CVE-2017-11499

Node.js v4.0 through v4.8.3, all versions of v5.x, v6.0 through v6.11.0, v7.0 through v7.10.0, and v8.0 through v8.1.3 was susceptible to hash flooding remote DoS attacks as the HashTable seed was constant across a given released version of Node.js. This was a result of building with V8 snapshots enabled by default which caused the initially randomized seed to be overwritten on startup.

This update for nodejs4 and nodejs6 fixes the following issues:

Security issues fixed:

• CVE-2017-1000381: The c-ares function ares_parse_naptr_reply() could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way. (bsc#1044946)
• CVE-2017-11499: Disable V8 snapshots. The hashseed embedded in the snapshot is currently the same for all runs of the binary. This opens node up to collision attacks which could result in a Denial of Service. We have temporarily disabled snapshots until a more robust solution is found. (bsc#1048299)

Non-security fixes:

• GCC 7 compilation fixes for v8 backported and add missing ICU59 headers (bsc#1041282)

• New upstream LTS release 6.11.1

  • https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.11.1

• New upstream LTS release 6.11.0

  • https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.11.0

• New upstream LTS release 6.10.3

  • https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.10.3

• New upstream LTS release 6.10.2

  • https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.10.2

• New upstream LTS release 6.10.1

  • https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.10.1

• New upstream LTS release 6.10.0

  • https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.10.0

• New upstream LTS release 4.8.4

  • https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.4

• New upstream LTS release 4.8.3

  • https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.3

• New upstream LTS release 4.8.2

  • https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.2

• New upstream LTS release 4.8.1

  • https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.1

• New upstream LTS release 4.8.0

  • https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.0

This update contains the Mozilla Firefox ESR 68.2 release.

Mozilla Firefox was updated to ESR 68.2 release:

• Enterprise: New administrative policies were added. More information and templates are available at the Policy Templates page.

• Various security fixes: MFSA 2019-33 (bsc#1154738)

  • CVE-2019-15903: Heap overflow in expat library in XML_GetCurrentLineNumber
  • CVE-2019-11757: Use-after-free when creating index updates in IndexedDB
  • CVE-2019-11758: Potentially exploitable crash due to 360 Total Security
  • CVE-2019-11759: Stack buffer overflow in HKDF output
  • CVE-2019-11760: Stack buffer overflow in WebRTC networking
  • CVE-2019-11761: Unintended access to a privileged JSONView object
  • CVE-2019-11762: document.domain-based origin isolation has same-origin- property violation
  • CVE-2019-11763: Incorrect HTML parsing results in XSS bypass technique
  • CVE-2019-11764: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2

Other Issues resolved:

• [bsc#1104841] Newer versions of firefox have a dependency on GLIBCXX_3.4.20
• [bsc#1074235] MozillaFirefox: background tab crash reports sent inadvertently without user opt-in
• [bsc#1043008] Firefox hangs randomly when browsing and scrolling
• [bsc#1025108] Firefox stops loading page until mouse is moved
• [bsc#905528] Firefox malfunctions due to broken omni.ja archives

This update for ardana-neutron, ardana-swift, cassandra, crowbar-openstack, grafana, kibana, openstack-dashboard, openstack-ironic, openstack-neutron, openstack-neutron-gbp, openstack-nova, python-Django1, python-py, python-pysaml2, python-xmlschema, rubygem-activerecord-session_store, venv-openstack-keystone contains the following fixes:

Security fixes included in this update:

cassandra:

• CVE-2020-17516: Fixed an issue where encryption between nodes was not enforced correctly for certain internode_encryption settings (bsc#1181689)

grafana:

• CVE-2018-18623, CVE-2018-18624, CVE-2018-18625: Fixed multiple cross site scripting vulnerabilities in the dashboard. (bsc#1172450)
• CVE-2021-27358: Fixed a denial of service via remote API call. (bsc#1183803)
• CVE-2019-15043: Fixed a denial of service by an unauthenticated user in the snapshot HTTP API (bsc#1148383)
• CVE-2020-13379: Fixed an information leak to unauthenticated users. (bsc#1172409)
• CVE-2020-12052: Fixed a cross site scripting vulnerability with the annotation popup (bsc#1170657)
• CVE-2018-19039: Fixed an issue where a privileged user could exfiltrate files (bsc#1115960)
• CVE-2020-11110: Fixed a stored cross site scripting vulnerability. (bsc#1174583)
• CVE-2020-24303: Fixed a cross site scripting vulnerability in a query alias for ElasticSearch datasources (bsc#1178243)

kibana:

• CVE-2017-11499: Fixed a vulnerability in nodejs, related to the HashTable implementation, which could cause a denial of service. (bsc#1044849)
• CVE-2017-11481: Fixed a cross site scripting vulnerability via via URL fields. (bsc#1044849)
• CVE-2020-10743: Fixed a clickjacking issue because X-Frame-Option was not used by default. (bsc#1171909)

python-Django:

• CVE-2021-23336: Fixed a web cache poisoning via django.utils.http.limited_parse_qsl(). (bsc#1182433)
• CVE-2021-28658: Fixed a directory traversal via uploaded files. (bsc#1184148)
• CVE-2021-31542: Fixed a directory traversal via uploaded files with suitably crafted file names. (bsc#1185623)
• CVE-2021-33203: Fixed potential path-traversal via admindocs' TemplateDetailView. (bsc#1186608)
• CVE-2021-33571: Tighten validator checks to not allow leading zeros in IPv4 addresses, which potentially leads to further attacks. (bsc#1186611)

python-py:

• CVE-2020-29651: Fixed a denial of service via regular expressions. (bsc#1179805)

python-pysaml2:

• CVE-2021-21238: Fixed improper verification of cryptographic signatures for signed SAML documents. (bsc#1181277)
• CVE-2021-21239: Fixed improper verification of cryptographic signatures when using CryptoBackendXmlSec1(). (bsc#1181278)

rubygem-activerecord-session_store:

• CVE-2019-25025: Fixed a timing attacks targeting the session id which could allow an attack to hijack sessions. (bsc#1183174)

Non-security changes included in this update:

Changes in ardana-neutron:

• Update to version 9.0+git.1615223676.777f0b3:
  • Allow users to stop monitoring rootwrap daemon (bsc#1182317)

Changes in ardana-swift:

• Update to version 9.0+git.1618235096.90974ed:
  • Run swiftlm-scan in the UTC timezone (bsc#1181690)

Changes in cassandra:

• update to 3.11.10 (bsc#1181689, CVE-2020-17516)

• Fix digest computation for queries with fetched but non queried columns (CASSANDRA-15962)
• Reduce amount of allocations during batch statement execution (CASSANDRA-16201)
• Update jflex-1.6.0.jar to match upstream (CASSANDRA-16393)
• Fix DecimalDeserializer#toString OOM (CASSANDRA-14925)
• Rate limit validation compactions using compaction_throughput_mb_per_sec (CASSANDRA-16161)
• SASI's max_compaction_flush_memory_in_mb settings over 100GB revert to default of 1GB (CASSANDRA-16071)
• Prevent unbounded number of pending flushing tasks (CASSANDRA-16261)
• Improve empty hint file handling during startup (CASSANDRA-16162)
• Allow empty string in collections with COPY FROM in cqlsh (CASSANDRA-16372)
• Fix skipping on pre-3.0 created compact storage sstables due to missing primary…

This update for crowbar-openstack, grafana, kibana, monasca-installer, python-Django, python-py, rubygem-activerecord-session_store contains the following fixes:

Security fixes included in this update:

crowbar-openstack:

• CVE-2016-8611: Added rate limiting for the '/images' API POST method (bsc#1005886).

grafana:

• CVE-2021-27358: Fixed a denial of service via remote API call (bsc#1183803)

kibana:

• CVE-2017-11499: Fixed a vulnerability in nodejs, related to the HashTable implementation, which could cause a denial of service (bsc#1044849)
• CVE-2017-11481: Fixed a cross site scripting vulnerability via via URL fields (bsc#1044849)

python-Django:

• CVE-2021-3281: Fixed a directory traversal via archive.extract() (bsc#1181379)
• CVE-2021-28658: Fixed a directory traversal via uploaded files (bsc#1184148)
• CVE-2021-31542: Fixed a directory traversal via uploaded files with suitably crafted file names (bsc#1185623)
• CVE-2021-33203:Fixed potential path-traversal via admindocs' TemplateDetailView (bsc#1186608)
• CVE-2021-33571: Tighten validator checks to not allow leading zeros in IPv4 addresses, which potentially leads to further attacks (bsc#1186611)

python-py:

• CVE-2020-29651: Fixed a denial of service via regular expressions (bsc#1179805)

rubygem-activerecord-session_store:

• CVE-2019-25025: Fixed a timing attacks targeting the session id which could allow an attack to hijack sessions (bsc#1183174)

Non-security fixes included in this update:

Changes in crowbar-openstack:

• Update to version 4.0+git.1616146720.44daffca0:
  • monasca: restart Kibana on update (bsc#1044849)

Changes in grafana_Update:

• Add CVE-2021-27358.patch (bsc#1183803, CVE-2021-27358)
  • Prevent unauthenticated remote attackers from causing a DoS through the snapshots API.

Changes in kibana_Update:

• Ensure /etc/sysconfig/kibana is present

• Update to Kibana 4.6.6 (bsc#1044849, CVE-2017-11499, ESA-2017-14, ESA-2017-16)

  • [4.6] ignore forked code for babel transpile build phase (#13483)
  • Allow more than match queries in custom filters (#8614) (#10857)
  • [state] don't make extra $location.replace() calls (#9954)
  • [optimizer] move to querystring-browser package for up-to-date api
  • [state/unhashUrl] use encode-uri-query to generate cleanly encoded urls
  • server: refactor log_interceptor to be more DRY (#9617)
  • server: downgrade ECANCELED logs to debug (#9616)
  • server: do not treat logged warnings as errors (#8746) (#9610)
  • [server/logger] downgrade EPIPE errors to debug level (#9023)
  • Add basepath when redirecting from a trailling slash (#9035)
  • [es/kibanaIndex] use unmapped_type rather than ignore_unmapped (#8968)
  • [server/shortUrl] validate urls before shortening them

• Add CVE-2017-11481.patch (bsc#1044849, CVE-2017-11481)

  • This fixes an XSS vulnerability in URL fields

• Remove %dir declaration from /opt/kibana/optimize to ensure no files owned by root end up in there

• Exclude /opt/kibana/optimize from %fdupes

• Restart service on upgrade

• Do not copy LICENSE.txt and README.txt to /opt/kibana

• Fix rpmlint warnings/errors

• Switch to explicit patch application

• Fix source URL

• Fix logic for systemd/systemv detection

Changes in monasca-installer_Update:

• Add support-influxdb-1.2.patch (SOC-11435)

Changes in python-Django_Update:

• Fixed potential path-traversal via admindocs' TemplateDetailView.(bsc#1186608, CVE-2021-33203)
• Prevented leading zeros in IPv4 addresses. (bsc#1186611, CVE-2021-33571)
• Add delegate-os-path-filename-generation-to-storage.patch (bsc#1185623)
  • Needed for CVE-2021-31542.patch to apply
• Tightened path & file name sanitation in file uploads. (bsc#1185623, CVE-2021-31542)
• Fixed potential directory-traversal via uploaded files. (bsc#1184148, CVE-2021-28658)
• Fixes a potential directory traversal when extracting archives. (bsc#1181379, CVE-2021-3281)

Changes in python-py_Update:

• Add CVE-2020-29651.patch (CVE-2020-29651, bsc#1179805)
  • svnwc: fix regular…

This update for ardana-cobbler, cassandra, cassandra-kit, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, kibana, openstack-heat-templates, openstack-monasca-installer, openstack-nova, python-Django, python-elementpath, python-eventlet, python-py, python-pysaml2, python-six, python-xmlschema fixes the following issues:

Security fixes included on this update:

cassandra-kit:

• CVE-2020-17516: Internode encryption enforcement vulnerability

cassandra:

• CVE-2020-17516: Internode encryption enforcement vulnerability
• CVE-2017-5929 logback: Fixed a serialization vulnerability in SocketServer and ServerSocketReceiver

crowbar-core: CVE-2020-26247: Potentially XXE or SSRF attacks by parsed Nokogiri::XML::Schema

grafana:

• CVE-2021-27358: Unauthenticated remote attackers to trigger a Denial of Service via a remote API call

kibana:

• CVE-2017-11481: Fixed an XSS via URL fields
• CVE-2017-11499: Fixed a constant hashtable seeds vulnerability

python-Django:

• CVE-2021-28658: Potential directory-traversal via uploaded files
• CVE-2021-31542: Potential directory-traversal via uploaded files
• CVE-2021-33203: Potential directory traversal via admindocs
• CVE-2021-33571: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses
• CVE-2021-23336: Fixed web cache poisoning via django.utils.http.limited_parse_qsl

python-eventlet:

• CVE-2021-21419: Improper handling of highly compressed data and memory allocation with excessive size value

python-pysaml2:

• CVE-2021-21238: Fixed an improper verification of cryptographic signatures for signed SAML documents
• CVE-2021-21239: Fixed an improper verification of cryptographic signatures when using CryptoBackendXmlSec1()_

python-py:

• CVE-2020-29651: Regular expression denial of service in svnwc.py

rubygem-activerecord-session_store:

• CVE-2019-25025: Fixed a hijack sessions by using timing attacks targeting the session id CVE-2019-16782

Non-security fixes included on this update:

Changes in ardana-cobbler:

• Update to version 8.0+git.1614096566.e8c2b27:
  • Change install_recommended to true (bsc#1181828)

Changes in cassandra:

• update to 3.11.10 (bsc#1181689, CVE-2020-17516)

• Fix digest computation for queries with fetched but non queried columns (CASSANDRA-15962)
• Reduce amount of allocations during batch statement execution (CASSANDRA-16201)
• Update jflex-1.6.0.jar to match upstream (CASSANDRA-16393)
• Fix DecimalDeserializer#toString OOM (CASSANDRA-14925)
• Rate limit validation compactions using compaction_throughput_mb_per_sec (CASSANDRA-16161)
• SASI's max_compaction_flush_memory_in_mb settings over 100GB revert to default of 1GB (CASSANDRA-16071)
• Prevent unbounded number of pending flushing tasks (CASSANDRA-16261)
• Improve empty hint file handling during startup (CASSANDRA-16162)
• Allow empty string in collections with COPY FROM in cqlsh (CASSANDRA-16372)
• Fix skipping on pre-3.0 created compact storage sstables due to missing primary key liveness (CASSANDRA-16226)
• Extend the exclusion of replica filtering protection to other indices instead of just SASI (CASSANDRA-16311)
• Synchronize transaction logs for JBOD (CASSANDRA-16225)
• Fix the counting of cells per partition (CASSANDRA-16259)
• Fix serial read/non-applying CAS linearizability (CASSANDRA-12126)
• Avoid potential NPE in JVMStabilityInspector (CASSANDRA-16294)
• Improved check of num_tokens against the length of initial_token (CASSANDRA-14477)
• Fix a race condition on ColumnFamilyStore and TableMetrics (CASSANDRA-16228)
• Remove the SEPExecutor blocking behavior (CASSANDRA-16186)
• Fix invalid cell value skipping when reading from disk (CASSANDRA-16223)
• Prevent invoking enable/disable gossip when not in NORMAL (CASSANDRA-16146)
• Wait for schema agreement when bootstrapping (CASSANDRA-15158)
• Fix the histogram merge of the table metrics (CASSANDRA-16259)
• Synchronize Keyspace instance store/clear…