CVE-2019-15043

In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana.

This update for grafana, grafana-piechart-panel, grafana-status-panel fixes the following issues:

grafana was updated to version 7.0.3:

• Features / Enhancements

  • Stats: include all fields. #24829, @ryantxu
  • Variables: change VariableEditorList row action Icon to IconButton. #25217, @hshoff

• Bug fixes

  • Cloudwatch: Fix dimensions of DDoSProtection. #25317, @papagian
  • Configuration: Fix env var override of sections containing hyphen. #25178, @marefr
  • Dashboard: Get panels in collapsed rows. #25079, @peterholmberg
  • Do not show alerts tab when alerting is disabled. #25285, @dprokop
  • Jaeger: fixes cascader option label duration value. #25129, @Estrax
  • Transformations: Fixed Transform tab crash & no update after adding first transform. #25152, @torkelo

Update to version 7.0.2

• Bug fixes

  • Security: Urgent security patch release to fix CVE-2020-13379

Update to version 7.0.1

• Features / Enhancements

  • Datasource/CloudWatch: Makes CloudWatch Logs query history more readable. #24795, @kaydelaney
  • Download CSV: Add date and time formatting. #24992, @ryantxu
  • Table: Make last cell value visible when right aligned. #24921, @peterholmberg
  • TablePanel: Adding sort order persistance. #24705, @torkelo
  • Transformations: Display correct field name when using reduce transformation. #25068, @peterholmberg
  • Transformations: Allow custom number input for binary operations. #24752, @ryantxu

• Bug fixes

  • Dashboard/Links: Fixes dashboard links by tags not working. #24773, @KamalGalrani
  • Dashboard/Links: Fixes open in new window for dashboard link. #24772, @KamalGalrani
  • Dashboard/Links: Variables are resolved and limits to 100. #25076, @hugohaggmark
  • DataLinks: Bring back variables interpolation in title. #24970, @dprokop
  • Datasource/CloudWatch: Field suggestions no longer limited to prefix-only. #24855, @kaydelaney
  • Explore/Table: Keep existing field types if possible. #24944, @kaydelaney
  • Explore: Fix wrap lines toggle for results of queries with filter expression. #24915, @ivanahuckova
  • Explore: fix undo in query editor. #24797, @zoltanbedi
  • Explore: fix word break in type head info. #25014, @zoltanbedi
  • Graph: Legend decimals now work as expected. #24931, @torkelo
  • LoginPage: Fix hover color for service buttons. #25009, @tskarhed
  • LogsPanel: Fix scrollbar. #24850, @ivanahuckova
  • MoveDashboard: Fix for moving dashboard caused all variables to be lost. #25005, @torkelo
  • Organize transformer: Use display name in field order comparer. #24984, @dprokop
  • Panel: shows correct panel menu items in view mode. #24912, @hugohaggmark
  • PanelEditor Fix missing labels and description if there is only single option in category. #24905, @dprokop
  • PanelEditor: Overrides name matcher still show all original field names even after Field default display name is specified. #24933, @torkelo
  • PanelInspector: Makes sure Data display options are visible. #24902, @hugohaggmark
  • PanelInspector: Hides unsupported data display options for Panel type. #24918, @hugohaggmark
  • PanelMenu: Make menu disappear on button press. #25015, @tskarhed
  • Postgres: Fix add button. #25087, @phemmer
  • Prometheus: Fix recording rules expansion. #24977, @ivanahuckova
  • Stackdriver: Fix creating Service Level Objectives (SLO) datasource query variable. #25023, @papagian

Update to version 7.0.0

• Breaking changes

  • Removed PhantomJS: PhantomJS was deprecated in Grafana v6.4 and starting from Grafana v7.0.0, all PhantomJS support has been removed. This means that Grafana no longer ships with a built-in image renderer, and we advise you to install the Grafana Image Renderer plugin.
  • Dashboard: A global minimum dashboard refresh interval is now enforced and defaults to 5 seconds.
  • Interval calculation: There is now a new option Max data points that controls the auto interval $__interval calculation. Interval was previously calculated by dividing the panel width by the…

This update fixes the following issues:

dracut-saltboot:

• Print a list of available disk devices (bsc#1170824)
• Install wipefs to initrd
• Force install crypt modules

golang-github-prometheus-prometheus:

• Update change log and spec file
  • Modified spec file: default to golang 1.14 to avoid 'have choice' build issues in OBS.
  • Rebase and update patches for version 2.18.0
• Update to 2.18.0
  • Features
    • Tracing: Added experimental Jaeger support #7148
  • Changes
    • Federation: Only use local TSDB for federation (ignore remote read). #7096
    • Rules: rule_evaluations_total and rule_evaluation_failures_total have a rule_group label now. #7094
  • Enhancements
    • TSDB: Significantly reduce WAL size kept around after a block cut. #7098
    • Discovery: Add architecture meta label for EC2. #7000
  • Bug fixes
    • UI: Fixed wrong MinTime reported by /status. #7182
    • React UI: Fixed multiselect legend on OSX. #6880
    • Remote Write: Fixed blocked resharding edge case. #7122
    • Remote Write: Fixed remote write not updating on relabel configs change. #7073
• Changes from 2.17.2
  • Bug fixes
    • Federation: Register federation metrics #7081
    • PromQL: Fix panic in parser error handling #7132
    • Rules: Fix reloads hanging when deleting a rule group that is being evaluated #7138
    • TSDB: Fix a memory leak when prometheus starts with an empty TSDB WAL #7135
    • TSDB: Make isolation more robust to panics in web handlers #7129 #7136
• Changes from 2.17.1
  • Bug fixes
    • TSDB: Fix query performance regression that increased memory and CPU usage #7051
• Changes from 2.17.0
  • Features
    • TSDB: Support isolation #6841
    • This release implements isolation in TSDB. API queries and recording rules are guaranteed to only see full scrapes and full recording rules. This comes with a certain overhead in resource usage. Depending on the situation, there might be some increase in memory usage, CPU usage, or query latency.
  • Enhancements
    • PromQL: Allow more keywords as metric names #6933
    • React UI: Add normalization of localhost URLs in targets page #6794
    • Remote read: Read from remote storage concurrently #6770
    • Rules: Mark deleted rule series as stale after a reload #6745
    • Scrape: Log scrape append failures as debug rather than warn #6852
    • TSDB: Improve query performance for queries that partially hit the head #6676
    • Consul SD: Expose service health as meta label #5313
    • EC2 SD: Expose EC2 instance lifecycle as meta label #6914
    • Kubernetes SD: Expose service type as meta label for K8s service role #6684
    • Kubernetes SD: Expose label_selector and field_selector #6807
    • Openstack SD: Expose hypervisor id as meta label #6962
  • Bug fixes
    • PromQL: Do not escape HTML-like chars in query log #6834 #6795
    • React UI: Fix data table matrix values #6896
    • React UI: Fix new targets page not loading when using non-ASCII characters #6892
    • Remote read: Fix duplication of metrics read from remote storage with external labels #6967 #7018
    • Remote write: Register WAL watcher and live reader metrics for all remotes, not just the first one #6998
    • Scrape: Prevent removal of metric names upon relabeling #6891
    • Scrape: Fix 'superfluous response.WriteHeader call' errors when scrape fails under some circonstances #6986
    • Scrape: Fix crash when reloads are separated by two scrape intervals #7011
• Changes from 2.16.0
  • Features
    • React UI: Support local timezone on /graph #6692
    • PromQL: add absent_over_time query function #6490
    • Adding optional logging of queries to their own file #6520
  • Enhancements
    • React UI: Add support for rules page and 'Xs ago' duration displays #6503
    • React UI: alerts page, replace filtering togglers tabs with checkboxes #6543
    • TSDB: Export metric for WAL write errors #6647
    • TSDB: Improve query performance for queries that only touch…

This update for grafana fixes the following issues:

grafana was updated to version 7.1.5:

• Features / Enhancements

  • Stats: Stop counting the same user multiple times.
  • Field overrides: Filter by field name using regex.
  • AzureMonitor: map more units.
  • Explore: Don't run queries on datasource change.
  • Graph: Support setting field unit & override data source (automatic) unit.
  • Explore: Unification of logs/metrics/traces user interface
  • Table: JSON Cell should try to convert strings to JSON
  • Variables: enables cancel for slow query variables queries.
  • TimeZone: unify the time zone pickers to one that can rule them all.
  • Search: support URL query params.
  • Grafana-UI: Add FileUpload.
  • TablePanel: Sort numbers correctly.

• Bug fixes

  • Alerting: remove LongToWide call in alerting.
  • AzureMonitor: fix panic introduced in 7.1.4 when unit was unspecified and alias was used.
  • Variables: Fixes issue with All variable not being resolved.
  • Templating: Fixes so texts show in picker not the values.
  • Templating: Templating: Fix undefined result when using raw interpolation format
  • TextPanel: Fix content overflowing panel boundaries.
  • StatPanel: Fix stat panel display name not showing when explicitly set.
  • Query history: Fix search filtering if null value.
  • Flux: Ensure connections to InfluxDB are closed.
  • Dashboard: Fix for viewer can enter panel edit mode by modifying url (but cannot not save anything).
  • Prometheus: Fix prom links in mixed mode.
  • Sign In Use correct url for the Sign In button.
  • StatPanel: Fixes issue with name showing for single series / field results
  • BarGauge: Fix space bug in single series mode.
  • Auth: Fix POST request failures with anonymous access
  • Templating: Fix recursive loop of template variable queries when changing ad-hoc-variable
  • Templating: Fixed recursive queries triggered when switching dashboard settings view
  • GraphPanel: Fix annotations overflowing panels.
  • Prometheus: Fix performance issue in processing of histogram labels.
  • Datasources: Handle URL parsing error.
  • Security: Use Header.Set and Header.Del for X-Grafana-User header.

These are all security issues fixed in the grafana-7.5.7-1.2 package on the GA media of openSUSE Tumbleweed.

This update for ansible, crowbar-core, crowbar-ha, crowbar-openstack, etcd, flannel, grafana, keepalived, kibana, memcached, monasca-installer, openstack-dashboard-theme-SUSE, openstack-manila, openstack-neutron-fwaas, openstack-nova, openstack-tempest, python-Django, python-Pillow, python-psql2mysql, python-psutil, python-py, python-pysaml2, python-waitress, rabbitmq-server, release-notes-suse-openstack-cloud, zookeeper fixes the following issues:

Security fixes included ins this update:

ansible

• CVE-2019-3828: Fixed a path traversal in the fetch module (bsc#1126503).

grafana

• CVE-2020-13379: Fixed an incorrect access control issue which could lead to information leaks or denial of service (bsc#1172409).
• CVE-2020-12052: Fixed an cross site scripting vulnerability related to the annotation popup (bsc#1170657).

kibana

• CVE-2020-10743: Fixed a clickjacking vulnerability (bsc#1171909).

memcached (to version 1.5.17)

• CVE-2019-15026: Fixed a stack-based buffer over-read in conn_to_str()n (bsc#1149110).
• CVE-2019-11596: Fixed a denial of service in the 'lru' command (bsc#1133817)
• CVE-2018-1000115: Disabled UDP by default to reduce DDoS amplification attacks (bsc#1083903).

python-Django

• CVE-2020-13254: Fixed a data leakage via malformed memcached keys (bsc#1172167).
• CVE-2020-13596: Fixed a cross site scripting vulnerability related to the admin parameters of the ForeignKeyRawIdWidget (bsc#1172166).
• Fixed a regression with the fix for CVE-2019-3498 (bsc#1161349).

python-Pillow

• CVE-2019-16865: Fixed a denial of service with specially crafted image files (bsc#1153191).
• CVE-2020-5312: Fixed a buffer overflow in the PCX P mode (bsc#1160152).
• CVE-2020-5313: Fixed a buffer overflow related to FLI (bsc#1160153).
• CVE-2019-19911: Fixed a denial of service in FpxImagePlugin.py (bsc#1160192).

python-pysaml2

• CVE-2020-5390: Fixed an issue with the verification of signatures in SAML documents (bsc#1160851)
• CVE-2017-1000246: Fixed an issue with weak encryption data, caused by initialization vector reuse(bsc#1068612).

python-waitress (to version 1.4.3)

• CVE-2019-16785: Fixed HTTP request smuggling through LF vs CRLF handling (bsc#1161088).
• CVE-2019-16786: Fixed HTTP request smuggling through invalid Transfer-Encoding (bsc#1161089).
• CVE-2019-16789: Fixed HTTP Request Smuggling through invalid whitespace characters (bsc#1160790).
• CVE-2019-16792: Fixed HTTP Request Smuggling through Content-Length header handling (bsc#1161670).

rubygem-activeresource

• CVE-2020-8151: Fixed information disclosure issue through specially crafted requests (bsc#1171560)

rubygem-json-1_7

• CVE-2020-10663: Fixed Unsafe Object Creation Vulnerability in JSON (bsc#1167244)

rubygem-puma

• CVE-2020-11077: Fixed HTTP Request Smuggling through proxy (bsc#1172175)
• CVE-2020-11076: Fixed HTTP Request smuggling through invalid Transfer-Encoding header.
• CVE-2020-5247: Fixed HTTP Response Splitting through newline characters handling (bsc#1165402)

zookeeper:

• CVE-2019-0201: Fixed an information disclosure related to getACL() (bsc#1135773).

Non security fixes included in this update:

Changes in ansible:

• Add 0001-Disallow-use-of-remote-home-directories-containing-..patch (bsc#1126503, CVE-2019-3828)

Changes in crowbar-core:

• Update to version 4.0+git.1580209654.1d112d31f:
  • network: start OVS before wickedd (SOC-11067)

Changes in crowbar-ha:

• Update to version 4.0+git.1585316203.d6ad2c8:
  • [4.0] add ssl termination on haproxy (bsc#1149535)

Changes in crowbar-openstack:

• Update to version 4.0+git.1589804581.9972163f0:

  • [4.0] magnum: fix check for image/flavor (SOC-11251)

• Update to version 4.0+git.1589647351.ccfd9481f:

  • [4.0] trove: fix rabbitmq connection URL (SOC-11286)

• Update to version 4.0+git.1589458214.9f765aa08:

  • [4.0] Fix create magnum k8s image and flavor (SOC-11251)

• Update to version 4.0+git.1588271860.131fc8cc1:

  • run keystone_register on cluster founder only when HA (SOC-11248)
  • nova: run…

This update for crowbar-core, crowbar-openstack, grafana, novnc, openstack-keystone, openstack-neutron, openstack-neutron-lbaas, openstack-nova, openstack-tempest, python-pysaml2, python-urllib3, rubygem-chef, rubygem-easy_diff, sleshammer fixes the following issues:

In python-pysaml2 the following security issue was fixed:

• CVE-2016-10127: Fixed an XML external entity attack. (bsc#1019074)

crowbar-core was updated to version 4.0+git.1570463621.40b11cd48:

• network: Don't set datapath-ids on ovs-bridges anymore (bsc#1152916)
• barclamp_lib: Sync timeout with other barclamps (SOC-10513, SOC-10011)
• gems: Update easy_diff to 1.0.0 (SOC-10505)
• crowbar: Do not read /etc/crowbar.install.key in non-SUSE init script
• transition.sh: Do not read /etc/crowbar.install.key
• gather_logs: Make it a bit useful again
• gather_logs: Do not read /etc/crowbar.install.key
• network: Allow locking down the network config for nodes (bsc#1120657)
• network: Check existing upper layers before bond setup (bsc#1120657)
• network: never plug two interface into the same ovs bridge (bsc#1120657)
• network: Avoid plugging the same interface to two ovs bridges (bsc#1120657)
• nic library: some helper for identifying base interface (bsc#1120657)
• network: Rework the vlan port replugging code (bsc#1120657)
• network: DRY out 'kill_nic_files' (noref)
• Add CVE-2019-5477 the to travis ignore list (SOC-9635)

crowbar-openstack was updated to version 4.0+git.1569429513.e7016b2b6:

• tempest: don't rely on service catalogue (SOC-10633)
• nova: set default attribute for max_threads_per_process
• database: Hardcode ruby version for package installation (SOC-10010)
• neutron: restore dhcp_domain in stable/4.0 (bsc#1145867)
• nova: add max_threads_per_process tuneable (SOC-10001, bsc#1133719)

grafana was updated to:

• CVE-2019-15043: Adds authentication to a few rest endpoints that could be used to access grafana snapshot apis to cause denial of service (SOC-10357 bsc#1148383) Also see https://github.com/grafana/grafana/compare/v5.4.4...v5.4.5

grafana was updated to version 4.6.5:

• CVE-2018-19039: Users with Editor or Admin permissions could exfiltrate files (jsc#SOC-9976 bsc#1115960)

grafana was updated version to 4.6.4:

• CVE-2018-15727 / CVE-2018-558213: Fixed an authentication bypass because an attacker can generate a valid 'remember me'cookie knowing only a username of an LDAP or OAuth user (jsc#SOC-9980 bsc#1106515)

Other fixes:

• sql: added code migration type
• release 4.6.3
• fix default alias
• fixes broken alert eval when first condition is using OR
• fix: alert list panel now works correctly after adding manual annotation on dashboard, fixes #9951
• fix: fix for avatar images when gzip is turned on, fixes #5952
• sets version to 4.6.2
• prom: add support for default step param (#9866)
• build: fixed jshint error
• fix: Html escaping caused issue in InfluxDB query editor, could not pick greater than or less then operators, fixes #9871
• heatmap: fix tooltip in 'Time series bucket' mode, #9332 (#9867)
• fix cloudwatch ec2_instance_attribute (#9718)
• colorpicker: fix color string change #9769 (#9780)
• changes version to 4.6.1
• fix: panel view now wraps, no scrolling required, fixes #9746
• plugins: fix for loading external plugins behind auth proxy, fixes #9509
• fix: color picker bug at series overrides page, #9715 (#9738)
• tech: switch to golang 1.9.2
• tech: add missing include
• save as should only delete threshold for panels with alerts
• fix: graphite annotation tooltip included undefined, fixes #9707
• build: updated version to v4.6.0
• plugins: added backward compatible path for rxjs
• ux: updated singlestat default colors
• prometheus: fixed unsaved changes warning when changing time range due to step option on query model was changed in datasource.query code, fixes #9675
• fix: firefox can now create region annotations, fixes #9638
• alerting: only editors can pause rules
• fix: another fix for playlist view state, #9639…

This update for ardana-ansible, ardana-glance, ardana-horizon, ardana-input-model, ardana-manila, ardana-neutron, ardana-nova, ardana-octavia, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, galera-3, grafana, mariadb, mariadb-connector-c, novnc, openstack-cinder, openstack-glance, openstack-heat, openstack-horizon-plugin-neutron-vpnaas-ui, openstack-keystone, openstack-monasca-installer, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, python-amqp, python-ovs, python-pysaml2, python-python-engineio, python-urllib3, release-notes-suse-openstack-cloud, rubygem-easy_diff, rubygem-rest-client-1_6, venv-openstack-keystone contains the following fixes:

• Update to version 8.0+git.1566374355.c509923:

  • Use raw image format when using SES backend on Nova (SOC-9285)

• Update to version 8.0+git.1566376789.be0fe01:

  • Configure glance image_direct_url/multiple_locations (SOC-9285)

• Update to version 8.0+git.1565816064.5d4f73f:

  • Removed None condition from rule (SOC-10003)

• Update to version 8.0+git.1566517401.98450e6:

  • Add neutron-fwaas.json when neutron-l3-agent is deployed (SOC-10280)

• Update to version 8.0+git.1568835837.2452e7a:

  • Ensure Manila services don't auto start on reboot (SOC-10641)

• Update to version 8.0+git.1568220097.74ee4b4:

  • API extension paths separated by colon (SOC-10447)

• Update to version 8.0+git.1567555448.5ecd5b0:

  • Add dependent services to neutron services (SOC-8746)

• Update to version 8.0+git.1566517377.f2a8c54:

  • Add policy.d/neutron-fwaas.json.j2 (SOC-10280)

• Update to version 8.0+git.1566902754.c58ff69:

  • Install libosinfo package (SOC-10295)

• Update to version 8.0+git.1565946419.a76c00e:

  • Set diskcachemode and disk discard when using RBD (SOC-10182)

• Update to version 8.0+git.1568373448.bcaee7e:

  • Make octavia heartbeat frequency options configurable (SOC-9285)

• Update to version 8.0+git.1566374572.a3c91d9:

  • Include SES variables when configuring image (SOC-9285)

• Update to version 8.0+git.1566208257.5213d93:

  • Use default values for amphora connection retries/timeout (SOC-9285)

• Update to version 8.0+git.1566471887.fd2fec7:

  • Delete existing run filter before deploying it (SOC-10287)

• Update to version 5.0+git.1569597589.1f025c557:

  • barclamp_lib: Sync timeout with other barclamps (SOC-10513, SOC-10011)

• Update to version 5.0+git.1569231378.ac645b753:

  • Revert 'batch: Use easy_merge for merging (SOC-10505)'

• Update to version 5.0+git.1569103607.ee4a6cbc9:

  • upgrade: Fix pie chart colors on dashboard (SOC-10619)

• Update to version 5.0+git.1568983947.70c39b8c7:

  • batch: Use easy_merge for merging (SOC-10505)

• Update to version 5.0+git.1568317972.dfb856def:

  • upgrade: Fix pre-checks tests (SOC-9868)
  • Allow designate rndc for all nodes (SOC-10339)

• Update to version 5.0+git.1568210854.4f87b86f8:

  • gems: Update easy_diff to 1.0.0 (SOC-10505)

• Update to version 5.0+git.1567531836.e06d68030:

  • Public ips for dns nodes when designate integration is in use (SOC-9635)

• Update to version 5.0+git.1567513044.e9ef28b03:

  • crowbar: Do not read /etc/crowbar.install.key in non-SUSE init script
  • transition.sh: Do not read /etc/crowbar.install.key
  • gather_logs: Make it a bit useful again
  • gather_logs: Do not read /etc/crowbar.install.key
  • network: Check existing upper layers before bond setup (bsc#1120657)
  • network: never plug two interface into the same ovs bridge (bsc#1120657)
  • network: Avoid plugging the same interface to two ovs bridges (bsc#1120657)
  • nic library: some helper for identifying base interface (bsc#1120657)
  • network: Rework the vlan port replugging code (bsc#1120657)
  • network: DRY out 'kill_nic_files' (noref)

• Update to version 5.0+git.1567161136.fa34ac9f2:

  • Add CVE-2019-5477 the to travis ignore list (SOC-9635)

• Update to version 5.0+git.1567094388.48f2be817:

  • upgrade: Add more prechecks for 8->9 (SOC-9868)

• Update…

This update for ardana-ansible, ardana-horizon, ardana-keystone, ardana-manila, ardana-neutron, crowbar-core, crowbar-openstack, grafana, openstack-cinder, openstack-dashboard, openstack-horizon-plugin-manila-ui, openstack-keystone, openstack-manila, openstack-neutron, openstack-neutron-fwaas, openstack-neutron-lbaas, openstack-nova, openstack-octavia, openstack-octavia-amphora-image, pdns, python-Django1, python-keystonemiddleware, python-octaviaclient, python-os-brick, python-oslo.cache, python-oslo.messaging fixes the following issues:

Security issues fixed:

• CVE-2019-3871: Fixed an insufficient validation in the HTTP remote back end (pdns, bsc#1129734).
• CVE-2019-15043: Added authentication to a few REST endpoints (Grafana, SOC-10357, bsc#1148383).

Non-security issues fixed:

• Update to version 9.0+git.1568821007.4e73730:

  • Include manila-pre-upgrade.yml in ardana-upgrade.yml (SOC-10609)

• Update to version 9.0+git.1569869028.8edfc22:

  • Added command to minify the django compressed css files (SOC-10305)

• Update to version 9.0+git.1570035317.78077ac:

  • support OpenID Connect WebSSO (SOC-10509)

• Update to version 9.0+git.1569444107.add6a40:

  • Manila parallelised upgrade workflow enhancements (SOC-10609)

• Update to version 9.0+git.1571328680.3a89cb8:

  • Add neutron-common role dependencies (SOC-10875)

• Update to version 6.0+git.1571412352.8da4d261f:

  • upgrade: Reload repo config in repochecks (SOC-10718)

• Update to version 6.0+git.1571210108.12bd2ffa3:

  • crowbar: Give more time for reboot for physical hardware reboots

• Update to version 6.0+git.1570004730.b56b8983b:

  • Revert 'Use block-migration when needed' (SOC-10133)

• Update to version 6.0+git.1569911671.d44b0035c:

  • Designate: Don't add the admin node to the public network (SOC-10658)

• Update to version 6.0+git.1572264221.3826a58b8:

  • Octavia: account for long ops in HA deployments (SOC-9894)
  • Octavia: use correct IP addresses for listening (SOC-9894)
  • Octavia: fix subnet creation race condition (SOC-9894)
  • Updated copyright notices (SOC-9894)
  • Octavia: Follow up patch addressing comments from last PR (SOC-9894)

• Update to version 6.0+git.1571986150.c5b827b7a:

  • Fix the migration that tried to access Array as a Hash (SOC-10896)

• Update to version 6.0+git.1571731423.957dcfecd:

  • mysql: fix WSREP sync race (SOC-10717)

• Update to version 6.0+git.1571660392.997fee49d:

  • mysql: stop service for mysql_install_db (SOC-10717)

• Update to version 6.0+git.1571241502.2f673d0a9:

  • rabbitmq: fix migration 200 (SOC-10623)
  • Changes to integrate with ACI 4.1 and new packages (SOC-10403)

• Update to version 6.0+git.1570143515.9b1546ed3:

  • No rndc key if no public DNS server (SOC-10835)

• Update to version 6.0+git.1570048281.815e06ff3:

  • create watcher barclamp (SOC-4183)

• Update to version 6.0+git.1569942913.15b24bec5:

  • monasca: Fix restore condition (SOC-9772)
  • database: really fix migration 102 (SOC-10717)

• Update to version 6.0+git.1569823669.91f267e96:

  • Designate: Filter out the admin node (SOC-10658)

• Create plugin directory and clean up (create in %install, add to %files) handling of /var/lib/grafana/* and

• Update to version cinder-13.0.8.dev8:

  • Extend timeout for database migration tests 13.0.7
  • Add context to cloning snapshots in remotefs driver

• Update to version cinder-13.0.7.dev22:

  • Add retry to LVM deactivation
  • Fix DetachedInstanceError for VolumeAttachment
  • Don't allow retype to encrypted+multiattach type

• Update to version cinder-13.0.8.dev8:

  • Extend timeout for database migration tests 13.0.7
  • Add context to cloning snapshots in remotefs driver

• Update to version cinder-13.0.7.dev22:

  • Add retry to LVM deactivation
  • Fix DetachedInstanceError for VolumeAttachment
  • Don't allow retype to encrypted+multiattach type

• Update to version horizon-14.0.5.dev1:

  • Fix aes-xts key length in Horizon Admin Guide / Manage Volumes 14.0.4

• Add…

This update for grafana to version 4.6.5 fixes the following issues:

Security issues fixed:

• CVE-2019-15043: Added authentication to a few rest endpoints (jsc#SOC-10357, bsc#1148383).
• CVE-2018-19039: Fixed File Exfiltration vulnerability (jsc#SOC-9976 bsc#1115960).
• CVE-2018-15727: Fixed an LDAP and OAuth login vulnerability (jsc#SOC-9980 bsc#1106515).
• CVE-2018-12099: Fixed cross site scripting vulnerabilities in dashboard links (bsc#1096985).
• CVE-2019-13068: Fixed an HTML injection in the panel drilldown links (bsc#1139862).

Non-security issue fixed:

• Solve wrongly categorized 'default.ini' file. (bsc#1167424) The configuration file was wrongly classified as documentation instead of configuration file. In systems where the documentation isn't installed by default was not possible to start the 'grafana server' service.

This update fixes the following issues:

dracut-saltboot:

• Print a list of available disk devices (bsc#1170824)
• Install wipefs to initrd
• Force install crypt modules
• Add missing terminal naming modifiers as exported veriables

golang-github-prometheus-prometheus:

• Update change log and spec file
  • Modified spec file: default to golang 1.14 to avoid 'have choice' build issues in OBS.
  • Rebase and update patches for version 2.18.0
  • Changed:
    • 0002-Default-settings.patch Changed
• Update to 2.18.0
  • Features
    • Tracing: Added experimental Jaeger support #7148
  • Changes
    • Federation: Only use local TSDB for federation (ignore remote read). #7096
    • Rules: rule_evaluations_total and rule_evaluation_failures_total have a rule_group label now. #7094
  • Enhancements
    • TSDB: Significantly reduce WAL size kept around after a block cut. #7098
    • Discovery: Add architecture meta label for EC2. #7000
  • Bug fixes
    • UI: Fixed wrong MinTime reported by /status. #7182
    • React UI: Fixed multiselect legend on OSX. #6880
    • Remote Write: Fixed blocked resharding edge case. #7122
    • Remote Write: Fixed remote write not updating on relabel configs change. #7073
• Changes from 2.17.2
  • Bug fixes
    • Federation: Register federation metrics #7081
    • PromQL: Fix panic in parser error handling #7132
    • Rules: Fix reloads hanging when deleting a rule group that is being evaluated #7138
    • TSDB: Fix a memory leak when prometheus starts with an empty TSDB WAL #7135
    • TSDB: Make isolation more robust to panics in web handlers #7129 #7136
• Changes from 2.17.1
  • Bug fixes
    • TSDB: Fix query performance regression that increased memory and CPU usage #7051
• Changes from 2.17.0
  • Features
    • TSDB: Support isolation #6841
    • This release implements isolation in TSDB. API queries and recording rules are guaranteed to only see full scrapes and full recording rules. This comes with a certain overhead in resource usage. Depending on the situation, there might be some increase in memory usage, CPU usage, or query latency.
  • Enhancements
    • PromQL: Allow more keywords as metric names #6933
    • React UI: Add normalization of localhost URLs in targets page #6794
    • Remote read: Read from remote storage concurrently #6770
    • Rules: Mark deleted rule series as stale after a reload #6745
    • Scrape: Log scrape append failures as debug rather than warn #6852
    • TSDB: Improve query performance for queries that partially hit the head #6676
    • Consul SD: Expose service health as meta label #5313
    • EC2 SD: Expose EC2 instance lifecycle as meta label #6914
    • Kubernetes SD: Expose service type as meta label for K8s service role #6684
    • Kubernetes SD: Expose label_selector and field_selector #6807
    • Openstack SD: Expose hypervisor id as meta label #6962
  • Bug fixes
    • PromQL: Do not escape HTML-like chars in query log #6834 #6795
    • React UI: Fix data table matrix values #6896
    • React UI: Fix new targets page not loading when using non-ASCII characters #6892
    • Remote read: Fix duplication of metrics read from remote storage with external labels #6967 #7018
    • Remote write: Register WAL watcher and live reader metrics for all remotes, not just the first one #6998
    • Scrape: Prevent removal of metric names upon relabeling #6891
    • Scrape: Fix 'superfluous response.WriteHeader call' errors when scrape fails under some circonstances #6986
    • Scrape: Fix crash when reloads are separated by two scrape intervals #7011
• Changes from 2.16.0
  • Features
    • React UI: Support local timezone on /graph #6692
    • PromQL: add absent_over_time query function #6490
    • Adding optional logging of queries to their own file #6520
  • Enhancements
    • React UI: Add support for rules page and 'Xs ago' duration displays #6503
    • React UI: alerts page, replace filtering togglers tabs with checkboxes #6543 …

This update fixes the following issues:

cobbler:

• Calculate relative path for kernel and inited when generating grub entry (bsc#1170231) Added: fix-grub2-entry-paths.diff
• Fix os-release version detection for SUSE Modified: sles15.patch
• Jinja2 template library fix (bsc#1141661)
• Removes string replace for textmode fix (bsc#1134195)

golang-github-prometheus-prometheus:

• Update change log and spec file
  • Modified spec file: default to golang 1.14 to avoid 'have choice' build issues in OBS.
  • Rebase and update patches for version 2.18.0
  • Changed:
    • 0002-Default-settings.patch Changed
• Update to 2.18.0
  • Features
    • Tracing: Added experimental Jaeger support #7148
  • Changes
    • Federation: Only use local TSDB for federation (ignore remote read). #7096
    • Rules: rule_evaluations_total and rule_evaluation_failures_total have a rule_group label now. #7094
  • Enhancements
    • TSDB: Significantly reduce WAL size kept around after a block cut. #7098
    • Discovery: Add architecture meta label for EC2. #7000
  • Bug fixes
    • UI: Fixed wrong MinTime reported by /status. #7182
    • React UI: Fixed multiselect legend on OSX. #6880
    • Remote Write: Fixed blocked resharding edge case. #7122
    • Remote Write: Fixed remote write not updating on relabel configs change. #7073
• Changes from 2.17.2
  • Bug fixes
    • Federation: Register federation metrics #7081
    • PromQL: Fix panic in parser error handling #7132
    • Rules: Fix reloads hanging when deleting a rule group that is being evaluated #7138
    • TSDB: Fix a memory leak when prometheus starts with an empty TSDB WAL #7135
    • TSDB: Make isolation more robust to panics in web handlers #7129 #7136
• Changes from 2.17.1
  • Bug fixes
    • TSDB: Fix query performance regression that increased memory and CPU usage #7051
• Changes from 2.17.0
  • Features
    • TSDB: Support isolation #6841
    • This release implements isolation in TSDB. API queries and recording rules are guaranteed to only see full scrapes and full recording rules. This comes with a certain overhead in resource usage. Depending on the situation, there might be some increase in memory usage, CPU usage, or query latency.
  • Enhancements
    • PromQL: Allow more keywords as metric names #6933
    • React UI: Add normalization of localhost URLs in targets page #6794
    • Remote read: Read from remote storage concurrently #6770
    • Rules: Mark deleted rule series as stale after a reload #6745
    • Scrape: Log scrape append failures as debug rather than warn #6852
    • TSDB: Improve query performance for queries that partially hit the head #6676
    • Consul SD: Expose service health as meta label #5313
    • EC2 SD: Expose EC2 instance lifecycle as meta label #6914
    • Kubernetes SD: Expose service type as meta label for K8s service role #6684
    • Kubernetes SD: Expose label_selector and field_selector #6807
    • Openstack SD: Expose hypervisor id as meta label #6962
  • Bug fixes
    • PromQL: Do not escape HTML-like chars in query log #6834 #6795
    • React UI: Fix data table matrix values #6896
    • React UI: Fix new targets page not loading when using non-ASCII characters #6892
    • Remote read: Fix duplication of metrics read from remote storage with external labels #6967 #7018
    • Remote write: Register WAL watcher and live reader metrics for all remotes, not just the first one #6998
    • Scrape: Prevent removal of metric names upon relabeling #6891
    • Scrape: Fix 'superfluous response.WriteHeader call' errors when scrape fails under some circonstances #6986
    • Scrape: Fix crash when reloads are separated by two scrape intervals #7011
• Changes from 2.16.0
  • Features
    • React UI: Support local timezone on /graph #6692
    • PromQL: add absent_over_time query function #6490
    • Adding optional logging of queries to their own file #6520
  • Enhancements
    • React UI: Add support for rules page and…

This update for ansible, ansible1, ardana-ansible, ardana-cluster, ardana-freezer, ardana-input-model, ardana-logging, ardana-mq, ardana-neutron, ardana-octavia, ardana-osconfig, caasp-openstack-heat-templates, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, kibana, openstack-dashboard, openstack-dashboard-theme-HPE, openstack-heat-templates, openstack-keystone, openstack-monasca-agent, openstack-monasca-installer, openstack-neutron, openstack-octavia-amphora-image, python-Django, python-Flask, python-GitPython, python-Pillow, python-amqp, python-apicapi, python-keystoneauth1, python-oslo.messaging, python-psutil, python-pyroute2, python-pysaml2, python-tooz, python-waitress, storm contains the following fixes:

The update fixes several security issues:

ansible

• CVE-2019-3828: Fixed a path traversal in the fetch module (bsc#1126503).

grafana

• CVE-2020-13379: Fixed an incorrect access control issue which could lead to information leaks or denial of service (bsc#1172409).
• CVE-2020-12052: Fixed an cross site scripting vulnerability related to the annotation popup (bsc#1170657).

kibana

• CVE-2020-10743: Fixed a clickjacking vulnerability (bsc#1171909).

python-Django

• CVE-2020-13254: Fixed a data leakage via malformed memcached keys. (bsc#1172167)
• CVE-2020-13596: Fixed a cross site scripting vulnerability related to the admin parameters of the ForeignKeyRawIdWidget. (bsc#1172166)

python-Flask

• CVE-2019-1010083: Fixed a denial of service via crafted encoded JSON. (bsc#1141968)

python-Pillow

• CVE-2019-16865: Fixed a denial of service with specially crafted image files. (bsc#1153191)
• CVE-2020-5312: Fixed a buffer overflow in the PCX P mode. (bsc#1160152)
• CVE-2020-5313: Fixed a buffer overflow related to FLI. (bsc#1160153)
• CVE-2019-19911: Fixed a denial of service in FpxImagePlugin.py. (bsc#1160192)

python-psutil

• CVE-2019-18874: Fixed a double free caused by refcount mishandling. (bsc#1156525)

python-pysaml2

• CVE-2020-5390: Fixed an issue with the verification of signatures in SAML documents. (bsc#1160851)
• CVE-2017-1000246: Fixed an issue with weak encryption data, caused by initialization vector reuse. (bsc#1068612)

python-waitress (to version 1.4.3)

• CVE-2019-16785: Fixed HTTP request smuggling through LF vs CRLF handling. (bsc#1161088)
• CVE-2019-16786: Fixed HTTP request smuggling through invalid Transfer-Encoding. (bsc#1161089)
• CVE-2019-16789: Fixed HTTP Request Smuggling through Invalid whitespace characters. (bsc#1160790)
• CVE-2019-16792: Fixed HTTP Request Smuggling through Content-Length header handling. (bsc#1161670)

rubygem-activeresource

• CVE-2020-8151: Fixed information disclosure issue via specially crafted requests. (bsc#1171560)

rubygem-json-1_7

• CVE-2020-10663: Fixed an unsafe object creation vulnerability. (bsc#1167244)

rubygem-puma

• CVE-2020-11077: Fixed a HTTP smuggling issue related to proxy usage. (bsc#1172175)
• CVE-2020-11076: Fixed a HTTP smuggling issue when using an invalid transfer-encoding header. (bsc#1172176)

Other non-security fixes in in the update below:

Changes in ansible:

• Add 0001-Disallow-use-of-remote-home-directories-containing-..patch (bsc#1126503, CVE-2019-3828)

Changes in ansible1:

• Add 0001-Disallow-use-of-remote-home-directories-containing-..patch (bsc#1126503, CVE-2019-3828)

Changes in ardana-ansible:

• Update to version 8.0+git.1589740980.6c3bcdc:

  • Reconfigure rabbitmq user permissions on update (SOC-11082)

• Update to version 8.0+git.1588953487.9bfd5cb:

  • Fix incorrect prefix used to collect supportconfig files (bsc#1171273)

• Update to version 8.0+git.1585690828.81d8f45:

  • Cleanup keystone-ansible (bsc#1108719)

Changes in ardana-cluster:

• Update to version 8.0+git.1585685203.3e71e49:
  • Use bool filter to ensure valid boolean evaluation (SOC-11192)

Changes in ardana-freezer:

• Update to version 8.0+git.1586539529.b7d295f:
  • Recovering Cloud8 using Freezer or SSH backups…

This update fixes the following issues:

cobbler:

• Calculate relative path for kernel and inited when generating grub entry (bsc#1170231) Added: fix-grub2-entry-paths.diff
• Fix os-release version detection for SUSE Modified: sles15.patch
• Jinja2 template library fix (bsc#1141661)
• Removes string replace for textmode fix (bsc#1134195)

golang-github-prometheus-node_exporter:

• Update to 0.18.1
  • [BUGFIX] Fix incorrect sysctl call in BSD meminfo collector, resulting in broken swap metrics on FreeBSD #1345
  • [BUGFIX] Fix rollover bug in mountstats collector #1364
  • Renamed interface label to device in netclass collector for consistency with
  • other network metrics #1224
  • The cpufreq metrics now separate the cpufreq and scaling data based on what the driver provides. #1248
  • The labels for the network_up metric have changed, see issue #1236
  • Bonding collector now uses mii_status instead of operstatus #1124
  • Several systemd metrics have been turned off by default to improve performance #1254
  • These include unit_tasks_current, unit_tasks_max, service_restart_total, and unit_start_time_seconds
  • The systemd collector blacklist now includes automount, device, mount, and slice units by default. #1255
  • [CHANGE] Bonding state uses mii_status #1124
  • [CHANGE] Add a limit to the number of in-flight requests #1166
  • [CHANGE] Renamed interface label to device in netclass collector #1224
  • [CHANGE] Add separate cpufreq and scaling metrics #1248
  • [CHANGE] Several systemd metrics have been turned off by default to improve performance #1254
  • [CHANGE] Expand systemd collector blacklist #1255
  • [CHANGE] Split cpufreq metrics into a separate collector #1253
  • [FEATURE] Add a flag to disable exporter metrics #1148
  • [FEATURE] Add kstat-based Solaris metrics for boottime, cpu and zfs collectors #1197
  • [FEATURE] Add uname collector for FreeBSD #1239
  • [FEATURE] Add diskstats collector for OpenBSD #1250
  • [FEATURE] Add pressure collector exposing pressure stall information for Linux #1174
  • [FEATURE] Add perf exporter for Linux #1274
  • [ENHANCEMENT] Add Infiniband counters #1120
  • [ENHANCEMENT] Add TCPSynRetrans to netstat default filter #1143
  • [ENHANCEMENT] Move network_up labels into new metric network_info #1236
  • [ENHANCEMENT] Use 64-bit counters for Darwin netstat
  • [BUGFIX] Add fallback for missing /proc/1/mounts #1172
  • [BUGFIX] Fix node_textfile_mtime_seconds to work properly on symlinks #1326
• Add network-online (Wants and After) dependency to systemd unit bsc#1143913

golang-github-prometheus-prometheus:

• Update change log and spec file
  • Modified spec file: default to golang 1.14 to avoid 'have choice' build issues in OBS.
  • Rebase and update patches for version 2.18.0
  • Changed:
    • 0002-Default-settings.patch Changed
• Update to 2.18.0
  • Features
    • Tracing: Added experimental Jaeger support #7148
  • Changes
    • Federation: Only use local TSDB for federation (ignore remote read). #7096
    • Rules: rule_evaluations_total and rule_evaluation_failures_total have a rule_group label now. #7094
  • Enhancements
    • TSDB: Significantly reduce WAL size kept around after a block cut. #7098
    • Discovery: Add architecture meta label for EC2. #7000
  • Bug fixes
    • UI: Fixed wrong MinTime reported by /status. #7182
    • React UI: Fixed multiselect legend on OSX. #6880
    • Remote Write: Fixed blocked resharding edge case. #7122
    • Remote Write: Fixed remote write not updating on relabel configs change. #7073
• Changes from 2.17.2
  • Bug fixes
    • Federation: Register federation metrics #7081
    • PromQL: Fix panic in parser error handling #7132
    • Rules: Fix reloads hanging when deleting a rule group that is being evaluated #7138
    • TSDB: Fix a memory leak when prometheus starts with an empty TSDB WAL #7135
    • TSDB: Make isolation more robust to panics in web handlers #7129 #7136
• Changes from 2.17.1
  • Bug…

This update fixes the following issues:

dracut-saltboot:

• Print a list of available disk devices (bsc#1170824)
• Install wipefs to initrd
• Force install crypt modules

golang-github-prometheus-prometheus:

• Update change log and spec file
  • Modified spec file: default to golang 1.14 to avoid 'have choice' build issues in OBS.
  • Rebase and update patches for version 2.18.0
• Update to 2.18.0
  • Features
    • Tracing: Added experimental Jaeger support #7148
  • Changes
    • Federation: Only use local TSDB for federation (ignore remote read). #7096
    • Rules: rule_evaluations_total and rule_evaluation_failures_total have a rule_group label now. #7094
  • Enhancements
    • TSDB: Significantly reduce WAL size kept around after a block cut. #7098
    • Discovery: Add architecture meta label for EC2. #7000
  • Bug fixes
    • UI: Fixed wrong MinTime reported by /status. #7182
    • React UI: Fixed multiselect legend on OSX. #6880
    • Remote Write: Fixed blocked resharding edge case. #7122
    • Remote Write: Fixed remote write not updating on relabel configs change. #7073
• Changes from 2.17.2
  • Bug fixes
    • Federation: Register federation metrics #7081
    • PromQL: Fix panic in parser error handling #7132
    • Rules: Fix reloads hanging when deleting a rule group that is being evaluated #7138
    • TSDB: Fix a memory leak when prometheus starts with an empty TSDB WAL #7135
    • TSDB: Make isolation more robust to panics in web handlers #7129 #7136
• Changes from 2.17.1
  • Bug fixes
    • TSDB: Fix query performance regression that increased memory and CPU usage #7051
• Changes from 2.17.0
  • Features
    • TSDB: Support isolation #6841
    • This release implements isolation in TSDB. API queries and recording rules are guaranteed to only see full scrapes and full recording rules. This comes with a certain overhead in resource usage. Depending on the situation, there might be some increase in memory usage, CPU usage, or query latency.
  • Enhancements
    • PromQL: Allow more keywords as metric names #6933
    • React UI: Add normalization of localhost URLs in targets page #6794
    • Remote read: Read from remote storage concurrently #6770
    • Rules: Mark deleted rule series as stale after a reload #6745
    • Scrape: Log scrape append failures as debug rather than warn #6852
    • TSDB: Improve query performance for queries that partially hit the head #6676
    • Consul SD: Expose service health as meta label #5313
    • EC2 SD: Expose EC2 instance lifecycle as meta label #6914
    • Kubernetes SD: Expose service type as meta label for K8s service role #6684
    • Kubernetes SD: Expose label_selector and field_selector #6807
    • Openstack SD: Expose hypervisor id as meta label #6962
  • Bug fixes
    • PromQL: Do not escape HTML-like chars in query log #6834 #6795
    • React UI: Fix data table matrix values #6896
    • React UI: Fix new targets page not loading when using non-ASCII characters #6892
    • Remote read: Fix duplication of metrics read from remote storage with external labels #6967 #7018
    • Remote write: Register WAL watcher and live reader metrics for all remotes, not just the first one #6998
    • Scrape: Prevent removal of metric names upon relabeling #6891
    • Scrape: Fix 'superfluous response.WriteHeader call' errors when scrape fails under some circonstances #6986
    • Scrape: Fix crash when reloads are separated by two scrape intervals #7011
• Changes from 2.16.0
  • Features
    • React UI: Support local timezone on /graph #6692
    • PromQL: add absent_over_time query function #6490
    • Adding optional logging of queries to their own file #6520
  • Enhancements
    • React UI: Add support for rules page and 'Xs ago' duration displays #6503
    • React UI: alerts page, replace filtering togglers tabs with checkboxes #6543
    • TSDB: Export metric for WAL write errors #6647
    • TSDB: Improve query performance for queries that only touch…

This update for ansible, crowbar-core, crowbar-openstack, grafana, grafana-natel-discrete-panel, openstack-aodh, openstack-barbican, openstack-cinder, openstack-gnocchi, openstack-heat, openstack-ironic, openstack-magnum, openstack-manila, openstack-monasca-agent, openstack-murano, openstack-neutron, openstack-neutron-vpnaas, openstack-nova, openstack-sahara, python-Pillow, rubygem-crowbar-client fixes the following issues:

Security fixes included on this update:

for ansible:

• CVE-2020-1733,CVE-2020-10744: Fixed a race condition and insecure permissions which could have allowed another user on the node to gain control of the become user (bsc#1171823 and bsc#1164140).

for grafana:

• CVE-2020-11110, CVE-2018-18623, CVE-2018-18624, CVE-2018-18625: Fixed XSS vulnerabilities in dashboard due to an incomplete fix for CVE-2018-12099

for openstack-nova:

• CVE-2020-17376: Fixed an issue in which live migration failed to update persistent domain XML (bsc#1175484)

for python-pillow:

• CVE-2016-0775: Fixed a buffer overflow in FliDecode.c (bsc#965582)
• CVE-2020-10177: Fix-OOB-reads-in-FLI-decoding (bsc#1173413)
• CVE-2020-10994: Fix-bounds-overflow-in-JPEG-2000-decoding (bsc#1173418)
• CVE-2020-10378: Fix-bounds-overflow-in-PCX-decoding (bsc#1173416)

for rubygem-crowbar-client:

• CVE-2018-17954: Fixed an issue where provision leaks admin password to all nodes in cleartext (bsc#1117080)

Non-security fixes included on this update:

Changes in ansible:

• Update CVE-2020-10744_avoid_mkdir_p.patch to include missing parts and rename to CVE-2020-1733_avoid_mkdir_p.patch to make it clear which CVE is fixed there (bsc#1164140)

• Add CVE-2020-10744_avoid_mkdir_p.patch (bsc#1171823) to fix insecure temporary directory creation.

Changes in crowbar-core:

• Update to version 4.0+git.1600767499.0615a418f:

  • provisioner: check for client_user (SOC-11389)
  • crowbar: Also add access to /restricted/ in SSL vhost (SOC-11352)
  • crowbar: Allow hardware-installing -> discovering transition (noref)
  • crowbar: Add Restricted controller with API for restricted clients (bsc#1117080)
  • crowbar: Add complete list of states to Crowbar::State (noref)
  • provisioner: Remove the need for /updates/parse_node_data (noref)
  • crowbar: Create helper module to validate states (noref)
  • provisioner: Use new restricted API (bsc#1117080)
  • provisioner: Do not read /etc/crowbar.install.key from crowbar_joi (bsc#1117080)
  • provisioner: Remove use of privileged user for Windows machine (bsc#1117080)
  • provisioner: Use restricted client during provisioning (bsc#1117080)
  • provisioner: Use restricted client for crowbar_register (bsc#1117080)
  • provisioner: Drop /etc/crowbar.install.key bits from autoyast prof (bsc#1117080)
  • Avoid hardcoding machine-install user (bsc#1117080)
  • crowbar: Restrict admin access (bsc#1117080)

• Update to version 4.0+git.1600416364.5a9286e31:

  • Whitelist fixed CVEs in travis (noref)
  • Disable cookbook tests (noref)

Changes in crowbar-openstack:

• Update to version 4.0+git.1599037255.25b759234:
  • horizon: Update configuration for Grafana 5.x

Changes in grafana:

• BuildRequire go1.14 explicitly
• Add recompress source service
• Add go_modules source service to create vendor.tar.gz containing 3rd party go modules.
• Adjust spec to work for Grafana-6.7.4
• Adjust Makefile to work for Grafana-6.7.4
• Remove CVE-2019-15043.patch (merged upstream)
• Remove CVE-2020-13379.patch (merged upstream)
• Remove 0001-CVE-2020-12052-bsc1170657-XSS-annotation-popup-vulnerability.patch (merged upstream)
• Update to version 6.7.4 (bsc#1172450, CVE-2018-18623, CVE-2018-18624, CVE-2018-18625, bsc#1174583, CVE-2020-11110)
  • Only allow 32 hexadecimal digits for the avatar hash
  • 6.7.3 cherry-picks (#23808)
  • Fix CI for pushing a multi-architecture manifest (#23327)
  • AzureMonitor: Fix Log Analytics and Application Insights for Azure China (#21803) (#22753)
  • Revert 'grafana/data:…

This update for grafana and system-user-grafana fixes the following issues:

• Updated grafana to upstream version 7.3.1

  • CVE-2019-15043: In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana

  • CVE-2020-12245: Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip (bsc#1170557)

  • CVE-2020-13379: The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault (bsc#1172409)

  • CVE-2019-15043: In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana (bsc#1148383)

  • CVE-2020-12052: Grafana version below 6.7.3 is vulnerable for annotation popup XSS (bsc#1170657)

  • CVE-2020-24303: Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource. (bsc#1178243)

  • CVE-2018-18623: Grafana 5.3.1 has XSS via the 'Dashboard > Text Panel' screen (bsc#1172450)

  • CVE-2019-19499: Grafana versions below or equal to 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations (bsc#1175951)

  • Please refer to this package's changelog to get a full list of all changes (including bug fixes etc.)

• Initial shipment of system-user-grafana to SES 6

This update for ardana-neutron, ardana-swift, cassandra, crowbar-openstack, grafana, kibana, openstack-dashboard, openstack-ironic, openstack-neutron, openstack-neutron-gbp, openstack-nova, python-Django1, python-py, python-pysaml2, python-xmlschema, rubygem-activerecord-session_store, venv-openstack-keystone contains the following fixes:

Security fixes included in this update:

cassandra:

• CVE-2020-17516: Fixed an issue where encryption between nodes was not enforced correctly for certain internode_encryption settings (bsc#1181689)

grafana:

• CVE-2018-18623, CVE-2018-18624, CVE-2018-18625: Fixed multiple cross site scripting vulnerabilities in the dashboard. (bsc#1172450)
• CVE-2021-27358: Fixed a denial of service via remote API call. (bsc#1183803)
• CVE-2019-15043: Fixed a denial of service by an unauthenticated user in the snapshot HTTP API (bsc#1148383)
• CVE-2020-13379: Fixed an information leak to unauthenticated users. (bsc#1172409)
• CVE-2020-12052: Fixed a cross site scripting vulnerability with the annotation popup (bsc#1170657)
• CVE-2018-19039: Fixed an issue where a privileged user could exfiltrate files (bsc#1115960)
• CVE-2020-11110: Fixed a stored cross site scripting vulnerability. (bsc#1174583)
• CVE-2020-24303: Fixed a cross site scripting vulnerability in a query alias for ElasticSearch datasources (bsc#1178243)

kibana:

• CVE-2017-11499: Fixed a vulnerability in nodejs, related to the HashTable implementation, which could cause a denial of service. (bsc#1044849)
• CVE-2017-11481: Fixed a cross site scripting vulnerability via via URL fields. (bsc#1044849)
• CVE-2020-10743: Fixed a clickjacking issue because X-Frame-Option was not used by default. (bsc#1171909)

python-Django:

• CVE-2021-23336: Fixed a web cache poisoning via django.utils.http.limited_parse_qsl(). (bsc#1182433)
• CVE-2021-28658: Fixed a directory traversal via uploaded files. (bsc#1184148)
• CVE-2021-31542: Fixed a directory traversal via uploaded files with suitably crafted file names. (bsc#1185623)
• CVE-2021-33203: Fixed potential path-traversal via admindocs' TemplateDetailView. (bsc#1186608)
• CVE-2021-33571: Tighten validator checks to not allow leading zeros in IPv4 addresses, which potentially leads to further attacks. (bsc#1186611)

python-py:

• CVE-2020-29651: Fixed a denial of service via regular expressions. (bsc#1179805)

python-pysaml2:

• CVE-2021-21238: Fixed improper verification of cryptographic signatures for signed SAML documents. (bsc#1181277)
• CVE-2021-21239: Fixed improper verification of cryptographic signatures when using CryptoBackendXmlSec1(). (bsc#1181278)

rubygem-activerecord-session_store:

• CVE-2019-25025: Fixed a timing attacks targeting the session id which could allow an attack to hijack sessions. (bsc#1183174)

Non-security changes included in this update:

Changes in ardana-neutron:

• Update to version 9.0+git.1615223676.777f0b3:
  • Allow users to stop monitoring rootwrap daemon (bsc#1182317)

Changes in ardana-swift:

• Update to version 9.0+git.1618235096.90974ed:
  • Run swiftlm-scan in the UTC timezone (bsc#1181690)

Changes in cassandra:

• update to 3.11.10 (bsc#1181689, CVE-2020-17516)

• Fix digest computation for queries with fetched but non queried columns (CASSANDRA-15962)
• Reduce amount of allocations during batch statement execution (CASSANDRA-16201)
• Update jflex-1.6.0.jar to match upstream (CASSANDRA-16393)
• Fix DecimalDeserializer#toString OOM (CASSANDRA-14925)
• Rate limit validation compactions using compaction_throughput_mb_per_sec (CASSANDRA-16161)
• SASI's max_compaction_flush_memory_in_mb settings over 100GB revert to default of 1GB (CASSANDRA-16071)
• Prevent unbounded number of pending flushing tasks (CASSANDRA-16261)
• Improve empty hint file handling during startup (CASSANDRA-16162)
• Allow empty string in collections with COPY FROM in cqlsh (CASSANDRA-16372)
• Fix skipping on pre-3.0 created compact storage sstables due to missing primary…