CVE-2018-17954

An Improper Privilege Management in crowbar of SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud 9, SUSE OpenStack Cloud Crowbar 8, SUSE OpenStack Cloud Crowbar 9 allows root users on any crowbar managed node to cause become root on any other node. This issue affects: SUSE OpenStack Cloud 7 crowbar-core versions prior to 4.0+git.1578392992.fabfd186c-9.63.1, crowbar-. SUSE OpenStack Cloud 8 ardana-cinder versions prior to 8.0+git.1579279939.ee7da88-3.39.3, ardana-. SUSE OpenStack Cloud 9 ardana-ansible versions prior to 9.0+git.1581611758.f694f7d-3.16.1, ardana-. SUSE OpenStack Cloud Crowbar 8 crowbar-core versions prior to 5.0+git.1582968668.1a55c77c5-3.35.4, crowbar-. SUSE OpenStack Cloud Crowbar 9 crowbar-core versions prior to 6.0+git.1582892022.cbd70e833-3.19.3, crowbar-.

An Improper Privilege Management in crowbar of SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud 9, SUSE OpenStack Cloud Crowbar 8, SUSE OpenStack Cloud Crowbar 9 allows root users on any crowbar managed node to cause become root on any other node. This issue affects: SUSE OpenStack Cloud 7 crowbar-core versions prior to 4.0+git.1578392992.fabfd186c-9.63.1, crowbar-. SUSE OpenStack Cloud 8 ardana-cinder versions prior to 8.0+git.1579279939.ee7da88-3.39.3, ardana-. SUSE OpenStack Cloud 9 ardana-ansible versions prior to 9.0+git.1581611758.f694f7d-3.16.1, ardana-. SUSE OpenStack Cloud Crowbar 8 crowbar-core versions prior to 5.0+git.1582968668.1a55c77c5-3.35.4, crowbar-. SUSE OpenStack Cloud Crowbar 9 crowbar-core versions prior to 6.0+git.1582892022.cbd70e833-3.19.3, crowbar-.

A Least Privilege Violation vulnerability in crowbar of SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud 9, SUSE OpenStack Cloud Crowbar 8, SUSE OpenStack Cloud Crowbar 9 allows root users on any crowbar managed node to cause become root on any other node. This issue affects: SUSE OpenStack Cloud 7 crowbar-core versions prior to 4.0+git.1578392992.fabfd186c-9.63.1, crowbar-. SUSE OpenStack Cloud 8 ardana-cinder versions prior to 8.0+git.1579279939.ee7da88-3.39.3, ardana-. SUSE OpenStack Cloud 9 ardana-ansible versions prior to 9.0+git.1581611758.f694f7d-3.16.1, ardana-. SUSE OpenStack Cloud Crowbar 8 crowbar-core versions prior to 5.0+git.1582968668.1a55c77c5-3.35.4, crowbar-. SUSE OpenStack Cloud Crowbar 9 crowbar-core versions prior to 6.0+git.1582892022.cbd70e833-3.19.3, crowbar-.

An Improper Privilege Management in crowbar of SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud 9, SUSE OpenStack Cloud Crowbar 8, SUSE OpenStack Cloud Crowbar 9 allows root users on any crowbar managed node to cause become root on any other node. This issue affects: SUSE OpenStack Cloud 7 crowbar-core versions prior to 4.0+git.1578392992.fabfd186c-9.63.1, crowbar-. SUSE OpenStack Cloud 8 ardana-cinder versions prior to 8.0+git.1579279939.ee7da88-3.39.3, ardana-. SUSE OpenStack Cloud 9 ardana-ansible versions prior to 9.0+git.1581611758.f694f7d-3.16.1, ardana-. SUSE OpenStack Cloud Crowbar 8 crowbar-core versions prior to 5.0+git.1582968668.1a55c77c5-3.35.4, crowbar-. SUSE OpenStack Cloud Crowbar 9 crowbar-core versions prior to 6.0+git.1582892022.cbd70e833-3.19.3, crowbar-.

This update for crowbar-core, crowbar-openstack, openstack-neutron-fwaas, rubygem-crowbar-client contains the following fixes:

Security fixes for rubygem-crowbar-client:

• CVE-2018-17954: Fixed an issue where crowbar was leaking the secret admin passwords to all nodes (bsc#1117080)

Changes in crowbar-core:

• Update to version 4.0+git.1578392992.fabfd186c:

  • Avoid nil crash when provisioner attributes are not set (bsc#1160048)

• Update to version 4.0+git.1578294389.acc7385d5:

  • Adding CVE-2019-16770 to the ignore list, regarding SOC-10999.

Changes in crowbar-openstack:

• Update to version 4.0+git.1579171175.d53ab6363:
  • tempest: tempest run filters as templates (SOC-11052)
  • Add tempest filters based on services (SOC-9801)

Changes in openstack-neutron-fwaas:

• Remove the patch that was deleting the tempest entry point and enable tempest tests.

This update for ardana-cinder, ardana-cobbler, ardana-designate, ardana-extensions-example, ardana-extensions-nsx, ardana-glance, ardana-heat, ardana-input-model, ardana-ironic, ardana-keystone, ardana-logging, ardana-monasca, ardana-monasca-transform, ardana-mq, ardana-neutron, ardana-nova, ardana-octavia, ardana-osconfig, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, keepalived, mariadb, openstack-cinder, openstack-dashboard, openstack-dashboard-theme-SUSE, openstack-heat, openstack-heat-templates, openstack-horizon-plugin-designate-ui, openstack-horizon-plugin-neutron-lbaas-ui, openstack-ironic, openstack-keystone, openstack-monasca-agent, openstack-neutron, openstack-neutron-gbp, openstack-neutron-vsphere, openstack-nova, openstack-octavia, openstack-octavia-amphora-image, openstack-resource-agents, openstack-sahara, openstack-trove, python-cinderlm, python-congressclient, python-designateclient, python-ironic-lib, python-networking-cisco, python-osc-lib, python-oslo.context, python-oslo.rootwrap, python-oslo.serialization, python-oslo.service, python-stevedore, python-taskflow, rubygem-crowbar-client, rubygem-puma, venv-openstack-swift fixes the following issues: Security issues fixed:

The update of rubygem-crowbar-client, rubygem-puma fixes the following security issues:

• CVE-2018-17954: Fixed an issue where crowbar was leaking the secret admin passwords to all nodes (bsc#1117080).
• CVE-2019-16770: Fixed a denial-of-service vulnerability that was exploitable by clients sending extraneous keepalive requests (bsc#1158675).

The update of mariadb to 10.2.29 fixes several security issues:

• CVE-2020-2574: Fixed a difficult to exploit vulnerability that allowed an attacker to crash the client (bsc#1162388).
• CVE-2019-18901: Fixed a difficult to exploit vulnerability that allowed an attacker to crash the client (bsc#1162388).
• CVE-2017-1002201: Fixed an issue where special characters did not escpae properly (bsc#1155089)
• CVE-2019-2737, CVE-2019-2739, CVE-2019-2740, CVE-2019-2758, CVE-2019-2805, CVE-2019-2938, CVE-2019-2974: Fixed an issue where could lead a remote attacker to cause denial of service (bsc#1156669)

Non-security issues fixed:

Changes in ardana-cinder:

• Update to version 8.0+git.1579279939.ee7da88:

  • Add option to flatten snapshots when using SES (SOC-11054)

• Update to version 8.0+git.1571846011.1a2f62b:

  • SCRD-4764 move v2.0 endpoints to v3 (SOC-9753)

Changes in ardana-cobbler:

• Update to version 8.0+git.1575037115.0326803:
  • Set root device on SLES autoyast templates (SOC-7365)

Changes in ardana-designate:

• Update to version 8.0+git.1573597788.15b7984:
  • Update gerrit location (SOC-9140)

Changes in ardana-extensions-example:

• Switch to new Gerrit Server

• Update to version 8.0+git.1534266307.db1ec28:

  • SCPL-409 Fix .gitreview for stable/pike

Changes in ardana-extensions-nsx:

• Update to version 8.0+git.1567529036.a41a037:

  • Update policy json templates for vmware-nsx (SOC-10254)

• Switch to new Gerrit Server

Changes in ardana-glance:

• Update to version 8.0+git.1571846045.ab9e3ea:
  • SCRD-4764 move v2.0 endpoints to v3 (SOC-9753)

Changes in ardana-heat:

• Update to version 8.0+git.1571777596.14dce6a:
  • SCRD-4764 remove V2.0 auth end points (SOC-9753)

Changes in ardana-input-model:

• Update to version 8.0+git.1582147997.b9ed134:

  • Enable port security extension neutron (SOC-11027)

• Update to version 8.0+git.1573658751.38e822a:

  • Move manila share to controller (SOC-10938)

Changes in ardana-ironic:

• Update to version 8.0+git.1571845225.006843d:
  • SCRD-4764 remove V2.0 auth end points (SOC-9753)

Changes in ardana-keystone:

• Update to version 8.0+git.1573147067.09e3ea0:
  • enable debug and insecure_debug on demand (SOC-10934)

Changes in ardana-logging:

• Update to version 8.0+git.1572452293.e65d714:
  • use correct Keystone v3 params bsc#1117840 (SOC-9753)

Changes in ardana-monasca:

• Update to version 8.0+git.1572527728.9b34bdf: *…

This update for ardana-ansible, ardana-cinder, ardana-cobbler, ardana-db, ardana-horizon, ardana-input-model, ardana-monasca, ardana-mq, ardana-nova, ardana-octavia, ardana-osconfig, ardana-tempest, ardana-tls, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, keepalived, openstack-barbican, openstack-ceilometer, openstack-cinder, openstack-dashboard, openstack-dashboard-theme-SUSE, openstack-designate, openstack-heat, openstack-horizon-plugin-designate-ui, openstack-horizon-plugin-ironic-ui, openstack-horizon-plugin-neutron-lbaas-ui, openstack-horizon-plugin-octavia-ui, openstack-ironic, openstack-ironic-python-agent, openstack-keystone, openstack-magnum, openstack-monasca-agent, openstack-neutron, openstack-neutron-fwaas, openstack-neutron-gbp, openstack-neutron-vpnaas, openstack-nova, openstack-octavia, openstack-octavia-amphora-image, openstack-sahara, openstack-swift, python-amqp, python-ironic-lib, python-keystoneauth1, python-keystoneclient, python-keystonemiddleware, python-ovs, supportutils-plugin-suse-openstack-cloud, rubygem-crowbar-client, rubygem-puma, venv-openstack-horizon fixes the following issues:

Security issues fixed:

• CVE-2018-17954: Enabled restricted commands for Cloud 8 (bsc#1117080).
• CVE-2019-16770: Fixed a DoS vulnerability a malicious client could use to block a large amount of threads (bsc#1158675).

Non-security issues fixed:

Changes in ardana-ansible:

• Update to version 9.0+git.1581611758.f694f7d:

  • Don't run deprecated-vhost-removal on localhost (SOC-11098)

• Update to version 9.0+git.1580906085.40eb430:

  • simplify glance image upload (SOC-11089)

• Update to version 9.0+git.1580220034.3236aa5:

  • Ensure rabbitmq-server started after packages updated (SOC-11070)

• Update to version 9.0+git.1576060554.bdd84e6:

  • Fix grep for image details on service-guest-image (SOC-11012)

Changes in ardana-cinder:

• Update to version 9.0+git.1579256229.c8b4b38:

  • Add option to flatten snapshots when using SES (SOC-11054)

• Update to version 9.0+git.1574694613.04a8b74:

  • Ensure nfs-client installed for NetApp support (SOC-9005)

• Update to version 9.0+git.1574359983.c198cc9:

  • Add option for nfs_share configuration (SOC-9005)

Changes in ardana-cobbler:

• Update to version 9.0+git.1574950066.a3c4be4:

  • Set root device on SLES autoyast templates (SOC-7365)

• Update to version 9.0+git.1573845154.3545efd:

  • Change install_recommended to true (SOC-9005)

Changes in ardana-db:

• Update to version 9.0+git.1578936438.b9a9b95:

  • Switch to using override file in my.cnf.d (SOC-11043)

• Update to version 9.0+git.1578595169.57c5911:

  • account for pre-update nodes (SOC-11037)

Changes in ardana-horizon:

• Update to version 9.0+git.1575562864.8ed5e10:

  • Generate policy for Octavia dashboard (SOC-10883)

• Update to version 9.0+git.1575562860.2ce2851:

  • Fix policy configuration generation (SOC-10883)

Changes in ardana-input-model:

• Update to version 9.0+git.1580403439.d425462:

  • Enable port security extension neutron (SOC-11027)

• Update to version 9.0+git.1574953363.60cf58f:

  • octavia: use lbaasv2-proxy service plugin (SOC-10987)

Changes in ardana-monasca:

• Update to version 9.0+git.1579273481.4b8c46f:

  • Leverage schema conversion script for upgrade (SOC-10277)

• Update to version 9.0+git.1575919721.5c42222:

  • align Monasca DB schema with upstream prior to upgrade (SOC-10277)

Changes in ardana-mq:

• Update to version 9.0+git.1581024903.8e74867:

  • Ensure HA queue sync wait fails (SOC-11083)

• Update to version 9.0+git.1580934283.230ff8b:

  • Fix HA policy setting comments (SOC-10317, SOC-11082)

• Update to version 9.0+git.1580746285.da922ce:

  • Set HA policy accordingly (SOC-10317, SOC-11082)

• Update to version 9.0+git.1575405552.d84f662:

  • Change the HA policy mirror (SOC-10317)

Changes in ardana-nova:

• Update to version 9.0+git.1580304673.6c668eb:

  • Set notification_format to unversioned in nova.conf (bsc#1161721)

• Update to version…

This update for ardana-ansible, ardana-cinder, ardana-cobbler, ardana-installer-ui, ardana-opsconsole-ui, ardana-osconfig, crowbar-core, grafana, grafana-natel-discrete-panel, openstack-cinder, openstack-dashboard, openstack-ironic, openstack-ironic-python-agent, openstack-manila, openstack-neutron, openstack-neutron-infoblox, openstack-nova, python-Flask-Cors, rubygem-crowbar-client, storm, storm-kit, venv-openstack-cinder, venv-openstack-horizon fixes the following issues:

Security changes on this update:

grafana:

• CVE-2018-18623, CVE-2018-18624, CVE-2018-18625: Fixed multiple XSS vulnerabilities, caused by an incomplete fix for CVE-2018-12099 (bsc#1172450).
• CVE-2020-11110: Fixed a stored XSS in dashboard snapshots (bsc#1174583).

openstack-nova:

• CVE-2020-17376: Fixed an information leak during live migration (bsc#1175484).

python-Flask-Cors:

• CVE-2020-25032: Fixed a potential information leak through path traversal (bsc#1175986).

rubygem-crowbar-client:

• CVE-2018-17954: Fixed an issue where provision leaks admin password to all nodes in cleartext (bsc#1117080)

Non security changes on this update:

Changes in ardana-ansible:

• Ensure that installing SOC 9 triggers removal of any existing ardana-freezer package, which is not available for SOC 9 (SOC-9779)

• Update to version 9.0+git.1596813072.110811d:

  • Update the Swift XFS inode size check (SOC-10300)

• Update to version 9.0+git.1596487185.d56da1b:

  • Remove lingering Cloud9 development hack (SOC-5480)

• Update to version 9.0+git.1596479802.67906d5:

  • Enable SLE12 SP3 LTSS for SMT deployments (SOC-11223)

• Update to version 9.0+git.1596209332.4ce15a6:

  • Fix upgrade validations Keystone V3 check target (SOC-10300)

Changes in ardana-cinder:

• Update to version 9.0+git.1596129576.0b3d3ce:
  • Install python-swiftclient as cinder-backup dependency (SOC-11364)

Changes in ardana-cobbler:

• Update to version 9.0+git.1588258487.3acf8ad:
  • Rip out unsupported distributions (SOC-9008)

Changes in ardana-installer-ui:

• Ensure SOC 9 package obsoletes HOS 8 equivalent package (SOC-11184)

Changes in ardana-opsconsole-ui:

• Add BuildRequires for ardana-devel so that the ardana_description macro is defined.

• Ensure SOC 9 package obsoletes HOS 8 equivalent package (SOC-11184)

Changes in ardana-osconfig:

• Update to version 9.0+git.1597427032.a062830:
  • Check for HOS 8 release package being installed (SOC-11184)

Changes in crowbar-core:

• Update to version 6.0+git.1598519900.770074aa7:
  • upgrade: Allow transition from crowbar_upgrade to rebsct (trivial)

Changes in grafana:

• BuildRequire go1.14 explicitly
• Add recompress source service
• Add go_modules source service to create vendor.tar.gz containing 3rd party go modules.
• Adjust spec to work for Grafana-6.7.4
• Adjust Makefile to work for Grafana-6.7.4
• Remove CVE-2019-15043.patch (merged upstream)
• Remove CVE-2020-13379.patch (merged upstream)
• Remove 0001-CVE-2020-12052-bsc1170657-XSS-annotation-popup-vulnerability.patch (merged upstream)
• Update to version 6.7.4 (bsc#1172450, CVE-2018-18623, CVE-2018-18624, CVE-2018-18625, bsc#1174583, CVE-2020-11110)
  • Only allow 32 hexadecimal digits for the avatar hash
  • 6.7.3 cherry-picks (#23808)
  • Fix CI for pushing a multi-architecture manifest (#23327)
  • AzureMonitor: Fix Log Analytics and Application Insights for Azure China (#21803) (#22753)
  • Revert 'grafana/data: PanelTypeChangedHandler API update to use PanelModel instead of panel options object [BREAKING] (#22754)'
  • Bumped version
  • Snapshots: Sanitize orignal url (#23254)
  • Plugins: Expose promiseToDigest (#23249)
  • Variables: Do not update variable from url when value is the same (#23220)
  • DashboardSave: Add new dashboard check (#23104)
  • Fix: reverted back to import * as module instead of using namespaces (#23069)
  • BackendSrv: Adds config to response to fix external plugins that use this (#23032)
  • DataLinks: make sure we use…

This update for ansible, crowbar-core, crowbar-openstack, grafana, grafana-natel-discrete-panel, openstack-aodh, openstack-barbican, openstack-cinder, openstack-gnocchi, openstack-heat, openstack-ironic, openstack-magnum, openstack-manila, openstack-monasca-agent, openstack-murano, openstack-neutron, openstack-neutron-vpnaas, openstack-nova, openstack-sahara, python-Pillow, rubygem-crowbar-client fixes the following issues:

Security fixes included on this update:

for ansible:

• CVE-2020-1733,CVE-2020-10744: Fixed a race condition and insecure permissions which could have allowed another user on the node to gain control of the become user (bsc#1171823 and bsc#1164140).

for grafana:

• CVE-2020-11110, CVE-2018-18623, CVE-2018-18624, CVE-2018-18625: Fixed XSS vulnerabilities in dashboard due to an incomplete fix for CVE-2018-12099

for openstack-nova:

• CVE-2020-17376: Fixed an issue in which live migration failed to update persistent domain XML (bsc#1175484)

for python-pillow:

• CVE-2016-0775: Fixed a buffer overflow in FliDecode.c (bsc#965582)
• CVE-2020-10177: Fix-OOB-reads-in-FLI-decoding (bsc#1173413)
• CVE-2020-10994: Fix-bounds-overflow-in-JPEG-2000-decoding (bsc#1173418)
• CVE-2020-10378: Fix-bounds-overflow-in-PCX-decoding (bsc#1173416)

for rubygem-crowbar-client:

• CVE-2018-17954: Fixed an issue where provision leaks admin password to all nodes in cleartext (bsc#1117080)

Non-security fixes included on this update:

Changes in ansible:

• Update CVE-2020-10744_avoid_mkdir_p.patch to include missing parts and rename to CVE-2020-1733_avoid_mkdir_p.patch to make it clear which CVE is fixed there (bsc#1164140)

• Add CVE-2020-10744_avoid_mkdir_p.patch (bsc#1171823) to fix insecure temporary directory creation.

Changes in crowbar-core:

• Update to version 4.0+git.1600767499.0615a418f:

  • provisioner: check for client_user (SOC-11389)
  • crowbar: Also add access to /restricted/ in SSL vhost (SOC-11352)
  • crowbar: Allow hardware-installing -> discovering transition (noref)
  • crowbar: Add Restricted controller with API for restricted clients (bsc#1117080)
  • crowbar: Add complete list of states to Crowbar::State (noref)
  • provisioner: Remove the need for /updates/parse_node_data (noref)
  • crowbar: Create helper module to validate states (noref)
  • provisioner: Use new restricted API (bsc#1117080)
  • provisioner: Do not read /etc/crowbar.install.key from crowbar_joi (bsc#1117080)
  • provisioner: Remove use of privileged user for Windows machine (bsc#1117080)
  • provisioner: Use restricted client during provisioning (bsc#1117080)
  • provisioner: Use restricted client for crowbar_register (bsc#1117080)
  • provisioner: Drop /etc/crowbar.install.key bits from autoyast prof (bsc#1117080)
  • Avoid hardcoding machine-install user (bsc#1117080)
  • crowbar: Restrict admin access (bsc#1117080)

• Update to version 4.0+git.1600416364.5a9286e31:

  • Whitelist fixed CVEs in travis (noref)
  • Disable cookbook tests (noref)

Changes in crowbar-openstack:

• Update to version 4.0+git.1599037255.25b759234:
  • horizon: Update configuration for Grafana 5.x

Changes in grafana:

• BuildRequire go1.14 explicitly
• Add recompress source service
• Add go_modules source service to create vendor.tar.gz containing 3rd party go modules.
• Adjust spec to work for Grafana-6.7.4
• Adjust Makefile to work for Grafana-6.7.4
• Remove CVE-2019-15043.patch (merged upstream)
• Remove CVE-2020-13379.patch (merged upstream)
• Remove 0001-CVE-2020-12052-bsc1170657-XSS-annotation-popup-vulnerability.patch (merged upstream)
• Update to version 6.7.4 (bsc#1172450, CVE-2018-18623, CVE-2018-18624, CVE-2018-18625, bsc#1174583, CVE-2020-11110)
  • Only allow 32 hexadecimal digits for the avatar hash
  • 6.7.3 cherry-picks (#23808)
  • Fix CI for pushing a multi-architecture manifest (#23327)
  • AzureMonitor: Fix Log Analytics and Application Insights for Azure China (#21803) (#22753)
  • Revert 'grafana/data:…