CVE-2017-5637

Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.

Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.

This update for ardana-ansible, ardana-barbican, ardana-db, ardana-monasca, ardana-mq, ardana-neutron, ardana-octavia, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, documentation-suse-openstack-cloud, memcached, openstack-manila, openstack-neutron, openstack-nova, pdns, python-amqp, rubygem-puma, zookeeper contains the following fixes:

Security fix for rubygem-puma:

• CVE-2020-5247: Fixed an issue where the newlines in headers according to Rack spec were not split (bsc#1165402)

Security fix for openstack-manila:

• CVE-2020-9543: Fixed an issue where an attacker could view, update, delete, or share resources that do not

Security fixes for memcached:

• CVE-2019-15026: Fixed a stack-based buffer over-read in conn_to_str() in memcached.c (bsc#1149110).
• CVE-2019-11596: Fixed NULL pointer dereference in process_lru_command() in memcached.c (bsc#1133817).

Security fixes for pdns:

• CVE-2019-3871: Fixed a denial of service with the HTTP remote backend when the attacker can send crafted DNS queries (bsc#1129734).
• CVE-2018-10851: Fixed a denial of service via crafted zone record (bnc#1114157).
• CVE-2018-14626: Fixed a denial of service by hiding DNSSEC records using a crafted DNS query (bsc#1114169).

Security fixes for zookeeper:

• CVE-2019-0201: Fixed an information disclosure in the ACL handling (bsc#1135773).
• CVE-2017-5637: Fixed incorrect input validation with wchp/wchc four letter words (bsc#1040519).

Changes in ardana-ansible:

• Update to version 8.0+git.1583432621.24fa60e:
  • Upgrade pre-checks in Cloud 8 and Cloud 9 (SOC-10300)

Changes in ardana-barbican:

• Update to version 8.0+git.1585152761.8ef3d61:
  • monitor ardana-node-cert (SOC-10873)

Changes in ardana-db:

• Update to version 8.0+git.1583944923.03cca6c:
  • monitor MySQL TLS certificate (SOC-10873)

Changes in ardana-monasca:

• Update to version 8.0+git.1583944894.38f023a:
  • Add certificate file check alarm (SOC-10873)

Changes in ardana-mq:

• Update to version 8.0+git.1583944811.dc14403:
  • monitor RabbitMQ TLS certificate (SOC-10873)

Changes in ardana-neutron:

• Update to version 8.0+git.1584715262.e4ea620:
  • Add symlink for neutron-fwaas.json.j2 (bsc#1166290)

Changes in ardana-octavia:

• Update to version 8.0+git.1585171918.418f5cf:

  • Reconfigure monitor if needed (SOC-10873)

• Update to version 8.0+git.1585168661.135c735:

  • fix Octavia client cert redeploy (SOC-10873)

• Update to version 8.0+git.1585152502.f15907a:

  • monitor Octavia client certificate (SOC-10873)

Changes in ardana-tempest:

• Update to version 8.0+git.1585311051.6ab5488:
  • Enable port-security feature in tempest(SOC-11027)

Changes in crowbar-core:

• Update to version 5.0+git.1585575551.16781d00d:

  • upgrade: Point to config dir instead of config file (SOC-11171)
  • upgrade: Do not call neutron-evacuate-lbaasv2-agent with use_crm (SOC-11171)

• Update to version 5.0+git.1585316726.670746c8c:

  • upgrade: Fix systemd unit listing (trivial)

• Update to version 5.0+git.1585213241.46f12f9be:

  • upgrade: Remove the assignement of crowbar-upgrade role (SOC-11166)

• Update to version 5.0+git.1585118470.eed9020de:

  • Update the default value of OS version (trivial)
  • Ignore CVE-2020-5267 in CI (bsc#1167240)
  • Ignore CVE-2020-10663 in CI (bsc#1167244)

• Update to version 5.0+git.1583911121.d6b4b4b1a:

  • ses: Make SES UI safe for unknown options (trivial)
  • ses: Use cinder user for nova (SOC-11119)
  • ses: Added helper for populating cinder volumes (SOC-11117)
  • ses: Add ses cookbook (SOC-11114)
  • ses: Configuration upload (SOC-11115)

• Update to version 5.0+git.1583309007.e3a8b81e9:

  • Ignore CVE-2020-8130 in CI (bsc#1164804)
  • Ignore CVE-2020-5247 (bsc#1165402)

Changes in crowbar-ha:

• Update to version 5.0+git.1585316176.344190f:
  • add ssl termination on haproxy (bsc#1149535)

Changes in crowbar-openstack:

• Update to version 5.0+git.1585304226.2164b7895:

  • nova: Fix migration numbers (trivial)

• Update to version…

It was discovered that Apache ZooKeeper incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service or other unspecified impact. (CVE-2016-5017)

It was discovered that Apache ZooKeeper incorrectly implemented "wchp/wchc" commands. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-5637)

It was discovered that Apache Zookeeper incorrectly handled clusters. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 ESM. (CVE-2018-8012)