cloud 8:storm-nimbus-1.2.3-3.8.2 SUSE OpenStack Cloud 8:storm-supervisor-1.2.3-3.8.2 SUSE OpenStack Cloud 8:venv-openstack-monasca-x86_64-2.2.2~dev1-11.32.1 SUSE OpenStack Cloud Crowbar 8:storm-1.2.3-3.8.2 SUSE OpenStack Cloud Crowbar 8:storm-nimbus-1.2.3-3.8.2 SUSE OpenStack Cloud Crowbar 8:storm-supervisor-1.2.3-3.8.2 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20214096-1/ https://www.suse.com/security/cve/CVE-2021-44228.html CVE-2021-44228 https://bugzilla.suse.com/1193611 SUSE Bug 1193611 https://bugzilla.suse.com/1193662 SUSE Bug 1193662 https://bugzilla.suse.com/1193743 SUSE Bug 1193743 https://bugzilla.suse.com/1193795 SUSE Bug 1193795 https://bugzilla.suse.com/1194016 SUSE Bug 1194016 https://bugzilla.suse.com/1194123 SUSE Bug 1194123 https://bugzilla.suse.com/1202994 SUSE Bug 1202994