CVE-2019-10876

An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated user may prevent Neutron from being able to configure networks on any compute nodes where those security groups are present, because of an Open vSwitch (OVS) firewall KeyError. All Neutron deployments utilizing neutron-openvswitch-agent are affected.

An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated user may prevent Neutron from being able to configure networks on any compute nodes where those security groups are present, because of an Open vSwitch (OVS) firewall KeyError. All Neutron deployments utilizing neutron-openvswitch-agent are affected.

An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated user may prevent Neutron from being able to configure networks on any compute nodes where those security groups are present, because of an Open vSwitch (OVS) firewall KeyError. All Neutron deployments utilizing neutron-openvswitch-agent are affected.

This update for ardana and crowbar fixes the following issues:

• Restrict rootwrap directories for cinder (bsc#1132542)
• Change Cinder default log level from DEBUG to INFO (SCRD-7132)
• Remove configuration from migration (bsc#1126391)
• Configurable innodb flush options (SCRD-7496)
• Secure designate's rootwrap files (bsc#1132542)
• specify rootwrap config file in designate sudoer (bsc#1132542)
• Update Designate log threshold from DEBUG to INFO (SCRD-8459)
• Change Glance default log level from DEBUG to INFO (SCRD-8592)
• Change Heat default log level from DEBUG to INFO (SCRD-7132)
• Fix Horizon missing create snapshot action for users (bsc#1130593)
• Don't set external-name in ardana-ci models (SCRD-7471)
• Fix fail-over/-back behavior of haproxy for galera (bsc#1122875)
• Update swift endpoints from keystone-reconfigure.yml if needed (SCRD-8703)
• Change Magnum default log level from DEFAULT to INFO (SCRD-7132)
• Rip out vertica related code (SCRD-9031)
• Tighten neutron sudoers to only execute rootwrap (bsc#1132542)
• Change Neutron default log level from DEBUG to INFO (SCRD-7132)
• SCRD-9031 Change permitted nova-rootwrap config file pattern (bsc#1132542)
• specify rootwrap config file in nova sudoer (bsc#1132542)
• Change Nova default log level from DEBUG to INFO (SCRD-7132)
• Stop installing a sudoers root escalator (SCRD-9031)
• Change Octavia default log level from DEBUG to INFO (SCRD-7132)
• Increase number of connect retries (SCRD-7496)
• UDEV rules for multi-port nics (SCRD-8329)
• Ensure that the ceph group exists (SCRD-8347)
• Disable test_create_health_monitor_with_scenarios tempest (SOC-9176)
• Make --os-test-timeout configurable and increase default (SCRD-7496)
• Disable TestVolumeBootPattern.test_volume_boot_pattern (SCRD-9015)
• Increase and make timeout values configurable (SCRD-7496)
• Configure heat boot config template path (SCRD-7496)
• Fix typo on ceilometer filter (SCRD-7496)
• barclamp: Fix setting MTU on networks using a bridge
• Fix order of values in nodes piechart
• Ignore CVE-2019-11068 during Travis (SOC-9262)
• Fix cloud-mkcloud9-job-backup-restore (SCRD-7126)
• Update suse-branding.patch with correct links for documentation (SCRD-8294)
• pacemaker: add failure nodes to sync fail message (bsc#1083721)
• update suse-branding.patch (SOC-9297)
• pacemaker: wait more for founder if SBD is configured (SCRD-8462)
• pacemaker: don't check cluster members on founder (SCRD-8462)
• database: Make wsrep_provider_options configurable (fate#327745)
• database: Raise and align promote/demote timeouts (bsc#1131791)
• mysql: improve galera HA setup (bsc#1122875)
• Update suse-branding.patch with correct links for documentation (SCRD-8294)
• neutron: Fix the rest of the keystone related settings for LBaaS
• neutron: properly define neutron lbaas region (bsc#1128753)
• CLM - update MariaDB manually (bsc#1132852, SOC-9022)
• update MariaDB manually (bsc#1132852, SOC-9022)
• SOC8 alarm table restructure ((SCRD-7710, bsc#1124170)
• Fix bsc#1118003
• add deprecation decision tree (shrub) (SCRD-8530)
• add cert section (SCRD-5542)
• grammar; make migration pairing more explicit (SCRD-7595)
• Remove whitespace on top of login page (SCRD-7142)
• Revert alert and form colors to default SCRD-6919
• Change active sidebar section text white SCRD-6919
• Updated the openstack-monasca-agent-sudoers file (bsc#1132542)
• Don't restart neutron-ovs-cleanup on RPM update (bsc#1132860)
• Fix KeyError in OVS firewall (bsc#1131712, CVE-2019-10876)
• update to 1.11.20 (bsc#124991, CVE-2019-6975):
• Memory exhaustion in django.utils.numberformat.format()
• Include ops-console logs if exist (bsc-1126912)
• Add a sed pattern to censor passwords from servers.yml (bsc#1105559)
• Show the status file of crowbar upgrade (if it exists)

This update for ardana package fixes the following issues:

• Update to version 9.0+git.1560211997.7ac9792:

  • Adds repository list parameter (bsc#1122825)

• Update to version 9.0+git.1557219331.457b6e7:

  • Update gerrit location (SCRD-9140)

• Switch to new Gerrit Server

• Update to version 9.0+git.1559292830.208d258:

  • Convert number of workers to int (SOC-9418)

• Update to version 9.0+git.1557424689.2b085d5:

  • Update gerrit location (SCRD-9140)

• Update to version 9.0+git.1556225774.492d42c:

  • SCRD-8748 Fix default worker count determination logic (SCRD-8748)

• Switch to new Gerrit Server

• Update to version 9.0+git.1557220194.6a90deb:

  • Update gerrit location (SCRD-9140)

• Switch to new Gerrit Server

• Update to version 9.0+git.1557219517.7b97993:

  • Update gerrit location (SCRD-9140)

• Switch to new Gerrit Server

• Update to version 9.0+git.1559039284.6fc1d47:

  • Convert number of workers to int (SOC-9384)

• Update to version 9.0+git.1558583814.a96bada:

  • Restrict rootwrap directories for cinder (bsc#1132542)

• Update to version 9.0+git.1557421539.521a486:

  • SCRD-8748 Fix default worker count determination logic (SCRD-8748)

• Update to version 9.0+git.1557219553.d850ca4:

  • Update gerrit location (SCRD-9140)

• Switch to new Gerrit Server

• Update to version 9.0+git.1557219586.7c96a6d:

  • Update gerrit location (SCRD-9140)

• Switch to new Gerrit Server

• Update to version 9.0+git.1557219626.b190680:

  • Update gerrit location (SCRD-9140)

• Switch to new Gerrit Server

• Update to version 9.0+git.1560868957.42bcb70:

  • MariaDB conf changes IPv6 (SOC-9089)

• Update to version 9.0+git.1559351643.a440414:

  • Configure xinted mysqlchk to accept ipv6 (SOC-9369)

• Update to version 9.0+git.1557219651.3d4d2d5:

  • Update gerrit location (SCRD-9140)

• Update to version 9.0+git.1554995553.23d9513:

  • Configurable innodb flush options (SCRD-7496)

• Switch to new Gerrit Server

• Update to version 9.0+git.1558588538.9211022:

  • Secure designate's rootwrap files (bsc#1132542)

• Update to version 9.0+git.1558549508.9bfa9e7:

  • specify rootwrap config file in designate sudoer (bsc#1132542)

• Update to version 9.0+git.1557219686.0e71bf9:

  • Update gerrit location (SCRD-9140)

• Switch to new Gerrit Server

• Update to version 9.0+git.1559033522.5e5be1c:

  • Convert number of workers to int (SOC-9381)

• Update to version 9.0+git.1557421456.f1e5016:

  • SCRD-8748 Fix default worker count determination logic (SCRD-8748)

• Update to version 9.0+git.1557219717.fe1bde6:

  • Update gerrit location (SCRD-9140)

• Switch to new Gerrit Server

• Update to version 9.0+git.1559036788.b727b53:

  • Convert number of workers to int (SOC-9382)

• Update to version 9.0+git.1557421526.a8c13bf:

  • SCRD-8748 Fix default worker count determination logic (SCRD-8748)

• Update to version 9.0+git.1557219773.fe2f6aa:

  • Update gerrit location (SCRD-9140)

• Switch to new Gerrit Server

• Update to version 9.0+git.1557219807.6036a8e:

  • Update gerrit location (SCRD-9140)

• Switch to new Gerrit Server

• Update to version 9.0+git.1557220534.883f8c9:

  • Update gerrit location (SCRD-9140)

• Update to version 9.0+git.1557189507.c786525:

  • add external network to Ironic multi-tenancy input model (SCRD-8930)

• Update to version 9.0+git.1557189482.8931e67:

  • add neutron_l3_agent plugin (SCRD-8929)

• Switch to new Gerrit Server

• Update to version 9.0+git.1556199488.bdf1cdc:

  • SCRD-7471 Don't set external-name in ardana-ci models (SCRD-7471)

• Update to version 9.0+git.1559171053.476225c:

  • Move keystone error url to locale bundle (SOC-3456)
  • Add doc link to 503 error from Keystone (SOC-3456)

• Update to version 9.0+git.1558732415.467c8ab:

  • Consolidate setCloseButtonDisabled
  • Disable close button when playbook or action in progress
  • Disable close button when playbook or action in progress
  • Updated comments
  • Fixed an issue for replacing controller page
  • Prevent operations when…