CVE-2020-13379

The avatar feature in Grafana (github.com/grafana/grafana/pkg/api/avatar) 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue that allows remote code execution. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on.

The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault.

This update for grafana, grafana-piechart-panel, grafana-status-panel fixes the following issues:

grafana was updated to version 7.0.3:

• Features / Enhancements

  • Stats: include all fields. #24829, @ryantxu
  • Variables: change VariableEditorList row action Icon to IconButton. #25217, @hshoff

• Bug fixes

  • Cloudwatch: Fix dimensions of DDoSProtection. #25317, @papagian
  • Configuration: Fix env var override of sections containing hyphen. #25178, @marefr
  • Dashboard: Get panels in collapsed rows. #25079, @peterholmberg
  • Do not show alerts tab when alerting is disabled. #25285, @dprokop
  • Jaeger: fixes cascader option label duration value. #25129, @Estrax
  • Transformations: Fixed Transform tab crash & no update after adding first transform. #25152, @torkelo

Update to version 7.0.2

• Bug fixes

  • Security: Urgent security patch release to fix CVE-2020-13379

Update to version 7.0.1

• Features / Enhancements

  • Datasource/CloudWatch: Makes CloudWatch Logs query history more readable. #24795, @kaydelaney
  • Download CSV: Add date and time formatting. #24992, @ryantxu
  • Table: Make last cell value visible when right aligned. #24921, @peterholmberg
  • TablePanel: Adding sort order persistance. #24705, @torkelo
  • Transformations: Display correct field name when using reduce transformation. #25068, @peterholmberg
  • Transformations: Allow custom number input for binary operations. #24752, @ryantxu

• Bug fixes

  • Dashboard/Links: Fixes dashboard links by tags not working. #24773, @KamalGalrani
  • Dashboard/Links: Fixes open in new window for dashboard link. #24772, @KamalGalrani
  • Dashboard/Links: Variables are resolved and limits to 100. #25076, @hugohaggmark
  • DataLinks: Bring back variables interpolation in title. #24970, @dprokop
  • Datasource/CloudWatch: Field suggestions no longer limited to prefix-only. #24855, @kaydelaney
  • Explore/Table: Keep existing field types if possible. #24944, @kaydelaney
  • Explore: Fix wrap lines toggle for results of queries with filter expression. #24915, @ivanahuckova
  • Explore: fix undo in query editor. #24797, @zoltanbedi
  • Explore: fix word break in type head info. #25014, @zoltanbedi
  • Graph: Legend decimals now work as expected. #24931, @torkelo
  • LoginPage: Fix hover color for service buttons. #25009, @tskarhed
  • LogsPanel: Fix scrollbar. #24850, @ivanahuckova
  • MoveDashboard: Fix for moving dashboard caused all variables to be lost. #25005, @torkelo
  • Organize transformer: Use display name in field order comparer. #24984, @dprokop
  • Panel: shows correct panel menu items in view mode. #24912, @hugohaggmark
  • PanelEditor Fix missing labels and description if there is only single option in category. #24905, @dprokop
  • PanelEditor: Overrides name matcher still show all original field names even after Field default display name is specified. #24933, @torkelo
  • PanelInspector: Makes sure Data display options are visible. #24902, @hugohaggmark
  • PanelInspector: Hides unsupported data display options for Panel type. #24918, @hugohaggmark
  • PanelMenu: Make menu disappear on button press. #25015, @tskarhed
  • Postgres: Fix add button. #25087, @phemmer
  • Prometheus: Fix recording rules expansion. #24977, @ivanahuckova
  • Stackdriver: Fix creating Service Level Objectives (SLO) datasource query variable. #25023, @papagian

Update to version 7.0.0

• Breaking changes

  • Removed PhantomJS: PhantomJS was deprecated in Grafana v6.4 and starting from Grafana v7.0.0, all PhantomJS support has been removed. This means that Grafana no longer ships with a built-in image renderer, and we advise you to install the Grafana Image Renderer plugin.
  • Dashboard: A global minimum dashboard refresh interval is now enforced and defaults to 5 seconds.
  • Interval calculation: There is now a new option Max data points that controls the auto interval $__interval calculation. Interval was previously calculated by dividing the panel width by the…

This update fixes the following issues:

dracut-saltboot:

• Print a list of available disk devices (bsc#1170824)
• Install wipefs to initrd
• Force install crypt modules

golang-github-prometheus-prometheus:

• Update change log and spec file
  • Modified spec file: default to golang 1.14 to avoid 'have choice' build issues in OBS.
  • Rebase and update patches for version 2.18.0
• Update to 2.18.0
  • Features
    • Tracing: Added experimental Jaeger support #7148
  • Changes
    • Federation: Only use local TSDB for federation (ignore remote read). #7096
    • Rules: rule_evaluations_total and rule_evaluation_failures_total have a rule_group label now. #7094
  • Enhancements
    • TSDB: Significantly reduce WAL size kept around after a block cut. #7098
    • Discovery: Add architecture meta label for EC2. #7000
  • Bug fixes
    • UI: Fixed wrong MinTime reported by /status. #7182
    • React UI: Fixed multiselect legend on OSX. #6880
    • Remote Write: Fixed blocked resharding edge case. #7122
    • Remote Write: Fixed remote write not updating on relabel configs change. #7073
• Changes from 2.17.2
  • Bug fixes
    • Federation: Register federation metrics #7081
    • PromQL: Fix panic in parser error handling #7132
    • Rules: Fix reloads hanging when deleting a rule group that is being evaluated #7138
    • TSDB: Fix a memory leak when prometheus starts with an empty TSDB WAL #7135
    • TSDB: Make isolation more robust to panics in web handlers #7129 #7136
• Changes from 2.17.1
  • Bug fixes
    • TSDB: Fix query performance regression that increased memory and CPU usage #7051
• Changes from 2.17.0
  • Features
    • TSDB: Support isolation #6841
    • This release implements isolation in TSDB. API queries and recording rules are guaranteed to only see full scrapes and full recording rules. This comes with a certain overhead in resource usage. Depending on the situation, there might be some increase in memory usage, CPU usage, or query latency.
  • Enhancements
    • PromQL: Allow more keywords as metric names #6933
    • React UI: Add normalization of localhost URLs in targets page #6794
    • Remote read: Read from remote storage concurrently #6770
    • Rules: Mark deleted rule series as stale after a reload #6745
    • Scrape: Log scrape append failures as debug rather than warn #6852
    • TSDB: Improve query performance for queries that partially hit the head #6676
    • Consul SD: Expose service health as meta label #5313
    • EC2 SD: Expose EC2 instance lifecycle as meta label #6914
    • Kubernetes SD: Expose service type as meta label for K8s service role #6684
    • Kubernetes SD: Expose label_selector and field_selector #6807
    • Openstack SD: Expose hypervisor id as meta label #6962
  • Bug fixes
    • PromQL: Do not escape HTML-like chars in query log #6834 #6795
    • React UI: Fix data table matrix values #6896
    • React UI: Fix new targets page not loading when using non-ASCII characters #6892
    • Remote read: Fix duplication of metrics read from remote storage with external labels #6967 #7018
    • Remote write: Register WAL watcher and live reader metrics for all remotes, not just the first one #6998
    • Scrape: Prevent removal of metric names upon relabeling #6891
    • Scrape: Fix 'superfluous response.WriteHeader call' errors when scrape fails under some circonstances #6986
    • Scrape: Fix crash when reloads are separated by two scrape intervals #7011
• Changes from 2.16.0
  • Features
    • React UI: Support local timezone on /graph #6692
    • PromQL: add absent_over_time query function #6490
    • Adding optional logging of queries to their own file #6520
  • Enhancements
    • React UI: Add support for rules page and 'Xs ago' duration displays #6503
    • React UI: alerts page, replace filtering togglers tabs with checkboxes #6543
    • TSDB: Export metric for WAL write errors #6647
    • TSDB: Improve query performance for queries that only touch…

This update for grafana fixes the following issues:

grafana was updated to version 7.1.5:

• Features / Enhancements

  • Stats: Stop counting the same user multiple times.
  • Field overrides: Filter by field name using regex.
  • AzureMonitor: map more units.
  • Explore: Don't run queries on datasource change.
  • Graph: Support setting field unit & override data source (automatic) unit.
  • Explore: Unification of logs/metrics/traces user interface
  • Table: JSON Cell should try to convert strings to JSON
  • Variables: enables cancel for slow query variables queries.
  • TimeZone: unify the time zone pickers to one that can rule them all.
  • Search: support URL query params.
  • Grafana-UI: Add FileUpload.
  • TablePanel: Sort numbers correctly.

• Bug fixes

  • Alerting: remove LongToWide call in alerting.
  • AzureMonitor: fix panic introduced in 7.1.4 when unit was unspecified and alias was used.
  • Variables: Fixes issue with All variable not being resolved.
  • Templating: Fixes so texts show in picker not the values.
  • Templating: Templating: Fix undefined result when using raw interpolation format
  • TextPanel: Fix content overflowing panel boundaries.
  • StatPanel: Fix stat panel display name not showing when explicitly set.
  • Query history: Fix search filtering if null value.
  • Flux: Ensure connections to InfluxDB are closed.
  • Dashboard: Fix for viewer can enter panel edit mode by modifying url (but cannot not save anything).
  • Prometheus: Fix prom links in mixed mode.
  • Sign In Use correct url for the Sign In button.
  • StatPanel: Fixes issue with name showing for single series / field results
  • BarGauge: Fix space bug in single series mode.
  • Auth: Fix POST request failures with anonymous access
  • Templating: Fix recursive loop of template variable queries when changing ad-hoc-variable
  • Templating: Fixed recursive queries triggered when switching dashboard settings view
  • GraphPanel: Fix annotations overflowing panels.
  • Prometheus: Fix performance issue in processing of histogram labels.
  • Datasources: Handle URL parsing error.
  • Security: Use Header.Set and Header.Del for X-Grafana-User header.

This update for grafana fixes the following issues:

Update to version 7.1.5:

• Features / Enhancements

  • Stats: Stop counting the same user multiple times.
  • Field overrides: Filter by field name using regex.
  • AzureMonitor: map more units.
  • Explore: Don't run queries on datasource change.
  • Graph: Support setting field unit & override data source (automatic) unit.
  • Explore: Unification of logs/metrics/traces user interface
  • Table: JSON Cell should try to convert strings to JSON
  • Variables: enables cancel for slow query variables queries.
  • TimeZone: unify the time zone pickers to one that can rule them all.
  • Search: support URL query params.
  • Grafana-UI: Add FileUpload.
  • TablePanel: Sort numbers correctly.

• Bug fixes

  • Alerting: remove LongToWide call in alerting.
  • AzureMonitor: fix panic introduced in 7.1.4 when unit was unspecified and alias was used.
  • Variables: Fixes issue with All variable not being resolved.
  • Templating: Fixes so texts show in picker not the values.
  • Templating: Templating: Fix undefined result when using raw interpolation format
  • TextPanel: Fix content overflowing panel boundaries.
  • StatPanel: Fix stat panel display name not showing when explicitly set.
  • Query history: Fix search filtering if null value.
  • Flux: Ensure connections to InfluxDB are closed.
  • Dashboard: Fix for viewer can enter panel edit mode by modifying url (but cannot not save anything).
  • Prometheus: Fix prom links in mixed mode.
  • Sign In Use correct url for the Sign In button.
  • StatPanel: Fixes issue with name showing for single series / field results
  • BarGauge: Fix space bug in single series mode.
  • Auth: Fix POST request failures with anonymous access
  • Templating: Fix recursive loop of template variable queries when changing ad-hoc-variable
  • Templating: Fixed recursive queries triggered when switching dashboard settings view
  • GraphPanel: Fix annotations overflowing panels.
  • Prometheus: Fix performance issue in processing of histogram labels.
  • Datasources: Handle URL parsing error.
  • Security: Use Header.Set and Header.Del for X-Grafana-User header.

Update to version 7.0.3

• Features / Enhancements

  • Stats: include all fields. #24829, @ryantxu
  • Variables: change VariableEditorList row action Icon to IconButton. #25217, @hshoff

• Bug fixes

  • Cloudwatch: Fix dimensions of DDoSProtection. #25317, @papagian
  • Configuration: Fix env var override of sections containing hyphen. #25178, @marefr
  • Dashboard: Get panels in collapsed rows. #25079, @peterholmberg
  • Do not show alerts tab when alerting is disabled. #25285, @dprokop
  • Jaeger: fixes cascader option label duration value. #25129, @Estrax
  • Transformations: Fixed Transform tab crash & no update after adding first transform. #25152, @torkelo

Update to version 7.0.2

• Bug fixes
  • Security: Urgent security patch release to fix CVE-2020-13379

Update to version 7.0.1

• Features / Enhancements

  • Datasource/CloudWatch: Makes CloudWatch Logs query history more readable. #24795, @kaydelaney
  • Download CSV: Add date and time formatting. #24992, @ryantxu
  • Table: Make last cell value visible when right aligned. #24921, @peterholmberg
  • TablePanel: Adding sort order persistance. #24705, @torkelo
  • Transformations: Display correct field name when using reduce transformation. #25068, @peterholmberg
  • Transformations: Allow custom number input for binary operations. #24752, @ryantxu

• Bug fixes

  • Dashboard/Links: Fixes dashboard links by tags not working. #24773, @KamalGalrani
  • Dashboard/Links: Fixes open in new window for dashboard link. #24772, @KamalGalrani
  • Dashboard/Links: Variables are resolved and limits to 100. #25076, @hugohaggmark
  • DataLinks: Bring back variables interpolation in title. #24970, @dprokop
  • Datasource/CloudWatch: Field suggestions no longer limited to prefix-only. #24855, @kaydelaney -…

These are all security issues fixed in the grafana-7.5.7-1.2 package on the GA media of openSUSE Tumbleweed.

This update for ansible, crowbar-core, crowbar-ha, crowbar-openstack, etcd, flannel, grafana, keepalived, kibana, memcached, monasca-installer, openstack-dashboard-theme-SUSE, openstack-manila, openstack-neutron-fwaas, openstack-nova, openstack-tempest, python-Django, python-Pillow, python-psql2mysql, python-psutil, python-py, python-pysaml2, python-waitress, rabbitmq-server, release-notes-suse-openstack-cloud, zookeeper fixes the following issues:

Security fixes included ins this update:

ansible

• CVE-2019-3828: Fixed a path traversal in the fetch module (bsc#1126503).

grafana

• CVE-2020-13379: Fixed an incorrect access control issue which could lead to information leaks or denial of service (bsc#1172409).
• CVE-2020-12052: Fixed an cross site scripting vulnerability related to the annotation popup (bsc#1170657).

kibana

• CVE-2020-10743: Fixed a clickjacking vulnerability (bsc#1171909).

memcached (to version 1.5.17)

• CVE-2019-15026: Fixed a stack-based buffer over-read in conn_to_str()n (bsc#1149110).
• CVE-2019-11596: Fixed a denial of service in the 'lru' command (bsc#1133817)
• CVE-2018-1000115: Disabled UDP by default to reduce DDoS amplification attacks (bsc#1083903).

python-Django

• CVE-2020-13254: Fixed a data leakage via malformed memcached keys (bsc#1172167).
• CVE-2020-13596: Fixed a cross site scripting vulnerability related to the admin parameters of the ForeignKeyRawIdWidget (bsc#1172166).
• Fixed a regression with the fix for CVE-2019-3498 (bsc#1161349).

python-Pillow

• CVE-2019-16865: Fixed a denial of service with specially crafted image files (bsc#1153191).
• CVE-2020-5312: Fixed a buffer overflow in the PCX P mode (bsc#1160152).
• CVE-2020-5313: Fixed a buffer overflow related to FLI (bsc#1160153).
• CVE-2019-19911: Fixed a denial of service in FpxImagePlugin.py (bsc#1160192).

python-pysaml2

• CVE-2020-5390: Fixed an issue with the verification of signatures in SAML documents (bsc#1160851)
• CVE-2017-1000246: Fixed an issue with weak encryption data, caused by initialization vector reuse(bsc#1068612).

python-waitress (to version 1.4.3)

• CVE-2019-16785: Fixed HTTP request smuggling through LF vs CRLF handling (bsc#1161088).
• CVE-2019-16786: Fixed HTTP request smuggling through invalid Transfer-Encoding (bsc#1161089).
• CVE-2019-16789: Fixed HTTP Request Smuggling through invalid whitespace characters (bsc#1160790).
• CVE-2019-16792: Fixed HTTP Request Smuggling through Content-Length header handling (bsc#1161670).

rubygem-activeresource

• CVE-2020-8151: Fixed information disclosure issue through specially crafted requests (bsc#1171560)

rubygem-json-1_7

• CVE-2020-10663: Fixed Unsafe Object Creation Vulnerability in JSON (bsc#1167244)

rubygem-puma

• CVE-2020-11077: Fixed HTTP Request Smuggling through proxy (bsc#1172175)
• CVE-2020-11076: Fixed HTTP Request smuggling through invalid Transfer-Encoding header.
• CVE-2020-5247: Fixed HTTP Response Splitting through newline characters handling (bsc#1165402)

zookeeper:

• CVE-2019-0201: Fixed an information disclosure related to getACL() (bsc#1135773).

Non security fixes included in this update:

Changes in ansible:

• Add 0001-Disallow-use-of-remote-home-directories-containing-..patch (bsc#1126503, CVE-2019-3828)

Changes in crowbar-core:

• Update to version 4.0+git.1580209654.1d112d31f:
  • network: start OVS before wickedd (SOC-11067)

Changes in crowbar-ha:

• Update to version 4.0+git.1585316203.d6ad2c8:
  • [4.0] add ssl termination on haproxy (bsc#1149535)

Changes in crowbar-openstack:

• Update to version 4.0+git.1589804581.9972163f0:

  • [4.0] magnum: fix check for image/flavor (SOC-11251)

• Update to version 4.0+git.1589647351.ccfd9481f:

  • [4.0] trove: fix rabbitmq connection URL (SOC-11286)

• Update to version 4.0+git.1589458214.9f765aa08:

  • [4.0] Fix create magnum k8s image and flavor (SOC-11251)

• Update to version 4.0+git.1588271860.131fc8cc1:

  • run keystone_register on cluster founder only when HA (SOC-11248)
  • nova: run…

This update for ansible1, ardana-ansible, ardana-cobbler, ardana-glance, ardana-input-model, ardana-logging, ardana-manila, ardana-monasca, ardana-mq, ardana-neutron, ardana-octavia, ardana-tempest, crowbar-core, crowbar-openstack, grafana, kibana, openstack-barbican, openstack-ceilometer, openstack-cinder, openstack-dashboard, openstack-designate, openstack-heat-templates, openstack-ironic, openstack-keystone, openstack-magnum, openstack-manila, openstack-monasca-agent, openstack-neutron, openstack-neutron-vsphere, openstack-nova, openstack-octavia, openstack-octavia-amphora-image, openstack-resource-agents, python-Django1, python-Pillow, python-ardana-packager, python-heatclient, python-neutron-tempest-plugin, python-octavia-tempest-plugin, python-os-brick, python-oslo.messaging, python-pyroute2, python-urllib3, python-waitress, release-notes-suse-openstack-cloud, rubygem-activeresource, rubygem-json-1_7, rubygem-puma fixes the following issues:

Security fixes included in this update:

ansible1:

• CVE-2019-3828: Fixed a path traversal in the fetch module (bsc#1126503).

grafana:

• CVE-2020-13379: Fixed an incorrect access control issue which could lead to information leaks or denial of service (bsc#1172409).
• CVE-2020-12052: Fixed an cross site scripting vulnerability related to the annotation popup (bsc#1170657).

kibana:

• CVE-2020-10743: Fixed a clickjacking vulnerability (bsc#1171909).

python-Django1 to 1.11.29:

• CVE-2020-13254: Fixed a data leakage via malformed memcached keys (bsc#1172167).
• CVE-2020-13596: Fixed a cross site scripting vulnerability related to the admin parameters of the ForeignKeyRawIdWidget (bsc#1172166).
• CVE-2020-7471: Fixed a SQL injection via StringAgg delimiter (bsc#1161919).
• CVE-2020-9402: Fixed a SQL injection via tolerance parameter in GIS functions and aggregates (bsc#1165022).
• CVE-2019-19844: Fixed a potential account hijack via password reset form (bsc#1159447).

python-Pillow:

• CVE-2020-10177: Fixed multiple out-of-bounds reads in libImaging/FliDecode.c (bsc#1173413).
• CVE-2020-11538: Fixed multiple out-of-bounds reads via a crafted JP2 files (bsc#1173420).
• CVE-2020-10994: Fixed multiple out-of-bounds reads via a crafted JP2 files (bsc#1173418).
• CVE-2020-10378: Fixed an out-of-bounds read when reading PCX files (bsc#1173416).
• CVE-2019-16865: Fixed a denial of service with specially crafted image files (bsc#1153191).
• CVE-2020-5311: Fixed an SGI buffer overflow (bsc#1160151).
• CVE-2020-5312: Fixed a buffer overflow in the PCX P mode (bsc#1160152).
• CVE-2020-5313: Fixed a buffer overflow related to FLI (bsc#1160153).
• CVE-2019-19911: Fixed a denial of service in FpxImagePlugin.py (bsc#1160192).

python-waitress to version 1.4.3:

• CVE-2019-16785: Fixed HTTP request smuggling through LF vs CRLF handling (bsc#1161088).
• CVE-2019-16786: Fixed HTTP request smuggling through invalid Transfer-Encoding (bsc#1161089).
• CVE-2019-16789: Fixed HTTP Request Smuggling through invalid whitespace characters (bsc#1160790).
• CVE-2019-16792: Fixed HTTP Request Smuggling through Content-Length header handling (bsc#1161670).

rubygem-activeresource:

• CVE-2020-8151: Fixed possible information disclosure through specially crafted requests (bsc#1171560).

Non security fixes:

Changes in ansible1.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:

• Add 0001-Disallow-use-of-remote-home-directories-containing-..patch (bsc#1126503, CVE-2019-3828)

Changes in ardana-ansible.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:

• Update to version 9.0+git.1591138508.e269bdb:

  • Use internal endpoint for upload image (SOC-11294)

• Update to version 9.0+git.1589740968.d339a28:

  • Reconfigure rabbitmq user permissions on update (SOC-11082)

• Update to version 9.0+git.1588953276.b8b5512:

  • Fix incorrect prefix used to collect supportconfig files (bsc#1171273)

Changes in ardana-cobbler.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:

• Update to version 9.0+git.1588181228.bae3b1f:
  • Ensure…

This update fixes the following issues:

dracut-saltboot:

• Print a list of available disk devices (bsc#1170824)
• Install wipefs to initrd
• Force install crypt modules
• Add missing terminal naming modifiers as exported veriables

golang-github-prometheus-prometheus:

• Update change log and spec file
  • Modified spec file: default to golang 1.14 to avoid 'have choice' build issues in OBS.
  • Rebase and update patches for version 2.18.0
  • Changed:
    • 0002-Default-settings.patch Changed
• Update to 2.18.0
  • Features
    • Tracing: Added experimental Jaeger support #7148
  • Changes
    • Federation: Only use local TSDB for federation (ignore remote read). #7096
    • Rules: rule_evaluations_total and rule_evaluation_failures_total have a rule_group label now. #7094
  • Enhancements
    • TSDB: Significantly reduce WAL size kept around after a block cut. #7098
    • Discovery: Add architecture meta label for EC2. #7000
  • Bug fixes
    • UI: Fixed wrong MinTime reported by /status. #7182
    • React UI: Fixed multiselect legend on OSX. #6880
    • Remote Write: Fixed blocked resharding edge case. #7122
    • Remote Write: Fixed remote write not updating on relabel configs change. #7073
• Changes from 2.17.2
  • Bug fixes
    • Federation: Register federation metrics #7081
    • PromQL: Fix panic in parser error handling #7132
    • Rules: Fix reloads hanging when deleting a rule group that is being evaluated #7138
    • TSDB: Fix a memory leak when prometheus starts with an empty TSDB WAL #7135
    • TSDB: Make isolation more robust to panics in web handlers #7129 #7136
• Changes from 2.17.1
  • Bug fixes
    • TSDB: Fix query performance regression that increased memory and CPU usage #7051
• Changes from 2.17.0
  • Features
    • TSDB: Support isolation #6841
    • This release implements isolation in TSDB. API queries and recording rules are guaranteed to only see full scrapes and full recording rules. This comes with a certain overhead in resource usage. Depending on the situation, there might be some increase in memory usage, CPU usage, or query latency.
  • Enhancements
    • PromQL: Allow more keywords as metric names #6933
    • React UI: Add normalization of localhost URLs in targets page #6794
    • Remote read: Read from remote storage concurrently #6770
    • Rules: Mark deleted rule series as stale after a reload #6745
    • Scrape: Log scrape append failures as debug rather than warn #6852
    • TSDB: Improve query performance for queries that partially hit the head #6676
    • Consul SD: Expose service health as meta label #5313
    • EC2 SD: Expose EC2 instance lifecycle as meta label #6914
    • Kubernetes SD: Expose service type as meta label for K8s service role #6684
    • Kubernetes SD: Expose label_selector and field_selector #6807
    • Openstack SD: Expose hypervisor id as meta label #6962
  • Bug fixes
    • PromQL: Do not escape HTML-like chars in query log #6834 #6795
    • React UI: Fix data table matrix values #6896
    • React UI: Fix new targets page not loading when using non-ASCII characters #6892
    • Remote read: Fix duplication of metrics read from remote storage with external labels #6967 #7018
    • Remote write: Register WAL watcher and live reader metrics for all remotes, not just the first one #6998
    • Scrape: Prevent removal of metric names upon relabeling #6891
    • Scrape: Fix 'superfluous response.WriteHeader call' errors when scrape fails under some circonstances #6986
    • Scrape: Fix crash when reloads are separated by two scrape intervals #7011
• Changes from 2.16.0
  • Features
    • React UI: Support local timezone on /graph #6692
    • PromQL: add absent_over_time query function #6490
    • Adding optional logging of queries to their own file #6520
  • Enhancements
    • React UI: Add support for rules page and 'Xs ago' duration displays #6503
    • React UI: alerts page, replace filtering togglers tabs with checkboxes #6543 …

This update fixes the following issues:

cobbler:

• Calculate relative path for kernel and inited when generating grub entry (bsc#1170231) Added: fix-grub2-entry-paths.diff
• Fix os-release version detection for SUSE Modified: sles15.patch
• Jinja2 template library fix (bsc#1141661)
• Removes string replace for textmode fix (bsc#1134195)

golang-github-prometheus-prometheus:

• Update change log and spec file
  • Modified spec file: default to golang 1.14 to avoid 'have choice' build issues in OBS.
  • Rebase and update patches for version 2.18.0
  • Changed:
    • 0002-Default-settings.patch Changed
• Update to 2.18.0
  • Features
    • Tracing: Added experimental Jaeger support #7148
  • Changes
    • Federation: Only use local TSDB for federation (ignore remote read). #7096
    • Rules: rule_evaluations_total and rule_evaluation_failures_total have a rule_group label now. #7094
  • Enhancements
    • TSDB: Significantly reduce WAL size kept around after a block cut. #7098
    • Discovery: Add architecture meta label for EC2. #7000
  • Bug fixes
    • UI: Fixed wrong MinTime reported by /status. #7182
    • React UI: Fixed multiselect legend on OSX. #6880
    • Remote Write: Fixed blocked resharding edge case. #7122
    • Remote Write: Fixed remote write not updating on relabel configs change. #7073
• Changes from 2.17.2
  • Bug fixes
    • Federation: Register federation metrics #7081
    • PromQL: Fix panic in parser error handling #7132
    • Rules: Fix reloads hanging when deleting a rule group that is being evaluated #7138
    • TSDB: Fix a memory leak when prometheus starts with an empty TSDB WAL #7135
    • TSDB: Make isolation more robust to panics in web handlers #7129 #7136
• Changes from 2.17.1
  • Bug fixes
    • TSDB: Fix query performance regression that increased memory and CPU usage #7051
• Changes from 2.17.0
  • Features
    • TSDB: Support isolation #6841
    • This release implements isolation in TSDB. API queries and recording rules are guaranteed to only see full scrapes and full recording rules. This comes with a certain overhead in resource usage. Depending on the situation, there might be some increase in memory usage, CPU usage, or query latency.
  • Enhancements
    • PromQL: Allow more keywords as metric names #6933
    • React UI: Add normalization of localhost URLs in targets page #6794
    • Remote read: Read from remote storage concurrently #6770
    • Rules: Mark deleted rule series as stale after a reload #6745
    • Scrape: Log scrape append failures as debug rather than warn #6852
    • TSDB: Improve query performance for queries that partially hit the head #6676
    • Consul SD: Expose service health as meta label #5313
    • EC2 SD: Expose EC2 instance lifecycle as meta label #6914
    • Kubernetes SD: Expose service type as meta label for K8s service role #6684
    • Kubernetes SD: Expose label_selector and field_selector #6807
    • Openstack SD: Expose hypervisor id as meta label #6962
  • Bug fixes
    • PromQL: Do not escape HTML-like chars in query log #6834 #6795
    • React UI: Fix data table matrix values #6896
    • React UI: Fix new targets page not loading when using non-ASCII characters #6892
    • Remote read: Fix duplication of metrics read from remote storage with external labels #6967 #7018
    • Remote write: Register WAL watcher and live reader metrics for all remotes, not just the first one #6998
    • Scrape: Prevent removal of metric names upon relabeling #6891
    • Scrape: Fix 'superfluous response.WriteHeader call' errors when scrape fails under some circonstances #6986
    • Scrape: Fix crash when reloads are separated by two scrape intervals #7011
• Changes from 2.16.0
  • Features
    • React UI: Support local timezone on /graph #6692
    • PromQL: add absent_over_time query function #6490
    • Adding optional logging of queries to their own file #6520
  • Enhancements
    • React UI: Add support for rules page and…

This update for ansible, ansible1, ardana-ansible, ardana-cluster, ardana-freezer, ardana-input-model, ardana-logging, ardana-mq, ardana-neutron, ardana-octavia, ardana-osconfig, caasp-openstack-heat-templates, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, kibana, openstack-dashboard, openstack-dashboard-theme-HPE, openstack-heat-templates, openstack-keystone, openstack-monasca-agent, openstack-monasca-installer, openstack-neutron, openstack-octavia-amphora-image, python-Django, python-Flask, python-GitPython, python-Pillow, python-amqp, python-apicapi, python-keystoneauth1, python-oslo.messaging, python-psutil, python-pyroute2, python-pysaml2, python-tooz, python-waitress, storm contains the following fixes:

The update fixes several security issues:

ansible

• CVE-2019-3828: Fixed a path traversal in the fetch module (bsc#1126503).

grafana

• CVE-2020-13379: Fixed an incorrect access control issue which could lead to information leaks or denial of service (bsc#1172409).
• CVE-2020-12052: Fixed an cross site scripting vulnerability related to the annotation popup (bsc#1170657).

kibana

• CVE-2020-10743: Fixed a clickjacking vulnerability (bsc#1171909).

python-Django

• CVE-2020-13254: Fixed a data leakage via malformed memcached keys. (bsc#1172167)
• CVE-2020-13596: Fixed a cross site scripting vulnerability related to the admin parameters of the ForeignKeyRawIdWidget. (bsc#1172166)

python-Flask

• CVE-2019-1010083: Fixed a denial of service via crafted encoded JSON. (bsc#1141968)

python-Pillow

• CVE-2019-16865: Fixed a denial of service with specially crafted image files. (bsc#1153191)
• CVE-2020-5312: Fixed a buffer overflow in the PCX P mode. (bsc#1160152)
• CVE-2020-5313: Fixed a buffer overflow related to FLI. (bsc#1160153)
• CVE-2019-19911: Fixed a denial of service in FpxImagePlugin.py. (bsc#1160192)

python-psutil

• CVE-2019-18874: Fixed a double free caused by refcount mishandling. (bsc#1156525)

python-pysaml2

• CVE-2020-5390: Fixed an issue with the verification of signatures in SAML documents. (bsc#1160851)
• CVE-2017-1000246: Fixed an issue with weak encryption data, caused by initialization vector reuse. (bsc#1068612)

python-waitress (to version 1.4.3)

• CVE-2019-16785: Fixed HTTP request smuggling through LF vs CRLF handling. (bsc#1161088)
• CVE-2019-16786: Fixed HTTP request smuggling through invalid Transfer-Encoding. (bsc#1161089)
• CVE-2019-16789: Fixed HTTP Request Smuggling through Invalid whitespace characters. (bsc#1160790)
• CVE-2019-16792: Fixed HTTP Request Smuggling through Content-Length header handling. (bsc#1161670)

rubygem-activeresource

• CVE-2020-8151: Fixed information disclosure issue via specially crafted requests. (bsc#1171560)

rubygem-json-1_7

• CVE-2020-10663: Fixed an unsafe object creation vulnerability. (bsc#1167244)

rubygem-puma

• CVE-2020-11077: Fixed a HTTP smuggling issue related to proxy usage. (bsc#1172175)
• CVE-2020-11076: Fixed a HTTP smuggling issue when using an invalid transfer-encoding header. (bsc#1172176)

Other non-security fixes in in the update below:

Changes in ansible:

• Add 0001-Disallow-use-of-remote-home-directories-containing-..patch (bsc#1126503, CVE-2019-3828)

Changes in ansible1:

• Add 0001-Disallow-use-of-remote-home-directories-containing-..patch (bsc#1126503, CVE-2019-3828)

Changes in ardana-ansible:

• Update to version 8.0+git.1589740980.6c3bcdc:

  • Reconfigure rabbitmq user permissions on update (SOC-11082)

• Update to version 8.0+git.1588953487.9bfd5cb:

  • Fix incorrect prefix used to collect supportconfig files (bsc#1171273)

• Update to version 8.0+git.1585690828.81d8f45:

  • Cleanup keystone-ansible (bsc#1108719)

Changes in ardana-cluster:

• Update to version 8.0+git.1585685203.3e71e49:
  • Use bool filter to ensure valid boolean evaluation (SOC-11192)

Changes in ardana-freezer:

• Update to version 8.0+git.1586539529.b7d295f:
  • Recovering Cloud8 using Freezer or SSH backups…

This update fixes the following issues:

cobbler:

• Calculate relative path for kernel and inited when generating grub entry (bsc#1170231) Added: fix-grub2-entry-paths.diff
• Fix os-release version detection for SUSE Modified: sles15.patch
• Jinja2 template library fix (bsc#1141661)
• Removes string replace for textmode fix (bsc#1134195)

golang-github-prometheus-node_exporter:

• Update to 0.18.1
  • [BUGFIX] Fix incorrect sysctl call in BSD meminfo collector, resulting in broken swap metrics on FreeBSD #1345
  • [BUGFIX] Fix rollover bug in mountstats collector #1364
  • Renamed interface label to device in netclass collector for consistency with
  • other network metrics #1224
  • The cpufreq metrics now separate the cpufreq and scaling data based on what the driver provides. #1248
  • The labels for the network_up metric have changed, see issue #1236
  • Bonding collector now uses mii_status instead of operstatus #1124
  • Several systemd metrics have been turned off by default to improve performance #1254
  • These include unit_tasks_current, unit_tasks_max, service_restart_total, and unit_start_time_seconds
  • The systemd collector blacklist now includes automount, device, mount, and slice units by default. #1255
  • [CHANGE] Bonding state uses mii_status #1124
  • [CHANGE] Add a limit to the number of in-flight requests #1166
  • [CHANGE] Renamed interface label to device in netclass collector #1224
  • [CHANGE] Add separate cpufreq and scaling metrics #1248
  • [CHANGE] Several systemd metrics have been turned off by default to improve performance #1254
  • [CHANGE] Expand systemd collector blacklist #1255
  • [CHANGE] Split cpufreq metrics into a separate collector #1253
  • [FEATURE] Add a flag to disable exporter metrics #1148
  • [FEATURE] Add kstat-based Solaris metrics for boottime, cpu and zfs collectors #1197
  • [FEATURE] Add uname collector for FreeBSD #1239
  • [FEATURE] Add diskstats collector for OpenBSD #1250
  • [FEATURE] Add pressure collector exposing pressure stall information for Linux #1174
  • [FEATURE] Add perf exporter for Linux #1274
  • [ENHANCEMENT] Add Infiniband counters #1120
  • [ENHANCEMENT] Add TCPSynRetrans to netstat default filter #1143
  • [ENHANCEMENT] Move network_up labels into new metric network_info #1236
  • [ENHANCEMENT] Use 64-bit counters for Darwin netstat
  • [BUGFIX] Add fallback for missing /proc/1/mounts #1172
  • [BUGFIX] Fix node_textfile_mtime_seconds to work properly on symlinks #1326
• Add network-online (Wants and After) dependency to systemd unit bsc#1143913

golang-github-prometheus-prometheus:

• Update change log and spec file
  • Modified spec file: default to golang 1.14 to avoid 'have choice' build issues in OBS.
  • Rebase and update patches for version 2.18.0
  • Changed:
    • 0002-Default-settings.patch Changed
• Update to 2.18.0
  • Features
    • Tracing: Added experimental Jaeger support #7148
  • Changes
    • Federation: Only use local TSDB for federation (ignore remote read). #7096
    • Rules: rule_evaluations_total and rule_evaluation_failures_total have a rule_group label now. #7094
  • Enhancements
    • TSDB: Significantly reduce WAL size kept around after a block cut. #7098
    • Discovery: Add architecture meta label for EC2. #7000
  • Bug fixes
    • UI: Fixed wrong MinTime reported by /status. #7182
    • React UI: Fixed multiselect legend on OSX. #6880
    • Remote Write: Fixed blocked resharding edge case. #7122
    • Remote Write: Fixed remote write not updating on relabel configs change. #7073
• Changes from 2.17.2
  • Bug fixes
    • Federation: Register federation metrics #7081
    • PromQL: Fix panic in parser error handling #7132
    • Rules: Fix reloads hanging when deleting a rule group that is being evaluated #7138
    • TSDB: Fix a memory leak when prometheus starts with an empty TSDB WAL #7135
    • TSDB: Make isolation more robust to panics in web handlers #7129 #7136
• Changes from 2.17.1
  • Bug…

This update fixes the following issues:

dracut-saltboot:

• Print a list of available disk devices (bsc#1170824)
• Install wipefs to initrd
• Force install crypt modules

golang-github-prometheus-prometheus:

• Update change log and spec file
  • Modified spec file: default to golang 1.14 to avoid 'have choice' build issues in OBS.
  • Rebase and update patches for version 2.18.0
• Update to 2.18.0
  • Features
    • Tracing: Added experimental Jaeger support #7148
  • Changes
    • Federation: Only use local TSDB for federation (ignore remote read). #7096
    • Rules: rule_evaluations_total and rule_evaluation_failures_total have a rule_group label now. #7094
  • Enhancements
    • TSDB: Significantly reduce WAL size kept around after a block cut. #7098
    • Discovery: Add architecture meta label for EC2. #7000
  • Bug fixes
    • UI: Fixed wrong MinTime reported by /status. #7182
    • React UI: Fixed multiselect legend on OSX. #6880
    • Remote Write: Fixed blocked resharding edge case. #7122
    • Remote Write: Fixed remote write not updating on relabel configs change. #7073
• Changes from 2.17.2
  • Bug fixes
    • Federation: Register federation metrics #7081
    • PromQL: Fix panic in parser error handling #7132
    • Rules: Fix reloads hanging when deleting a rule group that is being evaluated #7138
    • TSDB: Fix a memory leak when prometheus starts with an empty TSDB WAL #7135
    • TSDB: Make isolation more robust to panics in web handlers #7129 #7136
• Changes from 2.17.1
  • Bug fixes
    • TSDB: Fix query performance regression that increased memory and CPU usage #7051
• Changes from 2.17.0
  • Features
    • TSDB: Support isolation #6841
    • This release implements isolation in TSDB. API queries and recording rules are guaranteed to only see full scrapes and full recording rules. This comes with a certain overhead in resource usage. Depending on the situation, there might be some increase in memory usage, CPU usage, or query latency.
  • Enhancements
    • PromQL: Allow more keywords as metric names #6933
    • React UI: Add normalization of localhost URLs in targets page #6794
    • Remote read: Read from remote storage concurrently #6770
    • Rules: Mark deleted rule series as stale after a reload #6745
    • Scrape: Log scrape append failures as debug rather than warn #6852
    • TSDB: Improve query performance for queries that partially hit the head #6676
    • Consul SD: Expose service health as meta label #5313
    • EC2 SD: Expose EC2 instance lifecycle as meta label #6914
    • Kubernetes SD: Expose service type as meta label for K8s service role #6684
    • Kubernetes SD: Expose label_selector and field_selector #6807
    • Openstack SD: Expose hypervisor id as meta label #6962
  • Bug fixes
    • PromQL: Do not escape HTML-like chars in query log #6834 #6795
    • React UI: Fix data table matrix values #6896
    • React UI: Fix new targets page not loading when using non-ASCII characters #6892
    • Remote read: Fix duplication of metrics read from remote storage with external labels #6967 #7018
    • Remote write: Register WAL watcher and live reader metrics for all remotes, not just the first one #6998
    • Scrape: Prevent removal of metric names upon relabeling #6891
    • Scrape: Fix 'superfluous response.WriteHeader call' errors when scrape fails under some circonstances #6986
    • Scrape: Fix crash when reloads are separated by two scrape intervals #7011
• Changes from 2.16.0
  • Features
    • React UI: Support local timezone on /graph #6692
    • PromQL: add absent_over_time query function #6490
    • Adding optional logging of queries to their own file #6520
  • Enhancements
    • React UI: Add support for rules page and 'Xs ago' duration displays #6503
    • React UI: alerts page, replace filtering togglers tabs with checkboxes #6543
    • TSDB: Export metric for WAL write errors #6647
    • TSDB: Improve query performance for queries that only touch…

This update for ansible, crowbar-core, crowbar-openstack, grafana, grafana-natel-discrete-panel, openstack-aodh, openstack-barbican, openstack-cinder, openstack-gnocchi, openstack-heat, openstack-ironic, openstack-magnum, openstack-manila, openstack-monasca-agent, openstack-murano, openstack-neutron, openstack-neutron-vpnaas, openstack-nova, openstack-sahara, python-Pillow, rubygem-crowbar-client fixes the following issues:

Security fixes included on this update:

for ansible:

• CVE-2020-1733,CVE-2020-10744: Fixed a race condition and insecure permissions which could have allowed another user on the node to gain control of the become user (bsc#1171823 and bsc#1164140).

for grafana:

• CVE-2020-11110, CVE-2018-18623, CVE-2018-18624, CVE-2018-18625: Fixed XSS vulnerabilities in dashboard due to an incomplete fix for CVE-2018-12099

for openstack-nova:

• CVE-2020-17376: Fixed an issue in which live migration failed to update persistent domain XML (bsc#1175484)

for python-pillow:

• CVE-2016-0775: Fixed a buffer overflow in FliDecode.c (bsc#965582)
• CVE-2020-10177: Fix-OOB-reads-in-FLI-decoding (bsc#1173413)
• CVE-2020-10994: Fix-bounds-overflow-in-JPEG-2000-decoding (bsc#1173418)
• CVE-2020-10378: Fix-bounds-overflow-in-PCX-decoding (bsc#1173416)

for rubygem-crowbar-client:

• CVE-2018-17954: Fixed an issue where provision leaks admin password to all nodes in cleartext (bsc#1117080)

Non-security fixes included on this update:

Changes in ansible:

• Update CVE-2020-10744_avoid_mkdir_p.patch to include missing parts and rename to CVE-2020-1733_avoid_mkdir_p.patch to make it clear which CVE is fixed there (bsc#1164140)

• Add CVE-2020-10744_avoid_mkdir_p.patch (bsc#1171823) to fix insecure temporary directory creation.

Changes in crowbar-core:

• Update to version 4.0+git.1600767499.0615a418f:

  • provisioner: check for client_user (SOC-11389)
  • crowbar: Also add access to /restricted/ in SSL vhost (SOC-11352)
  • crowbar: Allow hardware-installing -> discovering transition (noref)
  • crowbar: Add Restricted controller with API for restricted clients (bsc#1117080)
  • crowbar: Add complete list of states to Crowbar::State (noref)
  • provisioner: Remove the need for /updates/parse_node_data (noref)
  • crowbar: Create helper module to validate states (noref)
  • provisioner: Use new restricted API (bsc#1117080)
  • provisioner: Do not read /etc/crowbar.install.key from crowbar_joi (bsc#1117080)
  • provisioner: Remove use of privileged user for Windows machine (bsc#1117080)
  • provisioner: Use restricted client during provisioning (bsc#1117080)
  • provisioner: Use restricted client for crowbar_register (bsc#1117080)
  • provisioner: Drop /etc/crowbar.install.key bits from autoyast prof (bsc#1117080)
  • Avoid hardcoding machine-install user (bsc#1117080)
  • crowbar: Restrict admin access (bsc#1117080)

• Update to version 4.0+git.1600416364.5a9286e31:

  • Whitelist fixed CVEs in travis (noref)
  • Disable cookbook tests (noref)

Changes in crowbar-openstack:

• Update to version 4.0+git.1599037255.25b759234:
  • horizon: Update configuration for Grafana 5.x

Changes in grafana:

• BuildRequire go1.14 explicitly
• Add recompress source service
• Add go_modules source service to create vendor.tar.gz containing 3rd party go modules.
• Adjust spec to work for Grafana-6.7.4
• Adjust Makefile to work for Grafana-6.7.4
• Remove CVE-2019-15043.patch (merged upstream)
• Remove CVE-2020-13379.patch (merged upstream)
• Remove 0001-CVE-2020-12052-bsc1170657-XSS-annotation-popup-vulnerability.patch (merged upstream)
• Update to version 6.7.4 (bsc#1172450, CVE-2018-18623, CVE-2018-18624, CVE-2018-18625, bsc#1174583, CVE-2020-11110)
  • Only allow 32 hexadecimal digits for the avatar hash
  • 6.7.3 cherry-picks (#23808)
  • Fix CI for pushing a multi-architecture manifest (#23327)
  • AzureMonitor: Fix Log Analytics and Application Insights for Azure China (#21803) (#22753)
  • Revert 'grafana/data:…

This update for grafana and system-user-grafana fixes the following issues:

• Updated grafana to upstream version 7.3.1

  • CVE-2019-15043: In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana

  • CVE-2020-12245: Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip (bsc#1170557)

  • CVE-2020-13379: The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault (bsc#1172409)

  • CVE-2019-15043: In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana (bsc#1148383)

  • CVE-2020-12052: Grafana version below 6.7.3 is vulnerable for annotation popup XSS (bsc#1170657)

  • CVE-2020-24303: Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource. (bsc#1178243)

  • CVE-2018-18623: Grafana 5.3.1 has XSS via the 'Dashboard > Text Panel' screen (bsc#1172450)

  • CVE-2019-19499: Grafana versions below or equal to 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations (bsc#1175951)

  • Please refer to this package's changelog to get a full list of all changes (including bug fixes etc.)

• Initial shipment of system-user-grafana to SES 6

This update for ardana-neutron, ardana-swift, cassandra, crowbar-openstack, grafana, kibana, openstack-dashboard, openstack-ironic, openstack-neutron, openstack-neutron-gbp, openstack-nova, python-Django1, python-py, python-pysaml2, python-xmlschema, rubygem-activerecord-session_store, venv-openstack-keystone contains the following fixes:

Security fixes included in this update:

cassandra:

• CVE-2020-17516: Fixed an issue where encryption between nodes was not enforced correctly for certain internode_encryption settings (bsc#1181689)

grafana:

• CVE-2018-18623, CVE-2018-18624, CVE-2018-18625: Fixed multiple cross site scripting vulnerabilities in the dashboard. (bsc#1172450)
• CVE-2021-27358: Fixed a denial of service via remote API call. (bsc#1183803)
• CVE-2019-15043: Fixed a denial of service by an unauthenticated user in the snapshot HTTP API (bsc#1148383)
• CVE-2020-13379: Fixed an information leak to unauthenticated users. (bsc#1172409)
• CVE-2020-12052: Fixed a cross site scripting vulnerability with the annotation popup (bsc#1170657)
• CVE-2018-19039: Fixed an issue where a privileged user could exfiltrate files (bsc#1115960)
• CVE-2020-11110: Fixed a stored cross site scripting vulnerability. (bsc#1174583)
• CVE-2020-24303: Fixed a cross site scripting vulnerability in a query alias for ElasticSearch datasources (bsc#1178243)

kibana:

• CVE-2017-11499: Fixed a vulnerability in nodejs, related to the HashTable implementation, which could cause a denial of service. (bsc#1044849)
• CVE-2017-11481: Fixed a cross site scripting vulnerability via via URL fields. (bsc#1044849)
• CVE-2020-10743: Fixed a clickjacking issue because X-Frame-Option was not used by default. (bsc#1171909)

python-Django:

• CVE-2021-23336: Fixed a web cache poisoning via django.utils.http.limited_parse_qsl(). (bsc#1182433)
• CVE-2021-28658: Fixed a directory traversal via uploaded files. (bsc#1184148)
• CVE-2021-31542: Fixed a directory traversal via uploaded files with suitably crafted file names. (bsc#1185623)
• CVE-2021-33203: Fixed potential path-traversal via admindocs' TemplateDetailView. (bsc#1186608)
• CVE-2021-33571: Tighten validator checks to not allow leading zeros in IPv4 addresses, which potentially leads to further attacks. (bsc#1186611)

python-py:

• CVE-2020-29651: Fixed a denial of service via regular expressions. (bsc#1179805)

python-pysaml2:

• CVE-2021-21238: Fixed improper verification of cryptographic signatures for signed SAML documents. (bsc#1181277)
• CVE-2021-21239: Fixed improper verification of cryptographic signatures when using CryptoBackendXmlSec1(). (bsc#1181278)

rubygem-activerecord-session_store:

• CVE-2019-25025: Fixed a timing attacks targeting the session id which could allow an attack to hijack sessions. (bsc#1183174)

Non-security changes included in this update:

Changes in ardana-neutron:

• Update to version 9.0+git.1615223676.777f0b3:
  • Allow users to stop monitoring rootwrap daemon (bsc#1182317)

Changes in ardana-swift:

• Update to version 9.0+git.1618235096.90974ed:
  • Run swiftlm-scan in the UTC timezone (bsc#1181690)

Changes in cassandra:

• update to 3.11.10 (bsc#1181689, CVE-2020-17516)

• Fix digest computation for queries with fetched but non queried columns (CASSANDRA-15962)
• Reduce amount of allocations during batch statement execution (CASSANDRA-16201)
• Update jflex-1.6.0.jar to match upstream (CASSANDRA-16393)
• Fix DecimalDeserializer#toString OOM (CASSANDRA-14925)
• Rate limit validation compactions using compaction_throughput_mb_per_sec (CASSANDRA-16161)
• SASI's max_compaction_flush_memory_in_mb settings over 100GB revert to default of 1GB (CASSANDRA-16071)
• Prevent unbounded number of pending flushing tasks (CASSANDRA-16261)
• Improve empty hint file handling during startup (CASSANDRA-16162)
• Allow empty string in collections with COPY FROM in cqlsh (CASSANDRA-16372)
• Fix skipping on pre-3.0 created compact storage sstables due to missing primary…