CVE-2021-3281

In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.

In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.

In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.

In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.

In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.

This update for ardana-horizon, ardana-logging, ardana-monasca, ardana-mq, ardana-osconfig, crowbar-ha, crowbar-openstack, kibana, openstack-neutron, openstack-nova, python-Django, release-notes-suse-openstack-cloud, sleshammer, spark fixes the following issues:

Security fix from this update: python-Django1

• CVE-2021-3281: Fixed a potential directory traversal when extracting archives (bsc#1181379).

Changes in ardana-horizon_Update:

• Update to version 8.0+git.1610733160.0f577f4:
  • Add Fix for logfile permissions (bsc#1179189)

Changes in ardana-logging_Update:

• Update to version 8.0+git.1610573640.452aed1:
  • Remove some files from upgrade.yml (bsc#1179189)

Changes in ardana-monasca_Update:

• Update to version 8.0+git.1610740501.5dca121:
  • Add Fix for logfile permissions (bsc#1179189)

Changes in ardana-mq_Update:

• Update to version 8.0+git.1605176800.52cccfa:
  • Re-enable mirroring of fanout and reply queues (bsc#1177611)

Changes in ardana-osconfig_Update:

• Update to version 8.0+git.1610643571.91b88d6:
  • Remove SLES-12-SP3-LTSS repos (bsc#1180916)

Changes in crowbar-ha:

• Update to version 5.0+git.1610564036.b75ee1b:
  • [5.0] crowbar-pacemaker: Cluster member SSH key improvements

Changes in crowbar-openstack:

• Update to version 5.0+git.1610402513.08dca931e:

  • neutron: Fix handling of networks with non-ascii names (SOC-11429)

• Update to version 5.0+git.1610372799.621afb999:

  • keystone: fix keystone node lookup (SOC-11333, bsc#1164838)

Changes in kibana:

• Add 0001-Configurable-custom-response-headers-for-server.patch (bsc#1171909, CVE-2020-10743)

• Added kibana.yml symlink (bsc#1048688, FATE#323204)

Changes in openstack-nova_Update:

• Update to version nova-16.1.9.dev78:
  • [stable-only] Cap bandit to 1.6.2

Changes in python-Django_Update:

• Add CVE-2021-3281.patch (bsc#1181379, CVE-2021-3281)
  • Fixes a potential directory traversal when extracting archives

Changes in release-notes-suse-openstack-cloud:

• Fix incorrect issue number for bsc#1179955
• Update to version 8.20201214:
  • Add workaround for secure boot issue when shim package is updated. (bsc#1179955)

Changes in spark_Update:

• Add _constraints to prevent build from running out of disk space.

Changes in sleshammer:

• Really drop etc/udev/rules.d/70-persistent-net.rules from the overlay it was still present in the tarball. (SOC-9288)

• added ruby2.1-rubygem-crowbar-client providing crowbarctl

This update for ardana-db, ardana-horizon, ardana-logging, ardana-monasca, ardana-opsconsole-ui, ardana-osconfig, crowbar-core, crowbar-openstack, kibana, openstack-dashboard, openstack-manila, openstack-neutron, openstack-neutron-gbp, openstack-nova, python-Django1, release-notes-suse-openstack-cloud, sleshammer fixes the following issues:

Security fix included in this update: python-Django1

• CVE-2021-3281: Fixed a potential directory traversal when extracting archives (bsc#1181379).

Non-security fixes included in this update

Changes in ardana-db:

• Update to version 9.0+git.1611600773.5f1de5f:
  • Add tasks to check for the TLS certificate expiry (bsc#1181040)

Changes in ardana-horizon:

• Update to version 9.0+git.1610491814.38661c2:
  • Add Fix for logfile permissions (bsc#1179189)

Changes in ardana-logging:

• Update to version 9.0+git.1610490922.d5f9813:
  • Remove some files and fix mysql logs locations (bsc#1179189)

Changes in ardana-monasca:

• Update to version 9.0+git.1610547641.d79ecfd:
  • Add Fix for logfile permissions (bsc#1179189)

Changes in ardana-opsconsole-ui:

• Update to version 9.0+git.1611867924.eb82818:
  • Adjust period used to query monasca summary metrics (bsc#1181521)

Changes in ardana-osconfig:

• Update to version 9.0+git.1610634027.5934cf8:
  • Fix logrotate code that needs to silence the grep (bsc#1179189)

Changes in crowbar-core:

• Update to version 6.0+git.1611320924.849e748ff:
  • avoid v4.1.5 of delayed_job_active_record (noref)
  • add CVE-2020-26247 to travis ignore list (bsc#1180507)

Changes in crowbar-openstack:

• Update to version 6.0+git.1610402342.21499240d:

  • neutron: Fix handling of networks with non-ascii names (SOC-11429)

• Update to version 6.0+git.1610374680.e68ff27d2:

  • Terminate ssl on haproxy for cinder (bsc#1149535)
  • Terminate ssl on haproxy for nova (bsc#1149535)

Changes in kibana:

• Added kibana.yml symlink (bsc#1048688, FATE#323204) Changes in openstack-dashboard:

• add 0001-Fix-network_topology-view-memory-and-file-leaks.patch

• Update to version horizon-14.1.1.dev10:

  • Fix open redirect (OSSA-2020-008, CVE-2020-29565)

• Update to version horizon-14.1.1.dev8:

  • Cap bandit for python 2.7 env

Changes in openstack-manila:

• Update to version manila-7.4.2.dev60:

  • [stable/rocky] Adjust CI jobs
  • [NetApp] Fix CIFS promote back issue

• Update to version manila-7.4.2.dev58:

  • [stable/rocky] Adjust CI jobs

Changes in openstack-manila:

• Update to version manila-7.4.2.dev60:

  • [stable/rocky] Adjust CI jobs
  • [NetApp] Fix CIFS promote back issue

• Update to version manila-7.4.2.dev58:

  • [stable/rocky] Adjust CI jobs

Changes in openstack-neutron:

• Update to version neutron-13.0.8.dev147:

  • Improve DHCP agent's debug messages

• Update to version neutron-13.0.8.dev145:

  • Use consistent filter API syntax

• Update to version neutron-13.0.8.dev144:

  • Improve the CIDRs overlap check method for router add interface

• Update to version neutron-13.0.8.dev142:

  • [GRE] Add possibility to create GRE tunnels over IPv6

• Update to version neutron-13.0.8.dev140:

  • Fix migration from the HA to non-HA routers

• Update to version neutron-13.0.8.dev138:

  • Dropping lower constraints testing (stable Rocky)
  • Fix calling of add_tunnel_port method from sanity checks module

• Update to version neutron-13.0.8.dev136:

  • Dropping lower constraints testing (stable Rocky)

Changes in openstack-neutron:

• Update to version neutron-13.0.8.dev147:

  • Improve DHCP agent's debug messages

• Update to version neutron-13.0.8.dev145:

  • Use consistent filter API syntax

• Update to version neutron-13.0.8.dev144:

  • Improve the CIDRs overlap check method for router add interface

• Update to version neutron-13.0.8.dev142:

  • [GRE] Add possibility to create GRE tunnels over IPv6

• Update to version neutron-13.0.8.dev140:

  • Fix migration from the HA to non-HA routers

• Update to version neutron-13.0.8.dev138:

  • Dropping lower constraints testing…

This update for crowbar-openstack, grafana, kibana, monasca-installer, python-Django, python-py, rubygem-activerecord-session_store contains the following fixes:

Security fixes included in this update:

crowbar-openstack:

• CVE-2016-8611: Added rate limiting for the '/images' API POST method (bsc#1005886).

grafana:

• CVE-2021-27358: Fixed a denial of service via remote API call (bsc#1183803)

kibana:

• CVE-2017-11499: Fixed a vulnerability in nodejs, related to the HashTable implementation, which could cause a denial of service (bsc#1044849)
• CVE-2017-11481: Fixed a cross site scripting vulnerability via via URL fields (bsc#1044849)

python-Django:

• CVE-2021-3281: Fixed a directory traversal via archive.extract() (bsc#1181379)
• CVE-2021-28658: Fixed a directory traversal via uploaded files (bsc#1184148)
• CVE-2021-31542: Fixed a directory traversal via uploaded files with suitably crafted file names (bsc#1185623)
• CVE-2021-33203:Fixed potential path-traversal via admindocs' TemplateDetailView (bsc#1186608)
• CVE-2021-33571: Tighten validator checks to not allow leading zeros in IPv4 addresses, which potentially leads to further attacks (bsc#1186611)

python-py:

• CVE-2020-29651: Fixed a denial of service via regular expressions (bsc#1179805)

rubygem-activerecord-session_store:

• CVE-2019-25025: Fixed a timing attacks targeting the session id which could allow an attack to hijack sessions (bsc#1183174)

Non-security fixes included in this update:

Changes in crowbar-openstack:

• Update to version 4.0+git.1616146720.44daffca0:
  • monasca: restart Kibana on update (bsc#1044849)

Changes in grafana_Update:

• Add CVE-2021-27358.patch (bsc#1183803, CVE-2021-27358)
  • Prevent unauthenticated remote attackers from causing a DoS through the snapshots API.

Changes in kibana_Update:

• Ensure /etc/sysconfig/kibana is present

• Update to Kibana 4.6.6 (bsc#1044849, CVE-2017-11499, ESA-2017-14, ESA-2017-16)

  • [4.6] ignore forked code for babel transpile build phase (#13483)
  • Allow more than match queries in custom filters (#8614) (#10857)
  • [state] don't make extra $location.replace() calls (#9954)
  • [optimizer] move to querystring-browser package for up-to-date api
  • [state/unhashUrl] use encode-uri-query to generate cleanly encoded urls
  • server: refactor log_interceptor to be more DRY (#9617)
  • server: downgrade ECANCELED logs to debug (#9616)
  • server: do not treat logged warnings as errors (#8746) (#9610)
  • [server/logger] downgrade EPIPE errors to debug level (#9023)
  • Add basepath when redirecting from a trailling slash (#9035)
  • [es/kibanaIndex] use unmapped_type rather than ignore_unmapped (#8968)
  • [server/shortUrl] validate urls before shortening them

• Add CVE-2017-11481.patch (bsc#1044849, CVE-2017-11481)

  • This fixes an XSS vulnerability in URL fields

• Remove %dir declaration from /opt/kibana/optimize to ensure no files owned by root end up in there

• Exclude /opt/kibana/optimize from %fdupes

• Restart service on upgrade

• Do not copy LICENSE.txt and README.txt to /opt/kibana

• Fix rpmlint warnings/errors

• Switch to explicit patch application

• Fix source URL

• Fix logic for systemd/systemv detection

Changes in monasca-installer_Update:

• Add support-influxdb-1.2.patch (SOC-11435)

Changes in python-Django_Update:

• Fixed potential path-traversal via admindocs' TemplateDetailView.(bsc#1186608, CVE-2021-33203)
• Prevented leading zeros in IPv4 addresses. (bsc#1186611, CVE-2021-33571)
• Add delegate-os-path-filename-generation-to-storage.patch (bsc#1185623)
  • Needed for CVE-2021-31542.patch to apply
• Tightened path & file name sanitation in file uploads. (bsc#1185623, CVE-2021-31542)
• Fixed potential directory-traversal via uploaded files. (bsc#1184148, CVE-2021-28658)
• Fixes a potential directory traversal when extracting archives. (bsc#1181379, CVE-2021-3281)

Changes in python-py_Update:

• Add CVE-2020-29651.patch (CVE-2020-29651, bsc#1179805)
  • svnwc: fix regular…

Wang Baohua discovered that Django incorrectly extracted archive files. A remote attacker could possibly use this issue to extract files outside of their expected location.

USN-4715-1 fixed a vulnerability in Django. This update provides the corresponding update for Ubuntu 14.04 ESM.

Original advisory details:

Wang Baohua discovered that Django incorrectly extracted archive files. A remote attacker could possibly use this issue to extract files outside of their expected location.