CVE-2020-17516

Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting, allows both encrypted and unencrypted internode connections. A misconfigured node or a malicious user can use the unencrypted connection despite not being in the same rack or dc, and bypass mutual TLS requirement.

Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting, allows both encrypted and unencrypted internode connections. A misconfigured node or a malicious user can use the unencrypted connection despite not being in the same rack or dc, and bypass mutual TLS requirement.

Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting, allows both encrypted and unencrypted internode connections. A misconfigured node or a malicious user can use the unencrypted connection despite not being in the same rack or dc, and bypass mutual TLS requirement.

Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting, allows both encrypted and unencrypted internode connections. A misconfigured node or a malicious user can use the unencrypted connection despite not being in the same rack or dc, and bypass mutual TLS requirement.

Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting, allows both encrypted and unencrypted internode connections. A misconfigured node or a malicious user can use the unencrypted connection despite not being in the same rack or dc, and bypass mutual TLS requirement.

Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting, allows both encrypted and unencrypted internode connections. A misconfigured node or a malicious user can use the unencrypted connection despite not being in the same rack or dc, and bypass mutual TLS requirement.

Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting, allows both encrypted and unencrypted internode connections. A misconfigured node or a malicious user can use the unencrypted connection despite not being in the same rack or dc, and bypass mutual TLS requirement.

This update for ardana-neutron, ardana-swift, cassandra, crowbar-openstack, grafana, kibana, openstack-dashboard, openstack-ironic, openstack-neutron, openstack-neutron-gbp, openstack-nova, python-Django1, python-py, python-pysaml2, python-xmlschema, rubygem-activerecord-session_store, venv-openstack-keystone contains the following fixes:

Security fixes included in this update:

cassandra:

• CVE-2020-17516: Fixed an issue where encryption between nodes was not enforced correctly for certain internode_encryption settings (bsc#1181689)

grafana:

• CVE-2018-18623, CVE-2018-18624, CVE-2018-18625: Fixed multiple cross site scripting vulnerabilities in the dashboard. (bsc#1172450)
• CVE-2021-27358: Fixed a denial of service via remote API call. (bsc#1183803)
• CVE-2019-15043: Fixed a denial of service by an unauthenticated user in the snapshot HTTP API (bsc#1148383)
• CVE-2020-13379: Fixed an information leak to unauthenticated users. (bsc#1172409)
• CVE-2020-12052: Fixed a cross site scripting vulnerability with the annotation popup (bsc#1170657)
• CVE-2018-19039: Fixed an issue where a privileged user could exfiltrate files (bsc#1115960)
• CVE-2020-11110: Fixed a stored cross site scripting vulnerability. (bsc#1174583)
• CVE-2020-24303: Fixed a cross site scripting vulnerability in a query alias for ElasticSearch datasources (bsc#1178243)

kibana:

• CVE-2017-11499: Fixed a vulnerability in nodejs, related to the HashTable implementation, which could cause a denial of service. (bsc#1044849)
• CVE-2017-11481: Fixed a cross site scripting vulnerability via via URL fields. (bsc#1044849)
• CVE-2020-10743: Fixed a clickjacking issue because X-Frame-Option was not used by default. (bsc#1171909)

python-Django:

• CVE-2021-23336: Fixed a web cache poisoning via django.utils.http.limited_parse_qsl(). (bsc#1182433)
• CVE-2021-28658: Fixed a directory traversal via uploaded files. (bsc#1184148)
• CVE-2021-31542: Fixed a directory traversal via uploaded files with suitably crafted file names. (bsc#1185623)
• CVE-2021-33203: Fixed potential path-traversal via admindocs' TemplateDetailView. (bsc#1186608)
• CVE-2021-33571: Tighten validator checks to not allow leading zeros in IPv4 addresses, which potentially leads to further attacks. (bsc#1186611)

python-py:

• CVE-2020-29651: Fixed a denial of service via regular expressions. (bsc#1179805)

python-pysaml2:

• CVE-2021-21238: Fixed improper verification of cryptographic signatures for signed SAML documents. (bsc#1181277)
• CVE-2021-21239: Fixed improper verification of cryptographic signatures when using CryptoBackendXmlSec1(). (bsc#1181278)

rubygem-activerecord-session_store:

• CVE-2019-25025: Fixed a timing attacks targeting the session id which could allow an attack to hijack sessions. (bsc#1183174)

Non-security changes included in this update:

Changes in ardana-neutron:

• Update to version 9.0+git.1615223676.777f0b3:
  • Allow users to stop monitoring rootwrap daemon (bsc#1182317)

Changes in ardana-swift:

• Update to version 9.0+git.1618235096.90974ed:
  • Run swiftlm-scan in the UTC timezone (bsc#1181690)

Changes in cassandra:

• update to 3.11.10 (bsc#1181689, CVE-2020-17516)

• Fix digest computation for queries with fetched but non queried columns (CASSANDRA-15962)
• Reduce amount of allocations during batch statement execution (CASSANDRA-16201)
• Update jflex-1.6.0.jar to match upstream (CASSANDRA-16393)
• Fix DecimalDeserializer#toString OOM (CASSANDRA-14925)
• Rate limit validation compactions using compaction_throughput_mb_per_sec (CASSANDRA-16161)
• SASI's max_compaction_flush_memory_in_mb settings over 100GB revert to default of 1GB (CASSANDRA-16071)
• Prevent unbounded number of pending flushing tasks (CASSANDRA-16261)
• Improve empty hint file handling during startup (CASSANDRA-16162)
• Allow empty string in collections with COPY FROM in cqlsh (CASSANDRA-16372)
• Fix skipping on pre-3.0 created compact storage sstables due to missing primary…

This update for ardana-cobbler, cassandra, cassandra-kit, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, kibana, openstack-heat-templates, openstack-monasca-installer, openstack-nova, python-Django, python-elementpath, python-eventlet, python-py, python-pysaml2, python-six, python-xmlschema fixes the following issues:

Security fixes included on this update:

cassandra-kit:

• CVE-2020-17516: Internode encryption enforcement vulnerability

cassandra:

• CVE-2020-17516: Internode encryption enforcement vulnerability
• CVE-2017-5929 logback: Fixed a serialization vulnerability in SocketServer and ServerSocketReceiver

crowbar-core: CVE-2020-26247: Potentially XXE or SSRF attacks by parsed Nokogiri::XML::Schema

grafana:

• CVE-2021-27358: Unauthenticated remote attackers to trigger a Denial of Service via a remote API call

kibana:

• CVE-2017-11481: Fixed an XSS via URL fields
• CVE-2017-11499: Fixed a constant hashtable seeds vulnerability

python-Django:

• CVE-2021-28658: Potential directory-traversal via uploaded files
• CVE-2021-31542: Potential directory-traversal via uploaded files
• CVE-2021-33203: Potential directory traversal via admindocs
• CVE-2021-33571: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses
• CVE-2021-23336: Fixed web cache poisoning via django.utils.http.limited_parse_qsl

python-eventlet:

• CVE-2021-21419: Improper handling of highly compressed data and memory allocation with excessive size value

python-pysaml2:

• CVE-2021-21238: Fixed an improper verification of cryptographic signatures for signed SAML documents
• CVE-2021-21239: Fixed an improper verification of cryptographic signatures when using CryptoBackendXmlSec1()_

python-py:

• CVE-2020-29651: Regular expression denial of service in svnwc.py

rubygem-activerecord-session_store:

• CVE-2019-25025: Fixed a hijack sessions by using timing attacks targeting the session id CVE-2019-16782

Non-security fixes included on this update:

Changes in ardana-cobbler:

• Update to version 8.0+git.1614096566.e8c2b27:
  • Change install_recommended to true (bsc#1181828)

Changes in cassandra:

• update to 3.11.10 (bsc#1181689, CVE-2020-17516)

• Fix digest computation for queries with fetched but non queried columns (CASSANDRA-15962)
• Reduce amount of allocations during batch statement execution (CASSANDRA-16201)
• Update jflex-1.6.0.jar to match upstream (CASSANDRA-16393)
• Fix DecimalDeserializer#toString OOM (CASSANDRA-14925)
• Rate limit validation compactions using compaction_throughput_mb_per_sec (CASSANDRA-16161)
• SASI's max_compaction_flush_memory_in_mb settings over 100GB revert to default of 1GB (CASSANDRA-16071)
• Prevent unbounded number of pending flushing tasks (CASSANDRA-16261)
• Improve empty hint file handling during startup (CASSANDRA-16162)
• Allow empty string in collections with COPY FROM in cqlsh (CASSANDRA-16372)
• Fix skipping on pre-3.0 created compact storage sstables due to missing primary key liveness (CASSANDRA-16226)
• Extend the exclusion of replica filtering protection to other indices instead of just SASI (CASSANDRA-16311)
• Synchronize transaction logs for JBOD (CASSANDRA-16225)
• Fix the counting of cells per partition (CASSANDRA-16259)
• Fix serial read/non-applying CAS linearizability (CASSANDRA-12126)
• Avoid potential NPE in JVMStabilityInspector (CASSANDRA-16294)
• Improved check of num_tokens against the length of initial_token (CASSANDRA-14477)
• Fix a race condition on ColumnFamilyStore and TableMetrics (CASSANDRA-16228)
• Remove the SEPExecutor blocking behavior (CASSANDRA-16186)
• Fix invalid cell value skipping when reading from disk (CASSANDRA-16223)
• Prevent invoking enable/disable gossip when not in NORMAL (CASSANDRA-16146)
• Wait for schema agreement when bootstrapping (CASSANDRA-15158)
• Fix the histogram merge of the table metrics (CASSANDRA-16259)
• Synchronize Keyspace instance store/clear…