CVE-2019-20933

InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).

InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).

Improper Authentication in InfluxDB in github.com/influxdata/influxdb

This update for crowbar-openstack, grafana, influxdb, python-urllib3 contains the following fixes:

Security fixes included in this update:

openstack-glance

• CVE-2016-8611: Added rate limiting for glance api (bnc#1005886)

grafana

• CVE-2020-24303: Fixed an XSS via a query alias for the ElasticSearch datasource (#bnc#1178243)

influxdb

• CVE-2019-20933: Fixed an authentication bypass (bnc#1178988)

python-urlib3

• CVE-2019-9740: Fixed a CRLF injection in urllib3 (bnc#1129071).
• CVE-2020-26137: Fixed a CRLF injection via HTTP request method (bnc#1177120)

memcached

• CVE-2018-1000115: Fixed a issue where a UDP server allowed spoofed traffic amplification DoS (bnc#1083903).

Non-security fixes included in this update:

Changes in crowbar-openstack:

• Update to version 4.0+git.1604938545.30c10db18:
  • rabbitmq: Fix crm running check (SOC-11240)

Changes in grafana:

• Fix bnc#1178243 CVE-2020-24303 by adding 25401-Fix-XSS-vulnerability-with-series-overrides.patch

Changes in influxdb:

• Add CVE-2019-20933.patch (bnc#1178988, CVE-2019-20933) to fix authentication bypass_

• Declare license files correctly

• Version 1.2.4:

  • The stress tool influx_stress will be removed in a subsequent release.
  • Remove the override of GOMAXPROCS.
  • Uncomment section headers from the default configuration file.
  • Improve write performance significantly.
  • Prune data in meta store for deleted shards.
  • Update latest dependencies with Godeps.
  • Introduce syntax for marking a partial response with chunking.
  • Use X-Forwarded-For IP address in HTTP logger if present.
  • Add support for secure transmission via collectd.
  • Switch logging to use structured logging everywhere.
  • [CLI feature request] USE retention policy for queries.
  • Add clear command to cli.
  • Adding ability to use parameters in queries in the v2 client using the Parameters map in the Query struct.
  • Allow add items to array config via ENV
  • Support subquery execution in the query language.
  • Verbose output for SSL connection errors.
  • Cache snapshotting performance improvements

• Partially revert previous change to fix build for Leap

Changes in python-urllib3:

• Update urllib3-fix-test-urls.patch. Adjust to match upstream solution.

• Add urllib3-fix-test-urls.patch. Fix tests failing on python checks for CVE-2019-9740.

• Add urllib3-cve-2020-26137.patch. Don't allow control chars in request method. (bnc#1177120, CVE-2020-26137)

This update for ardana-cassandra, ardana-mq, ardana-osconfig, ardana-tempest, crowbar-core, crowbar-openstack, grafana, influxdb, openstack-cinder, openstack-heat, openstack-heat-gbp, openstack-heat-templates, openstack-horizon-plugin-gbp-ui, openstack-ironic-python-agent, openstack-manila, openstack-neutron, openstack-neutron-gbp, openstack-neutron-vpnaas, openstack-nova, python-Jinja2, python-pysaml2, python-pytest, python-urllib3, release-notes-suse-openstack-cloud, spark fixes the following issues:

Security changes included on this update:

grafana:

• CVE-2020-24303: Fixed an XXS with series overides. (bsc#1178243)

influxdb:

• CVE-2019-20933: Fixed an authentication bypass. (bsc#1178988)

python-Jinja2:

• CVE-2019-10906,CVE-2019-8341,CVE-2016-10745: 'SandboxedEnvironment' securely handles 'str.format_map' in order to prevent code execution through untrusted format strings. (bsc#1132323, bsc#1125815, bsc#1132174)

python-pysaml2:

• CVE-2020-5390: Fixed an issue where there was no check that the signature in a SAML document is enveloped. (bsc#1160851)

python-urllib3:

• CVE-2020-26137: Fixed a CRLF injection via HTTP request method. (bsc#1177120)

Non-security changes included in this update:

Changes in ardana-cassandra:

• Update to version 9.0+git.1600802664.7e480a2:
  • Remove freezer related backup/restore code (SOC-7751)

Changes in ardana-mq:

• Update to version 9.0+git.1605174486.a78ddce:
  • Re-enable mirroring of fanout and reply queues (bsc#1177611)

Changes in ardana-osconfig:

• Update to version 9.0+git.1601621747.a87e5a0:
  • HOS8 check needs to be a shell rather than command (SOC-11184)

Changes in ardana-tempest:

• Update to version 9.0+git.1603378983.fc0bca9:

  • Enable VPNaaS testing (SOC-8764)

• Update to version 9.0+git.1599855218.875b2f3:

  • unblacklist some revert tests (SOC-9178)

Changes in crowbar-core:

• Update to version 6.0+git.1606314264.bf9ada813:

  • ntp: Do not use rate-limiting (bsc#1179161)

• Update to version 6.0+git.1600414599.150832ca2:

  • Ignore CVE-2020-15169 (SOC-11391)

Changes in crowbar-openstack:

• Update to version 6.0+git.1604573541.bb18c172d:

  • rabbitmq: Fix crm running check (SOC-11240)

• Update to version 6.0+git.1604491402.b4dbba849:

  • Remove aspiers from CODEOWNERS
  • Remove cmurphy from CODEOWNERS

Changes in grafana:

• Fix bsc#1178243 CVE-2020-24303 by adding 25401-Fix-XSS-vulnerability-with-series-overrides.patch

Changes in influxdb:

• Add CVE-2019-20933.patch (bsc#1178988, CVE-2019-20933) to fix authentication bypass
• Declare license files correctly

Changes in openstack-cinder:

• Update to version cinder-13.0.10.dev20:

  • PowerMax Driver - Legacy volumes fail to live migrate

• Update to version cinder-13.0.10.dev19:

  • RBD: Cleanup temporary file during exception

• Update to version cinder-13.0.10.dev17:

  • Remove experimental job legacy-tempest-dsvm-zeromq-multibackend

Changes in openstack-cinder:

• Update to version cinder-13.0.10.dev20:

  • PowerMax Driver - Legacy volumes fail to live migrate

• Update to version cinder-13.0.10.dev19:

  • RBD: Cleanup temporary file during exception

• Update to version cinder-13.0.10.dev17:

  • Remove experimental job legacy-tempest-dsvm-zeromq-multibackend

Changes in openstack-heat:

• Update to version openstack-heat-11.0.4.dev4:

  • Check external resources after creation

• Update to version openstack-heat-11.0.4.dev2:

  • Don't store signal_url for ec2 signaling of deployments
  • Allow scale-down of ASG as part of update 11.0.3

Changes in openstack-heat:

• Update to version openstack-heat-11.0.4.dev4:

  • Check external resources after creation

• Update to version openstack-heat-11.0.4.dev2:

  • Don't store signal_url for ec2 signaling of deployments
  • Allow scale-down of ASG as part of update 11.0.3

Changes in openstack-heat-gbp:

• Update to version group-based-policy-automation-12.0.1.dev2:

  • Add support for victoria

• Update to version group-based-policy-automation-12.0.1.dev1: *…

Ilya Averyanov discovered that an InfluxDB vulnerability allowed attackers to bypass authentication and gain access to any known database user.