CVE-2018-1000808

Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.

It was discovered that pyOpenSSL incorrectly handled memory when performing operations on a PKCS #12 store. A remote attacker could possibly use this issue to cause pyOpenSSL to consume resources, resulting in a denial of service.

This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection that would cause the calling application to reload certificates from a PKCS #12 store. This vulnerability appears to have been fixed in 17.5.0.

Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.

Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.

This update for ardana-ansible, ardana-cobbler, ardana-db, ardana-heat, ardana-manila, ardana-neutron, ardana-nova, ardana-octavia, ardana-osconfig, ardana-service, ardana-ses, ardana-swift, ardana-tempest, crowbar, crowbar-core, crowbar-ha, crowbar-openstack, documentation-suse-openstack-cloud, galera-python-clustercheck, openstack-dashboard, openstack-ec2-api, openstack-heat, openstack-heat-templates, openstack-horizon-plugin-ironic-ui, openstack-horizon-plugin-magnum-ui, openstack-horizon-plugin-sahara-ui, openstack-ironic, openstack-keystone, openstack-magnum, openstack-manila, openstack-monasca-api, openstack-monasca-notification, openstack-monasca-persister, openstack-murano, openstack-neutron, openstack-neutron-fwaas, openstack-nova, openstack-octavia, openstack-sahara, openstack-swift, openstack-tempest, python-cinderclient, python-cryptography, python-monasca-common, python-networking-hyperv, python-os-brick, python-venvjail, venv-openstack-aodh, venv-openstack-barbican, venv-openstack-ceilometer, venv-openstack-cinder, venv-openstack-designate, venv-openstack-freezer, venv-openstack-glance, venv-openstack-heat, venv-openstack-horizon, venv-openstack-ironic, venv-openstack-keystone, venv-openstack-magnum, venv-openstack-manila, venv-openstack-monasca, venv-openstack-monasca-ceilometer, venv-openstack-murano, venv-openstack-nova, venv-openstack-octavia, venv-openstack-sahara, venv-openstack-swift, venv-openstack-trove fixes the following issues:

This update fixes the following issues:

ardana-ansible:

• Move manila to the correct location in verb action list files (SCRD-6812)
• Enable manila service in verb action list files (SCRD-6812)
• Improve user experience (bsc#1114632)

ardana-cobbler:

• gate cobbler import on distro existence (SCRD-6821)

ardana-db:

• xtrabackup no longer needed (SCRD-7640, bsc#1116686)

ardana-heat:

• Fix typo so that heat gets correct name for hostname certs (bsc#127227)

ardana-manila:

• Put all config into one template (SCRD-7770)
• Fail when Manila service is not running (SCRD-7413)
• Split Manila API and Share deployment (SCRD-7773)
• Comment out example backends (bsc#1116501)

ardana-neutron:

• Fix misspelled variable names (SCRD-7836)
• Neutron services require network service to be started (SCRD-7764)

ardana-nova:

• Add dosfstools as requirement for nova-comptue (SCRD-8175)

ardana-octavia:

• Remove octavia dependency from monasca (SCRD-7690)

ardana-osconfig:

• Clean up ifcfg- files left behind by udevadm (bsc#1105822)

ardana-service:

• Add support for deprecated encryption-key parameter (SCRD-7837)

ardana-ses:

• Run SWF-PRX tasks in dedicated play (SCRD-8602)
• Make SES globals available to SWF (SCRD-8109)
• Add symlink ceph.conf.j2 to ~/openstack/my_cloud/config/ses (bsc#1128479)
• Add support for reusing clients (bsc#1122237)
• Ensure keyring files are readable (bsc#1122237)

ardana-swift:

• Prefer Kronos logrotate conf to Swift RPM logrotate conf (SCRD-7410)

ardana-tempest:

• Enable additional keystone tests (SCRD-7496)
• Enable domain specific drivers on tempest (SCRD-7496)
• Fix tempest heat plugin configuration (SCRD-7508)
• Add freezer to tempest available/testable list (SCRD-7496)
• Fix tempest configuration for magnum (SCRD-7496)
• Add missing test packages (SCRD-7496)
• Set cinder/glance admin on tempest roles (SCRD-7496)
• Update tempest test filters (SCRD-7496)
• Configure tempest accordingly when SES enabled (SCRD-7496)
• Merge test results from parallel and serial filters (SCRD-7784)

crowbar:

• install-chef-suse: filter comments from authorized_keys file

crowbar-core:

• crowbar: Do not rely on Chef::Util::FileEdit to write the file (bsc#1127752)
• Revert 'Disable upgrade API in Cloud8'
• upgrade: Make sure all compute nodes get compute related scripts
• network: run wicked ifdown for interface cleanup (bsc#1063535)

crowbar-ha:

• improve galera HA setup (bsc#1122875)

crowbar-openstack:

• ceilometer: Install package which contains cron file…

This update for python-cryptography, python-pyOpenSSL fixes the following issues:

Security issues fixed:

• CVE-2018-1000808: A memory leak due to missing reference checking in PKCS#12 store handling was fixed (bsc#1111634)

• CVE-2018-1000807: A use-after-free in X509 object handling was fixed (bsc#1111635)

• avoid bad interaction with python-cryptography package. (bsc#1021578)

This update for python-pyOpenSSL fixes the following issues:

• CVE-2018-1000807: Fixed a use-after-free in X509 object handling (bsc#1111635)
• CVE-2018-1000808: Fixed a use-after-free in PKCS #12 Store (bsc#1111634)

It was discovered that pyOpenSSL incorrectly handled memory when handling X509 objects. A remote attacker could use this issue to cause pyOpenSSL to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2018-1000807)

It was discovered that pyOpenSSL incorrectly handled memory when performing operations on a PKCS #12 store. A remote attacker could possibly use this issue to cause pyOpenSSL to consume resources, resulting in a denial of service. (CVE-2018-1000808)