CVE-2019-3871

A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. An insufficient validation of data coming from the user when building a HTTP request from a DNS query in the HTTP Connector of the Remote backend, allowing a remote user to cause a denial of service by making the server connect to an invalid endpoint, or possibly information disclosure by making the server connect to an internal endpoint and somehow extracting meaningful information about the response

A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. An insufficient validation of data coming from the user when building a HTTP request from a DNS query in the HTTP Connector of the Remote backend, allowing a remote user to cause a denial of service by making the server connect to an invalid endpoint, or possibly information disclosure by making the server connect to an internal endpoint and somehow extracting meaningful information about the response

Updated pdns packages fix security vulnerability:

An issue has been found in PowerDNS Authoritative Server when the HTTP remote backend is used in RESTful mode (without post=1 set), allowing a remote user to cause the HTTP backend to connect to an attacker-specified host instead of the configured one, via a crafted DNS query. This can be used to cause a denial of service by preventing the remote backend from getting a response, content spoofing if the attacker can time its own query so that subsequent queries will use an attacker-controlled HTTP server instead of the configured one, and possibly information disclosure if the Authoritative Server has access to internal servers (CVE-2019-3871).

This update for pdns fixes the following issue:

Security issue fixed:

• CVE-2019-3871: Fixed an insufficient validation in the HTTP remote backend which could allow a remote user to cause the HTTP backend to connect to an attacker-specified host instead of the configured one (bsc#1129734).

These are all security issues fixed in the pdns-4.5.1-1.5 package on the GA media of openSUSE Tumbleweed.

This update for ardana-ansible, ardana-horizon, ardana-keystone, ardana-manila, ardana-neutron, crowbar-core, crowbar-openstack, grafana, openstack-cinder, openstack-dashboard, openstack-horizon-plugin-manila-ui, openstack-keystone, openstack-manila, openstack-neutron, openstack-neutron-fwaas, openstack-neutron-lbaas, openstack-nova, openstack-octavia, openstack-octavia-amphora-image, pdns, python-Django1, python-keystonemiddleware, python-octaviaclient, python-os-brick, python-oslo.cache, python-oslo.messaging fixes the following issues:

Security issues fixed:

• CVE-2019-3871: Fixed an insufficient validation in the HTTP remote back end (pdns, bsc#1129734).
• CVE-2019-15043: Added authentication to a few REST endpoints (Grafana, SOC-10357, bsc#1148383).

Non-security issues fixed:

• Update to version 9.0+git.1568821007.4e73730:

  • Include manila-pre-upgrade.yml in ardana-upgrade.yml (SOC-10609)

• Update to version 9.0+git.1569869028.8edfc22:

  • Added command to minify the django compressed css files (SOC-10305)

• Update to version 9.0+git.1570035317.78077ac:

  • support OpenID Connect WebSSO (SOC-10509)

• Update to version 9.0+git.1569444107.add6a40:

  • Manila parallelised upgrade workflow enhancements (SOC-10609)

• Update to version 9.0+git.1571328680.3a89cb8:

  • Add neutron-common role dependencies (SOC-10875)

• Update to version 6.0+git.1571412352.8da4d261f:

  • upgrade: Reload repo config in repochecks (SOC-10718)

• Update to version 6.0+git.1571210108.12bd2ffa3:

  • crowbar: Give more time for reboot for physical hardware reboots

• Update to version 6.0+git.1570004730.b56b8983b:

  • Revert 'Use block-migration when needed' (SOC-10133)

• Update to version 6.0+git.1569911671.d44b0035c:

  • Designate: Don't add the admin node to the public network (SOC-10658)

• Update to version 6.0+git.1572264221.3826a58b8:

  • Octavia: account for long ops in HA deployments (SOC-9894)
  • Octavia: use correct IP addresses for listening (SOC-9894)
  • Octavia: fix subnet creation race condition (SOC-9894)
  • Updated copyright notices (SOC-9894)
  • Octavia: Follow up patch addressing comments from last PR (SOC-9894)

• Update to version 6.0+git.1571986150.c5b827b7a:

  • Fix the migration that tried to access Array as a Hash (SOC-10896)

• Update to version 6.0+git.1571731423.957dcfecd:

  • mysql: fix WSREP sync race (SOC-10717)

• Update to version 6.0+git.1571660392.997fee49d:

  • mysql: stop service for mysql_install_db (SOC-10717)

• Update to version 6.0+git.1571241502.2f673d0a9:

  • rabbitmq: fix migration 200 (SOC-10623)
  • Changes to integrate with ACI 4.1 and new packages (SOC-10403)

• Update to version 6.0+git.1570143515.9b1546ed3:

  • No rndc key if no public DNS server (SOC-10835)

• Update to version 6.0+git.1570048281.815e06ff3:

  • create watcher barclamp (SOC-4183)

• Update to version 6.0+git.1569942913.15b24bec5:

  • monasca: Fix restore condition (SOC-9772)
  • database: really fix migration 102 (SOC-10717)

• Update to version 6.0+git.1569823669.91f267e96:

  • Designate: Filter out the admin node (SOC-10658)

• Create plugin directory and clean up (create in %install, add to %files) handling of /var/lib/grafana/* and

• Update to version cinder-13.0.8.dev8:

  • Extend timeout for database migration tests 13.0.7
  • Add context to cloning snapshots in remotefs driver

• Update to version cinder-13.0.7.dev22:

  • Add retry to LVM deactivation
  • Fix DetachedInstanceError for VolumeAttachment
  • Don't allow retype to encrypted+multiattach type

• Update to version cinder-13.0.8.dev8:

  • Extend timeout for database migration tests 13.0.7
  • Add context to cloning snapshots in remotefs driver

• Update to version cinder-13.0.7.dev22:

  • Add retry to LVM deactivation
  • Fix DetachedInstanceError for VolumeAttachment
  • Don't allow retype to encrypted+multiattach type

• Update to version horizon-14.0.5.dev1:

  • Fix aes-xts key length in Horizon Admin Guide / Manage Volumes 14.0.4

• Add…

This update for ardana-ansible, ardana-barbican, ardana-db, ardana-monasca, ardana-mq, ardana-neutron, ardana-octavia, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, documentation-suse-openstack-cloud, memcached, openstack-manila, openstack-neutron, openstack-nova, pdns, python-amqp, rubygem-puma, zookeeper contains the following fixes:

Security fix for rubygem-puma:

• CVE-2020-5247: Fixed an issue where the newlines in headers according to Rack spec were not split (bsc#1165402)

Security fix for openstack-manila:

• CVE-2020-9543: Fixed an issue where an attacker could view, update, delete, or share resources that do not

Security fixes for memcached:

• CVE-2019-15026: Fixed a stack-based buffer over-read in conn_to_str() in memcached.c (bsc#1149110).
• CVE-2019-11596: Fixed NULL pointer dereference in process_lru_command() in memcached.c (bsc#1133817).

Security fixes for pdns:

• CVE-2019-3871: Fixed a denial of service with the HTTP remote backend when the attacker can send crafted DNS queries (bsc#1129734).
• CVE-2018-10851: Fixed a denial of service via crafted zone record (bnc#1114157).
• CVE-2018-14626: Fixed a denial of service by hiding DNSSEC records using a crafted DNS query (bsc#1114169).

Security fixes for zookeeper:

• CVE-2019-0201: Fixed an information disclosure in the ACL handling (bsc#1135773).
• CVE-2017-5637: Fixed incorrect input validation with wchp/wchc four letter words (bsc#1040519).

Changes in ardana-ansible:

• Update to version 8.0+git.1583432621.24fa60e:
  • Upgrade pre-checks in Cloud 8 and Cloud 9 (SOC-10300)

Changes in ardana-barbican:

• Update to version 8.0+git.1585152761.8ef3d61:
  • monitor ardana-node-cert (SOC-10873)

Changes in ardana-db:

• Update to version 8.0+git.1583944923.03cca6c:
  • monitor MySQL TLS certificate (SOC-10873)

Changes in ardana-monasca:

• Update to version 8.0+git.1583944894.38f023a:
  • Add certificate file check alarm (SOC-10873)

Changes in ardana-mq:

• Update to version 8.0+git.1583944811.dc14403:
  • monitor RabbitMQ TLS certificate (SOC-10873)

Changes in ardana-neutron:

• Update to version 8.0+git.1584715262.e4ea620:
  • Add symlink for neutron-fwaas.json.j2 (bsc#1166290)

Changes in ardana-octavia:

• Update to version 8.0+git.1585171918.418f5cf:

  • Reconfigure monitor if needed (SOC-10873)

• Update to version 8.0+git.1585168661.135c735:

  • fix Octavia client cert redeploy (SOC-10873)

• Update to version 8.0+git.1585152502.f15907a:

  • monitor Octavia client certificate (SOC-10873)

Changes in ardana-tempest:

• Update to version 8.0+git.1585311051.6ab5488:
  • Enable port-security feature in tempest(SOC-11027)

Changes in crowbar-core:

• Update to version 5.0+git.1585575551.16781d00d:

  • upgrade: Point to config dir instead of config file (SOC-11171)
  • upgrade: Do not call neutron-evacuate-lbaasv2-agent with use_crm (SOC-11171)

• Update to version 5.0+git.1585316726.670746c8c:

  • upgrade: Fix systemd unit listing (trivial)

• Update to version 5.0+git.1585213241.46f12f9be:

  • upgrade: Remove the assignement of crowbar-upgrade role (SOC-11166)

• Update to version 5.0+git.1585118470.eed9020de:

  • Update the default value of OS version (trivial)
  • Ignore CVE-2020-5267 in CI (bsc#1167240)
  • Ignore CVE-2020-10663 in CI (bsc#1167244)

• Update to version 5.0+git.1583911121.d6b4b4b1a:

  • ses: Make SES UI safe for unknown options (trivial)
  • ses: Use cinder user for nova (SOC-11119)
  • ses: Added helper for populating cinder volumes (SOC-11117)
  • ses: Add ses cookbook (SOC-11114)
  • ses: Configuration upload (SOC-11115)

• Update to version 5.0+git.1583309007.e3a8b81e9:

  • Ignore CVE-2020-8130 in CI (bsc#1164804)
  • Ignore CVE-2020-5247 (bsc#1165402)

Changes in crowbar-ha:

• Update to version 5.0+git.1585316176.344190f:
  • add ssl termination on haproxy (bsc#1149535)

Changes in crowbar-openstack:

• Update to version 5.0+git.1585304226.2164b7895:

  • nova: Fix migration numbers (trivial)

• Update to version…