CVE-2020-17376

An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot of an instance that has previously undergone live migration, a user may gain access to destination host devices that share the same paths as host devices previously referenced by the virtual machine on the source host. This can include block devices that map to different Cinder volumes at the destination than at the source. Only deployments allowing host-based connections (for instance, root and ephemeral devices) are affected.

An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot of an instance that has previously undergone live migration, a user may gain access to destination host devices that share the same paths as host devices previously referenced by the virtual machine on the source host. This can include block devices that map to different Cinder volumes at the destination than at the source. Only deployments allowing host-based connections (for instance, root and ephemeral devices) are affected.

An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot of an instance that has previously undergone live migration, a user may gain access to destination host devices that share the same paths as host devices previously referenced by the virtual machine on the source host. This can include block devices that map to different Cinder volumes at the destination than at the source. Only deployments allowing host-based connections (for instance, root and ephemeral devices) are affected.

This update for ardana-ansible, ardana-cinder, ardana-cobbler, ardana-installer-ui, ardana-opsconsole-ui, ardana-osconfig, crowbar-core, grafana, grafana-natel-discrete-panel, openstack-cinder, openstack-dashboard, openstack-ironic, openstack-ironic-python-agent, openstack-manila, openstack-neutron, openstack-neutron-infoblox, openstack-nova, python-Flask-Cors, rubygem-crowbar-client, storm, storm-kit, venv-openstack-cinder, venv-openstack-horizon fixes the following issues:

Security changes on this update:

grafana:

• CVE-2018-18623, CVE-2018-18624, CVE-2018-18625: Fixed multiple XSS vulnerabilities, caused by an incomplete fix for CVE-2018-12099 (bsc#1172450).
• CVE-2020-11110: Fixed a stored XSS in dashboard snapshots (bsc#1174583).

openstack-nova:

• CVE-2020-17376: Fixed an information leak during live migration (bsc#1175484).

python-Flask-Cors:

• CVE-2020-25032: Fixed a potential information leak through path traversal (bsc#1175986).

rubygem-crowbar-client:

• CVE-2018-17954: Fixed an issue where provision leaks admin password to all nodes in cleartext (bsc#1117080)

Non security changes on this update:

Changes in ardana-ansible:

• Ensure that installing SOC 9 triggers removal of any existing ardana-freezer package, which is not available for SOC 9 (SOC-9779)

• Update to version 9.0+git.1596813072.110811d:

  • Update the Swift XFS inode size check (SOC-10300)

• Update to version 9.0+git.1596487185.d56da1b:

  • Remove lingering Cloud9 development hack (SOC-5480)

• Update to version 9.0+git.1596479802.67906d5:

  • Enable SLE12 SP3 LTSS for SMT deployments (SOC-11223)

• Update to version 9.0+git.1596209332.4ce15a6:

  • Fix upgrade validations Keystone V3 check target (SOC-10300)

Changes in ardana-cinder:

• Update to version 9.0+git.1596129576.0b3d3ce:
  • Install python-swiftclient as cinder-backup dependency (SOC-11364)

Changes in ardana-cobbler:

• Update to version 9.0+git.1588258487.3acf8ad:
  • Rip out unsupported distributions (SOC-9008)

Changes in ardana-installer-ui:

• Ensure SOC 9 package obsoletes HOS 8 equivalent package (SOC-11184)

Changes in ardana-opsconsole-ui:

• Add BuildRequires for ardana-devel so that the ardana_description macro is defined.

• Ensure SOC 9 package obsoletes HOS 8 equivalent package (SOC-11184)

Changes in ardana-osconfig:

• Update to version 9.0+git.1597427032.a062830:
  • Check for HOS 8 release package being installed (SOC-11184)

Changes in crowbar-core:

• Update to version 6.0+git.1598519900.770074aa7:
  • upgrade: Allow transition from crowbar_upgrade to rebsct (trivial)

Changes in grafana:

• BuildRequire go1.14 explicitly
• Add recompress source service
• Add go_modules source service to create vendor.tar.gz containing 3rd party go modules.
• Adjust spec to work for Grafana-6.7.4
• Adjust Makefile to work for Grafana-6.7.4
• Remove CVE-2019-15043.patch (merged upstream)
• Remove CVE-2020-13379.patch (merged upstream)
• Remove 0001-CVE-2020-12052-bsc1170657-XSS-annotation-popup-vulnerability.patch (merged upstream)
• Update to version 6.7.4 (bsc#1172450, CVE-2018-18623, CVE-2018-18624, CVE-2018-18625, bsc#1174583, CVE-2020-11110)
  • Only allow 32 hexadecimal digits for the avatar hash
  • 6.7.3 cherry-picks (#23808)
  • Fix CI for pushing a multi-architecture manifest (#23327)
  • AzureMonitor: Fix Log Analytics and Application Insights for Azure China (#21803) (#22753)
  • Revert 'grafana/data: PanelTypeChangedHandler API update to use PanelModel instead of panel options object [BREAKING] (#22754)'
  • Bumped version
  • Snapshots: Sanitize orignal url (#23254)
  • Plugins: Expose promiseToDigest (#23249)
  • Variables: Do not update variable from url when value is the same (#23220)
  • DashboardSave: Add new dashboard check (#23104)
  • Fix: reverted back to import * as module instead of using namespaces (#23069)
  • BackendSrv: Adds config to response to fix external plugins that use this (#23032)
  • DataLinks: make sure we use…

This update for ansible, crowbar-core, crowbar-openstack, grafana, grafana-natel-discrete-panel, openstack-aodh, openstack-barbican, openstack-cinder, openstack-gnocchi, openstack-heat, openstack-ironic, openstack-magnum, openstack-manila, openstack-monasca-agent, openstack-murano, openstack-neutron, openstack-neutron-vpnaas, openstack-nova, openstack-sahara, python-Pillow, rubygem-crowbar-client fixes the following issues:

Security fixes included on this update:

for ansible:

• CVE-2020-1733,CVE-2020-10744: Fixed a race condition and insecure permissions which could have allowed another user on the node to gain control of the become user (bsc#1171823 and bsc#1164140).

for grafana:

• CVE-2020-11110, CVE-2018-18623, CVE-2018-18624, CVE-2018-18625: Fixed XSS vulnerabilities in dashboard due to an incomplete fix for CVE-2018-12099

for openstack-nova:

• CVE-2020-17376: Fixed an issue in which live migration failed to update persistent domain XML (bsc#1175484)

for python-pillow:

• CVE-2016-0775: Fixed a buffer overflow in FliDecode.c (bsc#965582)
• CVE-2020-10177: Fix-OOB-reads-in-FLI-decoding (bsc#1173413)
• CVE-2020-10994: Fix-bounds-overflow-in-JPEG-2000-decoding (bsc#1173418)
• CVE-2020-10378: Fix-bounds-overflow-in-PCX-decoding (bsc#1173416)

for rubygem-crowbar-client:

• CVE-2018-17954: Fixed an issue where provision leaks admin password to all nodes in cleartext (bsc#1117080)

Non-security fixes included on this update:

Changes in ansible:

• Update CVE-2020-10744_avoid_mkdir_p.patch to include missing parts and rename to CVE-2020-1733_avoid_mkdir_p.patch to make it clear which CVE is fixed there (bsc#1164140)

• Add CVE-2020-10744_avoid_mkdir_p.patch (bsc#1171823) to fix insecure temporary directory creation.

Changes in crowbar-core:

• Update to version 4.0+git.1600767499.0615a418f:

  • provisioner: check for client_user (SOC-11389)
  • crowbar: Also add access to /restricted/ in SSL vhost (SOC-11352)
  • crowbar: Allow hardware-installing -> discovering transition (noref)
  • crowbar: Add Restricted controller with API for restricted clients (bsc#1117080)
  • crowbar: Add complete list of states to Crowbar::State (noref)
  • provisioner: Remove the need for /updates/parse_node_data (noref)
  • crowbar: Create helper module to validate states (noref)
  • provisioner: Use new restricted API (bsc#1117080)
  • provisioner: Do not read /etc/crowbar.install.key from crowbar_joi (bsc#1117080)
  • provisioner: Remove use of privileged user for Windows machine (bsc#1117080)
  • provisioner: Use restricted client during provisioning (bsc#1117080)
  • provisioner: Use restricted client for crowbar_register (bsc#1117080)
  • provisioner: Drop /etc/crowbar.install.key bits from autoyast prof (bsc#1117080)
  • Avoid hardcoding machine-install user (bsc#1117080)
  • crowbar: Restrict admin access (bsc#1117080)

• Update to version 4.0+git.1600416364.5a9286e31:

  • Whitelist fixed CVEs in travis (noref)
  • Disable cookbook tests (noref)

Changes in crowbar-openstack:

• Update to version 4.0+git.1599037255.25b759234:
  • horizon: Update configuration for Grafana 5.x

Changes in grafana:

• BuildRequire go1.14 explicitly
• Add recompress source service
• Add go_modules source service to create vendor.tar.gz containing 3rd party go modules.
• Adjust spec to work for Grafana-6.7.4
• Adjust Makefile to work for Grafana-6.7.4
• Remove CVE-2019-15043.patch (merged upstream)
• Remove CVE-2020-13379.patch (merged upstream)
• Remove 0001-CVE-2020-12052-bsc1170657-XSS-annotation-popup-vulnerability.patch (merged upstream)
• Update to version 6.7.4 (bsc#1172450, CVE-2018-18623, CVE-2018-18624, CVE-2018-18625, bsc#1174583, CVE-2020-11110)
  • Only allow 32 hexadecimal digits for the avatar hash
  • 6.7.3 cherry-picks (#23808)
  • Fix CI for pushing a multi-architecture manifest (#23327)
  • AzureMonitor: Fix Log Analytics and Application Insights for Azure China (#21803) (#22753)
  • Revert 'grafana/data:…

This update for ansible, ardana-ansible, ardana-cinder, ardana-glance, ardana-mq, ardana-nova, ardana-osconfig, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, grafana-natel-discrete-panel, openstack-cinder, openstack-monasca-installer, openstack-neutron, openstack-nova, python-Django, python-Flask-Cors, python-Pillow, python-ardana-packager, python-keystoneclient, python-keystonemiddleware, python-kombu, python-straight-plugin, python-urllib3, release-notes-suse-openstack-cloud, storm, storm-kit, venv-openstack-cinder, venv-openstack-swift contains the following fixes:

Security fixes included in this update: ansible to 2.9.14:

• CVE-2020-1733: Fixed insecure temporary directory when running become_user (bsc#1164140).
• CVE-2020-1753: Kubectl connection plugin - connection plugin now redact kubectl_token and kubectl_password in console log. (bsc#1166389)
• CVE-2020-14365: Previously, regardless of the disable_gpg_check option, packages were not GPG validated. They are now. (bsc#1175993)
• CVE-2020-14332: copy - Redact the value of the no_log 'content' parameter in the result's invocation.module_args in check mode. Previously when used with check mode and with '-vvv', the module would not censor the content if a change would be made to the destination path. (bsc#1174302)
• CVE-2020-1736: atomic_move - Change default permissions when creating temporary files so they are not world readable (bsc#1164134).
• CVE-2020-14330: Sanitize no_log values from any response keys that might be returned from the uri module (bsc#1174145).
• CVE-2019-14846: Reset logging level to INFO. (bsc#1153452).
• CVE-2020-10744: incomplete fix for CVE-2020-1733 (bsc#1171823).

grafana:

• CVE-2018-18623, CVE-2018-18624,CVE-2018-18625: Fixed multiple XSS vulnerabilities in dashboard due to a incomplete fix for CVE-2018-12099 (bsc#1172450).
• CVE-2020-11110: Fixed a stored XSS (bsc#1174583).

openstack-nova:

• CVE-2020-17376: Fixed an information leak during live migration (bsc#1175484).

python-Django to 1.11.29

• CVE-2020-7471: Fixed a SQL injection via StringAgg delimiter (bsc#1161919).
• CVE-2020-9402: Fixed a SQL injection via tolerance parameter in GIS functions and aggregates (bsc#1165022).
• CVE-2019-19844: Fixed a potential account hijack via password reset form (bsc#1159447).

python-Flask-Cors

• CVE-2020-25032: Fixed a potential information leak through path traversal (bsc#1175986).

python-Pillow

• CVE-2020-10177: Fixed multiple out-of-bounds reads in libImaging/FliDecode.c (bsc#1173413).
• CVE-2020-10994: Fixed multiple out-of-bounds reads via a crafted JP2 files (bsc#1173418).
• CVE-2020-10378: Fixed an out-of-bounds read when reading PCX files (bsc#1173416).

python-urllib3

• CVE-2020-26137: Fixed CRLF injection via HTTP request method (bsc#1177120)

storm:

• CVE-2018-11779: Fixed java deserialization vulnerability related to the usage of storm-kafka-client or storm-kafka modules (bsc#1143163).
• CVE-2019-0202: Fixed an information leak related to the log viewer (bsc#1142617).

rubygem-crowbar-client update to 3.9.3:

• CVE-2018-17954: Fixed information leak of the admin password to all nodes in cleartext during provisioning (bsc#1117080)

Non-security fixes included on this update:

Changes in ansible:

• Update to ansible 2.9.14:
  • minor bugs and fixes, including security bugs:
    • CVE-2020-1753, bsc#1166389: Kubectl connection plugin - connection plugin now redact kubectl_token and kubectl_password in console log.
    • revert CVE-2020-1736. Users are encouraged to specify a mode parameter in their file-based tasks when the files being manipulated contain sensitive data.
    • CVE-2020-14365, bsc#1175993: Previously, regardless of the disable_gpg_check option, packages were not GPG validated. They are now.
    • CVE-2020-14332, bsc#1174302: copy - Redact the value of the no_log 'content' parameter in the result's invocation.module_args in …

It was discovered that Nova did not properly manage data logged into the log file. An attacker with read access to the service's logs could exploit this issue and may obtain sensitive information. This issue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 LTS. (CVE-2015-9543)

It was discovered that Nova did not properly handle attaching and reattaching the encrypted volume. An attacker could possibly use this issue to perform a denial of service attack. This issue only affected Ubuntu 16.04 ESM. (CVE-2017-18191)

It was discovered that Nova did not properly handle the updation of domain XML after live migration. An attacker could possibly use this issue to corrupt the volume or perform a denial of service attack. This issue only affected Ubuntu 18.04 LTS. (CVE-2020-17376)

It was discovered that Nova was not properly validating the URL passed to noVNC. An attacker could possibly use this issue by providing malicious URL to the noVNC proxy to redirect to any desired URL. This issue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 LTS. (CVE-2021-3654)

It was discovered that Nova did not properly handle changes in the neutron port of vnic_type type. An authenticated user could possibly use this issue to perform a denial of service attack. This issue only affected Ubuntu 20.04 LTS. (CVE-2022-37394)