Security update for documentation-suse-openstack-cloud, kibana, openstack-keystone, openstack-monasca-notification SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:1654-1 Final 1 1 2022-05-12T15:16:00Z current 2022-05-12T15:16:00Z 2022-05-12T15:16:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for documentation-suse-openstack-cloud, kibana, openstack-keystone, openstack-monasca-notification This update for documentation-suse-openstack-cloud, kibana, openstack-keystone, openstack-monasca-notification fixes the following issues: - CVE-2021-22141: Fixed URL redirection flaw (bsc#1186868). - CVE-2021-38155: Fixed information disclosure during account locking (bsc#1189390). The following non-security bugs were fixed: - Fix smtp server authentication (bsc#1197204) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). HPE-Helion-OpenStack-8-2022-1654,SUSE-2022-1654,SUSE-OpenStack-Cloud-8-2022-1654,SUSE-OpenStack-Cloud-Crowbar-8-2022-1654 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20221654-1/ Link for SUSE-SU-2022:1654-1 https://lists.suse.com/pipermail/sle-security-updates/2022-May/010996.html E-Mail link for SUSE-SU-2022:1654-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1186868 SUSE Bug 1186868 https://bugzilla.suse.com/1189390 SUSE Bug 1189390 https://bugzilla.suse.com/1197204 SUSE Bug 1197204 https://www.suse.com/security/cve/CVE-2021-22141/ SUSE CVE CVE-2021-22141 page https://www.suse.com/security/cve/CVE-2021-38155/ SUSE CVE CVE-2021-38155 page HPE Helion OpenStack 8 SUSE OpenStack Cloud 8 SUSE OpenStack Cloud Crowbar 8 documentation-hpe-helion-openstack-installation-8.20211112-1.38.1 documentation-hpe-helion-openstack-operations-8.20211112-1.38.1 documentation-hpe-helion-openstack-opsconsole-8.20211112-1.38.1 documentation-hpe-helion-openstack-planning-8.20211112-1.38.1 documentation-hpe-helion-openstack-security-8.20211112-1.38.1 documentation-hpe-helion-openstack-user-8.20211112-1.38.1 kibana-4.6.6-3.12.1 openstack-keystone-12.0.4~dev11-5.36.1 openstack-keystone-doc-12.0.4~dev11-5.36.1 openstack-monasca-notification-1.10.2~dev4-3.9.1 python-keystone-12.0.4~dev11-5.36.1 python-monasca-notification-1.10.2~dev4-3.9.1 venv-openstack-keystone-x86_64-12.0.4~dev11-11.45.1 venv-openstack-monasca-x86_64-2.2.2~dev1-11.45.1 documentation-suse-openstack-cloud-deployment-8.20211112-1.38.1 documentation-suse-openstack-cloud-installation-8.20211112-1.38.1 documentation-suse-openstack-cloud-operations-8.20211112-1.38.1 documentation-suse-openstack-cloud-opsconsole-8.20211112-1.38.1 documentation-suse-openstack-cloud-planning-8.20211112-1.38.1 documentation-suse-openstack-cloud-security-8.20211112-1.38.1 documentation-suse-openstack-cloud-socmmsoperator-8.20211112-1.38.1 documentation-suse-openstack-cloud-socmosoperator-8.20211112-1.38.1 documentation-suse-openstack-cloud-socmoverview-8.20211112-1.38.1 documentation-suse-openstack-cloud-supplement-8.20211112-1.38.1 documentation-suse-openstack-cloud-upstream-admin-8.20211112-1.38.1 documentation-suse-openstack-cloud-upstream-user-8.20211112-1.38.1 documentation-suse-openstack-cloud-user-8.20211112-1.38.1 openstack-keystone-test-12.0.4~dev11-5.36.1 venv-openstack-keystone-aarch64-12.0.4~dev11-11.45.1 venv-openstack-keystone-ppc64le-12.0.4~dev11-11.45.1 venv-openstack-keystone-s390x-12.0.4~dev11-11.45.1 venv-openstack-monasca-aarch64-2.2.2~dev1-11.45.1 venv-openstack-monasca-ppc64le-2.2.2~dev1-11.45.1 venv-openstack-monasca-s390x-2.2.2~dev1-11.45.1 documentation-hpe-helion-openstack-installation-8.20211112-1.38.1 as a component of HPE Helion OpenStack 8 documentation-hpe-helion-openstack-operations-8.20211112-1.38.1 as a component of HPE Helion OpenStack 8 documentation-hpe-helion-openstack-opsconsole-8.20211112-1.38.1 as a component of HPE Helion OpenStack 8 documentation-hpe-helion-openstack-planning-8.20211112-1.38.1 as a component of HPE Helion OpenStack 8 documentation-hpe-helion-openstack-security-8.20211112-1.38.1 as a component of HPE Helion OpenStack 8 documentation-hpe-helion-openstack-user-8.20211112-1.38.1 as a component of HPE Helion OpenStack 8 kibana-4.6.6-3.12.1 as a component of HPE Helion OpenStack 8 openstack-keystone-12.0.4~dev11-5.36.1 as a component of HPE Helion OpenStack 8 openstack-keystone-doc-12.0.4~dev11-5.36.1 as a component of HPE Helion OpenStack 8 openstack-monasca-notification-1.10.2~dev4-3.9.1 as a component of HPE Helion OpenStack 8 python-keystone-12.0.4~dev11-5.36.1 as a component of HPE Helion OpenStack 8 python-monasca-notification-1.10.2~dev4-3.9.1 as a component of HPE Helion OpenStack 8 venv-openstack-keystone-x86_64-12.0.4~dev11-11.45.1 as a component of HPE Helion OpenStack 8 venv-openstack-monasca-x86_64-2.2.2~dev1-11.45.1 as a component of HPE Helion OpenStack 8 documentation-suse-openstack-cloud-installation-8.20211112-1.38.1 as a component of SUSE OpenStack Cloud 8 documentation-suse-openstack-cloud-operations-8.20211112-1.38.1 as a component of SUSE OpenStack Cloud 8 documentation-suse-openstack-cloud-opsconsole-8.20211112-1.38.1 as a component of SUSE OpenStack Cloud 8 documentation-suse-openstack-cloud-planning-8.20211112-1.38.1 as a component of SUSE OpenStack Cloud 8 documentation-suse-openstack-cloud-security-8.20211112-1.38.1 as a component of SUSE OpenStack Cloud 8 documentation-suse-openstack-cloud-supplement-8.20211112-1.38.1 as a component of SUSE OpenStack Cloud 8 documentation-suse-openstack-cloud-upstream-admin-8.20211112-1.38.1 as a component of SUSE OpenStack Cloud 8 documentation-suse-openstack-cloud-upstream-user-8.20211112-1.38.1 as a component of SUSE OpenStack Cloud 8 documentation-suse-openstack-cloud-user-8.20211112-1.38.1 as a component of SUSE OpenStack Cloud 8 kibana-4.6.6-3.12.1 as a component of SUSE OpenStack Cloud 8 openstack-keystone-12.0.4~dev11-5.36.1 as a component of SUSE OpenStack Cloud 8 openstack-keystone-doc-12.0.4~dev11-5.36.1 as a component of SUSE OpenStack Cloud 8 openstack-monasca-notification-1.10.2~dev4-3.9.1 as a component of SUSE OpenStack Cloud 8 python-keystone-12.0.4~dev11-5.36.1 as a component of SUSE OpenStack Cloud 8 python-monasca-notification-1.10.2~dev4-3.9.1 as a component of SUSE OpenStack Cloud 8 venv-openstack-keystone-x86_64-12.0.4~dev11-11.45.1 as a component of SUSE OpenStack Cloud 8 venv-openstack-monasca-x86_64-2.2.2~dev1-11.45.1 as a component of SUSE OpenStack Cloud 8 documentation-suse-openstack-cloud-deployment-8.20211112-1.38.1 as a component of SUSE OpenStack Cloud Crowbar 8 documentation-suse-openstack-cloud-supplement-8.20211112-1.38.1 as a component of SUSE OpenStack Cloud Crowbar 8 documentation-suse-openstack-cloud-upstream-admin-8.20211112-1.38.1 as a component of SUSE OpenStack Cloud Crowbar 8 documentation-suse-openstack-cloud-upstream-user-8.20211112-1.38.1 as a component of SUSE OpenStack Cloud Crowbar 8 kibana-4.6.6-3.12.1 as a component of SUSE OpenStack Cloud Crowbar 8 openstack-keystone-12.0.4~dev11-5.36.1 as a component of SUSE OpenStack Cloud Crowbar 8 openstack-keystone-doc-12.0.4~dev11-5.36.1 as a component of SUSE OpenStack Cloud Crowbar 8 openstack-monasca-notification-1.10.2~dev4-3.9.1 as a component of SUSE OpenStack Cloud Crowbar 8 python-keystone-12.0.4~dev11-5.36.1 as a component of SUSE OpenStack Cloud Crowbar 8 python-monasca-notification-1.10.2~dev4-3.9.1 as a component of SUSE OpenStack Cloud Crowbar 8 An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could result in Kibana redirecting the user to an arbitrary website. CVE-2021-22141 HPE Helion OpenStack 8:documentation-hpe-helion-openstack-installation-8.20211112-1.38.1 HPE Helion OpenStack 8:documentation-hpe-helion-openstack-operations-8.20211112-1.38.1 HPE Helion OpenStack 8:documentation-hpe-helion-openstack-opsconsole-8.20211112-1.38.1 HPE Helion OpenStack 8:documentation-hpe-helion-openstack-planning-8.20211112-1.38.1 HPE Helion OpenStack 8:documentation-hpe-helion-openstack-security-8.20211112-1.38.1 HPE Helion OpenStack 8:documentation-hpe-helion-openstack-user-8.20211112-1.38.1 HPE Helion OpenStack 8:kibana-4.6.6-3.12.1 HPE Helion OpenStack 8:openstack-keystone-12.0.4~dev11-5.36.1 HPE Helion OpenStack 8:openstack-keystone-doc-12.0.4~dev11-5.36.1 HPE Helion OpenStack 8:openstack-monasca-notification-1.10.2~dev4-3.9.1 HPE Helion OpenStack 8:python-keystone-12.0.4~dev11-5.36.1 HPE Helion OpenStack 8:python-monasca-notification-1.10.2~dev4-3.9.1 HPE Helion OpenStack 8:venv-openstack-keystone-x86_64-12.0.4~dev11-11.45.1 HPE Helion OpenStack 8:venv-openstack-monasca-x86_64-2.2.2~dev1-11.45.1 SUSE OpenStack Cloud 8:documentation-suse-openstack-cloud-installation-8.20211112-1.38.1 SUSE OpenStack Cloud 8:documentation-suse-openstack-cloud-operations-8.20211112-1.38.1 SUSE OpenStack Cloud 8:documentation-suse-openstack-cloud-opsconsole-8.20211112-1.38.1 SUSE OpenStack Cloud 8:documentation-suse-openstack-cloud-planning-8.20211112-1.38.1 SUSE OpenStack Cloud 8:documentation-suse-openstack-cloud-security-8.20211112-1.38.1 SUSE OpenStack Cloud 8:documentation-suse-openstack-cloud-supplement-8.20211112-1.38.1 SUSE OpenStack Cloud 8:documentation-suse-openstack-cloud-upstream-admin-8.20211112-1.38.1 SUSE OpenStack Cloud 8:documentation-suse-openstack-cloud-upstream-user-8.20211112-1.38.1 SUSE OpenStack Cloud 8:documentation-suse-openstack-cloud-user-8.20211112-1.38.1 SUSE OpenStack Cloud 8:kibana-4.6.6-3.12.1 SUSE OpenStack Cloud 8:openstack-keystone-12.0.4~dev11-5.36.1 SUSE OpenStack Cloud 8:openstack-keystone-doc-12.0.4~dev11-5.36.1 SUSE OpenStack Cloud 8:openstack-monasca-notification-1.10.2~dev4-3.9.1 SUSE OpenStack Cloud 8:python-keystone-12.0.4~dev11-5.36.1 SUSE OpenStack Cloud 8:python-monasca-notification-1.10.2~dev4-3.9.1 SUSE OpenStack Cloud 8:venv-openstack-keystone-x86_64-12.0.4~dev11-11.45.1 SUSE OpenStack Cloud 8:venv-openstack-monasca-x86_64-2.2.2~dev1-11.45.1 SUSE OpenStack Cloud Crowbar 8:documentation-suse-openstack-cloud-deployment-8.20211112-1.38.1 SUSE OpenStack Cloud Crowbar 8:documentation-suse-openstack-cloud-supplement-8.20211112-1.38.1 SUSE OpenStack Cloud Crowbar 8:documentation-suse-openstack-cloud-upstream-admin-8.20211112-1.38.1 SUSE OpenStack Cloud Crowbar 8:documentation-suse-openstack-cloud-upstream-user-8.20211112-1.38.1 SUSE OpenStack Cloud Crowbar 8:kibana-4.6.6-3.12.1 SUSE OpenStack Cloud Crowbar 8:openstack-keystone-12.0.4~dev11-5.36.1 SUSE OpenStack Cloud Crowbar 8:openstack-keystone-doc-12.0.4~dev11-5.36.1 SUSE OpenStack Cloud Crowbar 8:openstack-monasca-notification-1.10.2~dev4-3.9.1 SUSE OpenStack Cloud Crowbar 8:python-keystone-12.0.4~dev11-5.36.1 SUSE OpenStack Cloud Crowbar 8:python-monasca-notification-1.10.2~dev4-3.9.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221654-1/ https://www.suse.com/security/cve/CVE-2021-22141.html CVE-2021-22141 https://bugzilla.suse.com/1186868 SUSE Bug 1186868 OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to PCI DSS features). By guessing the name of an account and failing to authenticate multiple times, any unauthenticated actor could both confirm the account exists and obtain that account's corresponding UUID, which might be leveraged for other unrelated attacks. All deployments enabling security_compliance.lockout_failure_attempts are affected. CVE-2021-38155 HPE Helion OpenStack 8:documentation-hpe-helion-openstack-installation-8.20211112-1.38.1 HPE Helion OpenStack 8:documentation-hpe-helion-openstack-operations-8.20211112-1.38.1 HPE Helion OpenStack 8:documentation-hpe-helion-openstack-opsconsole-8.20211112-1.38.1 HPE Helion OpenStack 8:documentation-hpe-helion-openstack-planning-8.20211112-1.38.1 HPE Helion OpenStack 8:documentation-hpe-helion-openstack-security-8.20211112-1.38.1 HPE Helion OpenStack 8:documentation-hpe-helion-openstack-user-8.20211112-1.38.1 HPE Helion OpenStack 8:kibana-4.6.6-3.12.1 HPE Helion OpenStack 8:openstack-keystone-12.0.4~dev11-5.36.1 HPE Helion OpenStack 8:openstack-keystone-doc-12.0.4~dev11-5.36.1 HPE Helion OpenStack 8:openstack-monasca-notification-1.10.2~dev4-3.9.1 HPE Helion OpenStack 8:python-keystone-12.0.4~dev11-5.36.1 HPE Helion OpenStack 8:python-monasca-notification-1.10.2~dev4-3.9.1 HPE Helion OpenStack 8:venv-openstack-keystone-x86_64-12.0.4~dev11-11.45.1 HPE Helion OpenStack 8:venv-openstack-monasca-x86_64-2.2.2~dev1-11.45.1 SUSE OpenStack Cloud 8:documentation-suse-openstack-cloud-installation-8.20211112-1.38.1 SUSE OpenStack Cloud 8:documentation-suse-openstack-cloud-operations-8.20211112-1.38.1 SUSE OpenStack Cloud 8:documentation-suse-openstack-cloud-opsconsole-8.20211112-1.38.1 SUSE OpenStack Cloud 8:documentation-suse-openstack-cloud-planning-8.20211112-1.38.1 SUSE OpenStack Cloud 8:documentation-suse-openstack-cloud-security-8.20211112-1.38.1 SUSE OpenStack Cloud 8:documentation-suse-openstack-cloud-supplement-8.20211112-1.38.1 SUSE OpenStack Cloud 8:documentation-suse-openstack-cloud-upstream-admin-8.20211112-1.38.1 SUSE OpenStack Cloud 8:documentation-suse-openstack-cloud-upstream-user-8.20211112-1.38.1 SUSE OpenStack Cloud 8:documentation-suse-openstack-cloud-user-8.20211112-1.38.1 SUSE OpenStack Cloud 8:kibana-4.6.6-3.12.1 SUSE OpenStack Cloud 8:openstack-keystone-12.0.4~dev11-5.36.1 SUSE OpenStack Cloud 8:openstack-keystone-doc-12.0.4~dev11-5.36.1 SUSE OpenStack Cloud 8:openstack-monasca-notification-1.10.2~dev4-3.9.1 SUSE OpenStack Cloud 8:python-keystone-12.0.4~dev11-5.36.1 SUSE OpenStack Cloud 8:python-monasca-notification-1.10.2~dev4-3.9.1 SUSE OpenStack Cloud 8:venv-openstack-keystone-x86_64-12.0.4~dev11-11.45.1 SUSE OpenStack Cloud 8:venv-openstack-monasca-x86_64-2.2.2~dev1-11.45.1 SUSE OpenStack Cloud Crowbar 8:documentation-suse-openstack-cloud-deployment-8.20211112-1.38.1 SUSE OpenStack Cloud Crowbar 8:documentation-suse-openstack-cloud-supplement-8.20211112-1.38.1 SUSE OpenStack Cloud Crowbar 8:documentation-suse-openstack-cloud-upstream-admin-8.20211112-1.38.1 SUSE OpenStack Cloud Crowbar 8:documentation-suse-openstack-cloud-upstream-user-8.20211112-1.38.1 SUSE OpenStack Cloud Crowbar 8:kibana-4.6.6-3.12.1 SUSE OpenStack Cloud Crowbar 8:openstack-keystone-12.0.4~dev11-5.36.1 SUSE OpenStack Cloud Crowbar 8:openstack-keystone-doc-12.0.4~dev11-5.36.1 SUSE OpenStack Cloud Crowbar 8:openstack-monasca-notification-1.10.2~dev4-3.9.1 SUSE OpenStack Cloud Crowbar 8:python-keystone-12.0.4~dev11-5.36.1 SUSE OpenStack Cloud Crowbar 8:python-monasca-notification-1.10.2~dev4-3.9.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221654-1/ https://www.suse.com/security/cve/CVE-2021-38155.html CVE-2021-38155 https://bugzilla.suse.com/1189390 SUSE Bug 1189390