CVE-2015-3448

REST client for Ruby (aka rest-client) before 1.7.3 logs usernames and passwords, which allows local users to obtain sensitive information by reading the log.

REST client for Ruby (aka rest-client) before 1.7.3 logs usernames and passwords, which allows local users to obtain sensitive information by reading the log.

Updated ruby-rest-client packages fix security vulnerability:

When Ruby rest-client processes an HTTP redirection response, it blindly passes along the values from any Set-Cookie headers to the redirection target, regardless of domain, path, or expiration. This can be used in a session fixation attack or in stealing cookies (CVE-2015-1820).

REST Client for Ruby contains a flaw that is due to the application logging password information in plaintext. This may allow a local attacker to gain access to password information (CVE-2015-3448).

The ruby-rest-client package has been updated to version 1.8.0, fixing these issues and several other bugs. Refer to the upstream changelog for more details.

This update provides SUSE Studio Runner 1.3.14, which brings fixes for the following issues:

• bsc#968797: 11 SP3 appliance gets invalid distribution upgrade from SLMS.
• bsc#947225: Second build of appliance will not register to SLMS, wrong product name.
• bsc#983404: UEFI boot missing for SLE11 SP4.
• bsc#972406: Kiwi export config.sh script has /build-custom out of order.
• bsc#981095: Add user 'ldap' to default_users list for assigning owners for overlay files.
• bsc#972425: Runlevel 3 is being ignored in appliance configuration.
• bsc#983999: SLES 12 appliance build does not include gpg keys from base product.
• bsc#979110: SLES 12 will not build for EC2.
• bsc#929102: Plaintext Password Local Disclosure in rubygem-rest-client. (CVE-2015-3448)
• bsc#963741: Security fixes for Rails v3.2.22. (CVE-2015-7576, CVE-2015-7577, CVE-2016-0751, CVE-2016-0752)

This update for ardana-ansible, ardana-db, ardana-freezer, ardana-glance, ardana-input-model, ardana-nova, ardana-osconfig, ardana-tempest, caasp-openstack-heat-templates, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, documentation-suse-openstack-cloud, galera-python-clustercheck, openstack-cinder, openstack-glance, openstack-heat, openstack-horizon-plugin-monasca-ui, openstack-horizon-plugin-neutron-fwaas-ui, openstack-ironic, openstack-keystone, openstack-manila, openstack-monasca-agent, openstack-monasca-api, openstack-monasca-persister, openstack-monasca-persister-java, openstack-murano, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, openstack-octavia, python-Beaver, python-oslo.db, python-osprofiler, python-swiftlm, venv-openstack-magnum, venv-openstack-monasca, venv-openstack-monasca-ceilometer, venv-openstack-murano, venv-openstack-neutron fixes the following issues:

• Update to version 8.0+git.1560208949.67048e3:

  • Adds repository list parameter (bsc#1122825)

• Update to version 8.0+git.1564410318.f0cca2c:

  • Don't use 'latest' with 'zypper' (SOC-9997)

• Update to version 8.0+git.1564164977.ef9baeb:

  • Freezer Config file is mixed case (SOC-9700)

• Update to version 8.0+git.1564491709.349d78e:

  • Default glance_default_store to rbd if SES enabled (SOC-8749)

• Update to version 8.0+git.1562848601.c3daff0:

  • Include memcached in the minimal ardana-ci model (SOC-9800)

• Update to version 8.0+git.1565388406.c6abb8d:

  • Make default/rpc_response_timeout configurable (SOC-9285)

• Update to version 8.0+git.1562943864.e04a92f:

  • Resolves nova-novncproxy random status failures (SOC-9574)

• Update to version 8.0+git.1560180700.bd26898:

  • Adding support for qemu-ovmf to ardana (SOC-8985)

• Update to version 8.0+git.1563383198.c7fd9b4:

  • Add an global_filter entry to lvm.conf (bsc#1140512)

• Update to version 8.0+git.1559761021.5605746:

  • Enable FCOE for SUSE platform family (SCRD-8562)

• Update to version 8.0+git.1562849010.73bc517:

  • Fix Keystone only deployment tempest testing (SOC-9800)

• Update to version 8.0+git.1560764545.6c8d2dc:

  • Install manila tempest tests package (SOC-7496)

• Update to version 8.0+git.1560330843.b7d807c:

  • Add configuration for manila-tempest-plugin (SOC-7496)

• Update to version 1.0+git.1560518045.ad7dc6d:

  • Patching node before bootstraping

• Update to version 5.0+git.1565280360.01fed6905:

  • batch: Fix get_proposal_json (SOC-9954)
  • batch: Format crowbar batch error output (SOC-9954)
  • batch: Format crowbar batch error output (SOC-9954)

• Update to version 5.0+git.1564657662.75174c965:

  • travis: Whitelist CVE-2015-3448 (SOC-9911)
  • travis: Use env variable for commit range (SOC-9911)
  • Use proper names for the Travis Tests (SOC-9565)
  • Replace Danger with Gitlint (SOC-9565)
  • Switch from Travis dist from Trusty to Xenial (SOC-9565)

• Update to version 5.0+git.1563983933.03880f1c8:

  • dns: fix migration for designate

• Update to version 5.0+git.1562080799.f2dd7d0dd:

  • network: Don't set datapath-ids on ovs-bridges anymore
  • crowbar: Save sync_mark attributes in databag

• Update to version 5.0+git.1561648142.b6be652e9:

  • dns: forwards dns queries to dns-master when using desingate
  • dns: write admin network in ip/mask notation for bind9
  • dns: skip installing designate-rndc-key on non-master nodes
  • dns: fix designate migration
  • dns: allow using dns-server as designate target
  • bind: Allow new zones configured via rndc
  • bind: Disable listening on IPv6 addresses for now

• Update to version 5.0+git.1561465092.4dc67a7fa:

  • travis: pin sexp_processor to 4.12.0

• Update to version 5.0+git.1561380950.b4e37c0e2:

  • deployer: Use dhcp on crowbar_register only when enable_pxe is set (bsc#1132654)
  • network: Allow locking down the network config for nodes (bsc#1120657)

• Update to version 5.0+git.1562069707.e2de18c:

  • Add timeout multiplier
  • Make default sync_mark timeout…

This update for ardana-ansible, ardana-barbican, ardana-cinder, ardana-cluster, ardana-cobbler, ardana-db, ardana-designate, ardana-extensions-nsx, ardana-glance, ardana-heat, ardana-horizon, ardana-input-model, ardana-installer-ui, ardana-ironic, ardana-keystone, ardana-logging, ardana-magnum, ardana-monasca, ardana-mq, ardana-neutron, ardana-nova, ardana-octavia, ardana-opsconsole, ardana-opsconsole-ui, ardana-osconfig, ardana-service, ardana-ses, ardana-swift, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, java-monasca-common, java-monasca-common-kit, openstack-ceilometer, openstack-cinder, openstack-designate, openstack-heat, openstack-horizon-plugin-neutron-fwaas-ui, openstack-horizon-plugin-neutron-lbaas-ui, openstack-horizon-plugin-neutron-vpnaas-ui, openstack-ironic, openstack-ironic-python-agent, openstack-keystone, openstack-magnum, openstack-manila, openstack-monasca-notification, openstack-monasca-persister, openstack-monasca-persister-java, openstack-monasca-persister-java-kit, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, openstack-octavia, openstack-tempest, python-ardana-configurationprocessor, python-cinder-tempest-plugin, python-ironicclient, python-keystonemiddleware, python-monasca-tempest-plugin, python-openstackclient, python-openstacksdk, python-proliantutils, python-python-engineio, python-swiftlm, python-vmware-nsx, python-vmware-nsxlib, yast2-crowbar fixes the following issues:

• Update to version 9.0+git.1566374020.301191f:

  • Use raw image format when using SES backend on Nova (SOC-9285)

• Update to version 9.0+git.1563375514.31fa9a7:

  • Ensure ardana-update-pkgs works for dist-upgrade (SOC-9857)

• Update to version 9.0+git.1563192450.30e8f16:

  • Ensure Cloud8/SLE-12-SP3 repps still served (SOC-9840)

• Update to version 9.0+git.1566251498.be02ca4:

  • adds ipv6 format to http/https urls (SOC-10063)

• Update to version 9.0+git.1565678764.c3a9b9f:

  • adds ipv6 format to urls (SOC-10063)

• Update to version 9.0+git.1562898832.1731f25:

  • FIX broken symlink for policy.yaml.j2. (SOC-0000)

• Update to version 9.0+git.1559333871.40508f7:

  • Allow system to bind to non local ipv6 addresses (SOC-9330)

• Update to version 9.0+git.1566336494.93967dd:

  • Using python netaddr for ipv6 address comparison (SOC-9940)

• Update to version 9.0+git.1564409964.b7e4fc3:

  • Don't use 'latest' with 'zypper' (SOC-9997)

• Update to version 9.0+git.1562182567.aef23e0:

  • Format curl commands for ipv6 (SOC-9369)

• Update to version 9.0+git.1565680593.df7a432:

  • adds ipv6 format to urls (SOC-10063)

• Update to version 9.0+git.1566213657.69862ab:

  • Add missing service plugin for l2gw (SOC-5837)

• Update to version 9.0+git.1563904379.31ff1e9:

  • Add the NSX-T L2-Gateway Service definition (SOC-5837)

• Switch to new Gerrit Server

• Update to version 9.0+git.1566375806.f0b2333:

  • Configure glance image_direct_url/multiple_locations (SOC-9285)

• Update to version 9.0+git.1565720518.c7fdca2:

  • adds ipv6 format to urls (SOC-10063)

• Update to version 9.0+git.1564491141.602fdf9:

  • Default glance_default_store to rbd if SES enabled (SOC-8749)

• Update to version 9.0+git.1565721273.f44b8d7:

  • adds ipv6 format to urls (SOC-10063)

• Update to version 9.0+git.1565891518.2a545a1:

  • adds ipv6 format to urls (SOC-10063)

• Update to version 9.0+git.1565655129.ab3a58c:

  • Removed None condition from rule (SOC-10003)

• Update to version 9.0+git.1564609155.033a963:

  • Updated heat_policy.json permission to be 664 (SOC-9872)

• Update to version 9.0+git.1562848565.91e75b2:

  • Include memcached in the minimal ardana-ci model (SOC-9800)

• Update to version 9.0+git.1566255088.3443670:

  • Add server state column (SOC-9957)

• Update to version 9.0+git.1565218199.868c5d1:

  • Add ipv6 support (SOC-9677) (#357)

• Update to version 9.0+git.1563912815.7090c20:

  • Only show ses config upload option when ses is not configured (SOC-8555)…

This update for ardana-ansible, ardana-glance, ardana-horizon, ardana-input-model, ardana-manila, ardana-neutron, ardana-nova, ardana-octavia, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, galera-3, grafana, mariadb, mariadb-connector-c, novnc, openstack-cinder, openstack-glance, openstack-heat, openstack-horizon-plugin-neutron-vpnaas-ui, openstack-keystone, openstack-monasca-installer, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, python-amqp, python-ovs, python-pysaml2, python-python-engineio, python-urllib3, release-notes-suse-openstack-cloud, rubygem-easy_diff, rubygem-rest-client-1_6, venv-openstack-keystone contains the following fixes:

• Update to version 8.0+git.1566374355.c509923:

  • Use raw image format when using SES backend on Nova (SOC-9285)

• Update to version 8.0+git.1566376789.be0fe01:

  • Configure glance image_direct_url/multiple_locations (SOC-9285)

• Update to version 8.0+git.1565816064.5d4f73f:

  • Removed None condition from rule (SOC-10003)

• Update to version 8.0+git.1566517401.98450e6:

  • Add neutron-fwaas.json when neutron-l3-agent is deployed (SOC-10280)

• Update to version 8.0+git.1568835837.2452e7a:

  • Ensure Manila services don't auto start on reboot (SOC-10641)

• Update to version 8.0+git.1568220097.74ee4b4:

  • API extension paths separated by colon (SOC-10447)

• Update to version 8.0+git.1567555448.5ecd5b0:

  • Add dependent services to neutron services (SOC-8746)

• Update to version 8.0+git.1566517377.f2a8c54:

  • Add policy.d/neutron-fwaas.json.j2 (SOC-10280)

• Update to version 8.0+git.1566902754.c58ff69:

  • Install libosinfo package (SOC-10295)

• Update to version 8.0+git.1565946419.a76c00e:

  • Set diskcachemode and disk discard when using RBD (SOC-10182)

• Update to version 8.0+git.1568373448.bcaee7e:

  • Make octavia heartbeat frequency options configurable (SOC-9285)

• Update to version 8.0+git.1566374572.a3c91d9:

  • Include SES variables when configuring image (SOC-9285)

• Update to version 8.0+git.1566208257.5213d93:

  • Use default values for amphora connection retries/timeout (SOC-9285)

• Update to version 8.0+git.1566471887.fd2fec7:

  • Delete existing run filter before deploying it (SOC-10287)

• Update to version 5.0+git.1569597589.1f025c557:

  • barclamp_lib: Sync timeout with other barclamps (SOC-10513, SOC-10011)

• Update to version 5.0+git.1569231378.ac645b753:

  • Revert 'batch: Use easy_merge for merging (SOC-10505)'

• Update to version 5.0+git.1569103607.ee4a6cbc9:

  • upgrade: Fix pie chart colors on dashboard (SOC-10619)

• Update to version 5.0+git.1568983947.70c39b8c7:

  • batch: Use easy_merge for merging (SOC-10505)

• Update to version 5.0+git.1568317972.dfb856def:

  • upgrade: Fix pre-checks tests (SOC-9868)
  • Allow designate rndc for all nodes (SOC-10339)

• Update to version 5.0+git.1568210854.4f87b86f8:

  • gems: Update easy_diff to 1.0.0 (SOC-10505)

• Update to version 5.0+git.1567531836.e06d68030:

  • Public ips for dns nodes when designate integration is in use (SOC-9635)

• Update to version 5.0+git.1567513044.e9ef28b03:

  • crowbar: Do not read /etc/crowbar.install.key in non-SUSE init script
  • transition.sh: Do not read /etc/crowbar.install.key
  • gather_logs: Make it a bit useful again
  • gather_logs: Do not read /etc/crowbar.install.key
  • network: Check existing upper layers before bond setup (bsc#1120657)
  • network: never plug two interface into the same ovs bridge (bsc#1120657)
  • network: Avoid plugging the same interface to two ovs bridges (bsc#1120657)
  • nic library: some helper for identifying base interface (bsc#1120657)
  • network: Rework the vlan port replugging code (bsc#1120657)
  • network: DRY out 'kill_nic_files' (noref)

• Update to version 5.0+git.1567161136.fa34ac9f2:

  • Add CVE-2019-5477 the to travis ignore list (SOC-9635)

• Update to version 5.0+git.1567094388.48f2be817:

  • upgrade: Add more prechecks for 8->9 (SOC-9868)

• Update…

This update for crowbar-core, crowbar-openstack, openstack-horizon-plugin-monasca-ui, openstack-monasca-api, openstack-monasca-log-api, openstack-neutron, rubygem-puma, rubygem-rest-client contains the following fixes:

Security issue fixed for rubygem-puma:

• CVE-2019-16770: Fixed a potential denial of service in Puma's reactor (bsc#1158675, jsc#SOC-10999)

Security issue fixed for rubygem-rest-client:

• CVE-2015-3448: Fixed a plain text local password disclosure. (bsc#917802)

Updates for crowbar-core:

• Update to version 4.0+git.1574788924.e4a6aeb0c:

  • Allow pacemaker remotes for upgrade (SOC-10133)

• Update to version 4.0+git.1574713660.972029d1a:

  • Ignore CVE-2019-13117 in CI builds (bsc#1157028)

Updates for crowbar-openstack:

• Update to version 4.0+git.1574869671.9c7bade2d:

  • tempest: configure Kibana version (SOC-10131)

• Update to version 4.0+git.1574764112.c260c70e5:

  • horizon: install lbaas horizon dashboard (SOC-10883)

Updates for openstack-horizon-plugin-monasca-ui:

• Refresh allow-raw-grafana-links.patch
• update to version 1.5.5~dev3
  • Replace openstack.org git:// URLs with https://
  • Fix the partial missing metrics in Create Alarm Definition flow
  • import zuul job settings from project-config
  • Fix incorrect splitting of dimension in ProxyView
  • Fix Alarm status Panel on Overview page
  • Change IntegerField to ChoiceField for notification period
  • Imported Translations from Zanata
  • Display unique metric names for alarm
  • Fix Alarm Details section in Alarm History view
  • Fix validators for creating and editing notifications
  • Center the text for the button Deterministic
  • Adding title to Filter Alarms pop-up
  • Fix misleading validation error
  • Fix nit found in monasca-ui
  • Fix Breadcrumbs
  • Fix description for name field
  • Fixing 'Create Alarm Definition' for IE11
  • Imported Translations from Zanata

Updates to openstack-monasca-api:

• added fix-metric-name-offset.patch (SOC-10131)
• removed 0001-Fix-InfluxDB-repository-list_dimension_values-to-sup.patch (merged upstream)
• update to version 1.7.1~dev18
  • Replace openstack.org git:// URLs with https://
  • import zuul job settings from project-config
  • Upgrade Apache Storm to 1.0.6
  • Zuul: Remove project name

Updates to openstack-monasca-log-api:

• added fix-tempest-region.patch (SOC-10131)
• update to version 1.4.3~dev3
  • Replace openstack.org git:// URLs with https://
  • import zuul job settings from project-config
  • Avoid tox_install.sh for constraints support

Updates to openstack-neutron:

• neutron: Remove stop action from ovs-cleanup (bsc#1157482) backport of https://review.opendev.org/#/c/695867/

REST client for Ruby (aka rest-client) before 1.7.3 logs usernames and passwords, which allows local users to obtain sensitive information by reading the log.