CVE-2018-1288

In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.

In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.

In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.

In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.

In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.

In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.

These are all security issues fixed in the kafka-source-2.1.0-3.6 package on the GA media of openSUSE Tumbleweed.

This update for grafana, kafka, logstash and monasca-installer fixes the following issues:

The following security issues have been fixed:

grafana:

• CVE-2018-12099: Fix Cross-Site-Scripting (XSS) vulnerabilities in dashboard links. (bsc#1096985)

kafka:

• CVE-2018-1288: Authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss. (bsc#1102920)

logstash:

• CVE-2018-3817: Fix potential leak of sensitive data when logging warnings about deprecated options. (bsc#1090849)

Additionally, the following non-security issues have been fixed:

monasca-installer:

• Add complete set of elasticsearch performance tunables.
• Update to version Build_20180427_14.04 (bsc#1090192, bsc#1090343)
• Fix bad elasticsearch-curator configuration. (bsc#1090192)
• Enable bootstrap.memory_lock for Elasticsearch. (bsc#1090343)

logstash:

• Declare Gemfile as config to prevent loss of installed plugins when updating.
• Stop installing prebuilt jruby for non-x86.

kafka:

• Update to version 0.10.2.2 (bsc#1102920, CVE-2018-1288)
• Add noreplace directive for /etc/kafka/server.properties.
• Reduce package ownership of tmpfiles.d to bare minium. (SLE12 SP2)
• Set log rotation options. (bsc#1094448)
• Disable jmxremote debugging. (bsc#1095603)
• Increase open file limits. (bsc#1086909)

This update for ardana-monasca, ardana-spark, kafka, kafka-kit, openstack-monasca-api fixes the following issues:

This update for ardana-monasca to version 8.0+git.1535031421.9262a47 fixes these issues:

• Requests Apache to reload on change (bsc#1102662)
• Avoids managing non-Monasca users (bsc#1102662)
• Line up perms on storm.conf to match rpm (bsc#1094971)

This update for ardana-spark to version 8.0+git.1532114050.04654a8 fixes this issue:

• Only set log dir perms on legacy install (bsc#1094851)

This update for kafka to version 0.10.2.2 fixes this security issue:

• CVE-2018-1288: Authenticated Kafka users may have performed action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss (bsc#1102920).

This update for kafka to version 0.10.2.2 fixes these non-security issues:

• set internal.leave.group.on.close to false in KafkaStreams
• Improve message for Kafka failed startup with non-Kafka data in data.dirs
• add max_number _of_retries to exponential backoff strategy
• Mute logger for reflections.org at the warn level in system tests
• Kafka connect: error with special characters in connector name
• streams task gets stuck after re-balance due to LockException
• CachingSessionStore doesn't use the default keySerde.
• RocksDBSessionStore doesn't use default aggSerde.
• Recommended values for Connect transformations contain the wrong class name
• Kafka broker fails to start if a topic containing dot in its name is marked for delete but hasn't been deleted during previous uptime
• GlobalKTable does not checkpoint offsets after restoring state
• Log cleaning can increase message size and cause cleaner to crash with buffer overflow
• Some socket connections not closed after restart of Kafka Streams
• Distributed Herder Deadlocks on Shutdown
• Log cleaner fails due to large offset in segment file
• StreamsKafkaClient should not use StreamsConfig.POLL_MS_CONFIG
• Refactor kafkatest docker support
• ducktape kafka service: do not assume Service contains num_nodes
• Using _DUCKTAPE_OPTIONS has no effect on executing tests
• Connect WorkerSinkTask out of order offset commit can lead to inconsistent state
• RocksDB segments not removed when store is closed causes re-initialization to fail
• FetchMetadata creates unneeded Strings on instantiation
• SourceTask#stop() not called after exception raised in poll()
• Sink connectors that explicitly 'resume' topic partitions can resume a paused task
• GlobalStateManagerImpl should not write offsets of in-memory stores in checkpoint file
• Source KTable checkpoint is not correct
• ConnectSchema#equals() broken for array-typed default values

This update for openstack-monasca-api to version 2.2.1~dev24 fixes these issues:

• devstack: download storm from archive.apache.org
• Backport tempest test robustness improvements
• 1724543-fixed kafka partition creation error in devstack installation
• Fix:No alarms created if metric name in alarm def. expr. is mix case
• Zuul: Remove project name
• Run against Pike requirements