CVE-2021-38155

OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to PCI DSS features). By guessing the name of an account and failing to authenticate multiple times, any unauthenticated actor could both confirm the account exists and obtain that account's corresponding UUID, which might be leveraged for other unrelated attacks. All deployments enabling security_compliance.lockout_failure_attempts are affected.

OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to PCI DSS features). By guessing the name of an account and failing to authenticate multiple times, any unauthenticated actor could both confirm the account exists and obtain that account's corresponding UUID, which might be leveraged for other unrelated attacks. All deployments enabling security_compliance.lockout_failure_attempts are affected.

OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to PCI DSS features). By guessing the name of an account and failing to authenticate multiple times, any unauthenticated actor could both confirm the account exists and obtain that account's corresponding UUID, which might be leveraged for other unrelated attacks. All deployments enabling security_compliance.lockout_failure_attempts are affected.

This update for documentation-suse-openstack-cloud, kibana, openstack-keystone, openstack-monasca-notification fixes the following issues:

• CVE-2021-22141: Fixed URL redirection flaw (bsc#1186868).
• CVE-2021-38155: Fixed information disclosure during account locking (bsc#1189390).

The following non-security bugs were fixed:

• Fix smtp server authentication (bsc#1197204)

This update for ardana-barbican, grafana, openstack-barbican, openstack-cinder, openstack-heat-gbp, openstack-horizon-plugin-gbp-ui, openstack-ironic, openstack-keystone, openstack-neutron-gbp, python-lxml, release-notes-suse-openstack-cloud fixes the following issues:

Security fixes included on the update:

ardana-barbican:

• Update policies to protect container secret access (SOC-11621)
• Update policies to protect secret metadata access (SOC-11620)

openstack-neutron:

• CVE-2021-40085: Fixed arbitrary dnsmasq reconfiguration via extra_dhcp_opts (bsc#1189794).

rubygem-sinatra:

• CVE-2022-29970: Fixed path traversal possible outside of public_dir when serving static files (bsc#1199138).

python-XStatic-jquery-ui:

• CVE-2021-41182: Fixed XSS in the altField option of the Datepicker widget (bsc#1192070)
• CVE-2021-41183: Fixed XSS in the of option of the .position() util (bsc#1192073)
• CVE-2021-41184: Fixed XSS in *Text options of the Datepicker widget (bsc#1192075)

python-lxml:

• CVE-2018-19787: Fixed that the lxml.html.clean module does remove javascript in lxml/html/clean.py (bsc#1118088).
• CVE-2020-27783: Fixed mXSS due to the use of improper parser (bsc#1179534).
• CVE-2021-28957: Fixed missing input sanitization for formaction HTML5 attributes that may have led to XSS (bsc#1184177).
• CVE-2021-43818: Fixed HTML Cleaner that allowed crafted and SVG embedded scripts to pass through (bsc#1193752).

openstack-barbican:

• CVE-2022-23451: Disallows authenticated users to add/modify/delete arbitrary metadata on any secret (bsc#1194952).
• CVE-2022-23452: Disallows anyone with an admin role to add their secrets to a different project's containers (bsc#1194954).

grafana:

• CVE-2021-44716: Fixed net/http: limit growth of header canonicalization cache (bsc#1193597).

openstack-keystone:

• CVE-2021-38155: Fixed information disclosure during account locking (bsc#1189390).

Non-security fixes included on the update:

Changes in ardana-barbican:

• Update to version 9.0+git.1644879908.8a641c1:

  • Update policies to protect container secret access (SOC-11621)

• Update to version 9.0+git.1643052417.9a3348e:

  • update policies to protect secret metadata access (SOC-11620)

Changes in grafana:

• Add CVE-2021-43813.patch (bsc#1193688, CVE-2021-43813)

  • directory traversal vulnerability for .md files

• Bump Go to 1.16 (bsc#1193597, CVE-2021-44716)

  • Fix Go net/http: limit growth of header canonicalization cache

Changes in openstack-barbican:

• Add patches (0001-Fix-RBAC-and-ACL-access-for-managing-secret-containe.patch and 0001-Fix-policy-for-adding-a-secret-to-a-container.patch) to fix the legacy policy rules for adding a secret to a container and removing a secret from a container. bsc#1194954,CVE-2022-23452

• Add patch (0001-Fix-secret-metadata-access-rules.patch) to fix the legacy policy rules for accessing secret metadata by checking that the user making the request is authenticated for the project that owns the secret. bsc#1194952,CVE-2022-23451

Changes in openstack-cinder:

• Update to version cinder-13.0.10.dev24:
  • Correct group:reset_group_snapshot_status policy

Changes in openstack-cinder:

• Update to version cinder-13.0.10.dev24:
  • Correct group:reset_group_snapshot_status policy

Changes in openstack-heat-gbp:

• Update to version group-based-policy-automation-14.0.1.dev4:

  • Add support for yoga

• Update to version group-based-policy-automation-14.0.1.dev3:

  • Python2/3 compatibility fixes

• Update to version group-based-policy-automation-14.0.1.dev2:

  • Add support for xena

• Update to version group-based-policy-automation-14.0.1.dev1:

  • Remove py27 from gate jobs 14.0.0

Changes in openstack-horizon-plugin-gbp-ui:

• Update to version group-based-policy-ui-14.0.1.dev3:

  • Add support for yoga

• Update to version group-based-policy-ui-14.0.1.dev2:

  • Python2/3 compatibility changes

• Update to version group-based-policy-ui-14.0.1.dev1:

  • Add support for xena …