CVE-2019-0804

An information disclosure vulnerability exists in the way Azure WaLinuxAgent creates swap files on resource disks, aka 'Azure Linux Agent Information Disclosure Vulnerability'.

This update for python-azure-agent fixes the following issues:

• CVE-2019-0804: An issue with swapfile handling in the agent created a data leak situation that exposes system memory data. (bsc#1127838)

This update was imported from the SUSE:SLE-15:Update update project.

This update for python-azure-agent fixes the following issues:

python-azure-agent was updated to version 2.2.45 (jsc#ECO-80)

• Add support for Gen2 VM resource disks
• Use alternate systemd detection
• Fix /proc/net/route requirement that causes errors on FreeBSD
• Add cloud-init auto-detect to prevent multiple provisioning mechanisms from relying on configuration for coordination
• Disable cgroups when daemon is setup incorrectly
• Remove upgrade extension loop for the same goal state
• Add container id for extension telemetry events
• Be more exact when detecting IMDS service health
• Changing add_event to start sending missing fields

From 2.2.44 update:

• Remove outdated extension ZIP packages
• Improved error handling when starting extensions using systemd
• Reduce provisioning time of some custom images
• Improve the handling of extension download errors
• New API for extension authors to handle errors during extension update
• Fix handling of errors in calls to openssl
• Improve logic to determine current distro
• Reduce verbosity of several logging statements

From 2.2.42 update:

• Poll for artifact blob, addresses goal state procesing issue

From 2.2.41 update:

• Rewriting the mechanism to start the extension using systemd-run for systems using systemd for managing
• Refactoring of resource monitoring framework using cgroup for both systemd and non-systemd approaches [#1530, #1534]
• Telemetry pipeline for resource monitoring data

From 2.2.40 update:

• Fixed tracking of memory/cpu usage
• Do not prevent extensions from running if setting up cgroups fails
• Enable systemd-aware deprovisioning on all versions >= 18.04
• Add systemd support for Debian Jessie, Stretch, and Buster
• Support for Linux Openwrt

From 2.2.38 update:

Security issue fixed:

• CVE-2019-0804: An issue with swapfile handling in the agent creates a data leak situation that exposes system memory data. (bsc#1127838)
• Add fixes for handling swap file and other nit fixes

From 2.2.37 update:

• Improves re-try logic to handle errors while downloading extensions

This update was imported from the SUSE:SLE-15-SP1:Update update project.

These are all security issues fixed in the python-azure-agent-2.2.49.2-4.5 package on the GA media of openSUSE Tumbleweed.

This update for python-azure-agent fixes the following issues:

• CVE-2019-0804: An issue with swapfile handling in the agent created a data leak situation that exposes system memory data. (bsc#1127838)

This update for python-azure-agent fixes the following issues:

Update to version 2.2.45 (jsc#ECO-80 bsc#1159639)

• Add support for Gen2 VM resource disks
• Use alternate systemd detection
• Fix /proc/net/route requirement that causes errors on FreeBSD
• Add cloud-init auto-detect to prevent multiple provisioning mechanisms from relying on configuration for coordination
• Disable cgroups when daemon is setup incorrectly
• Remove upgrade extension loop for the same goal state
• Add container id for extension telemetry events
• Be more exact when detecting IMDS service health
• Changing add_event to start sending missing fields

Update to version 2.2.44:

• Remove outdated extension ZIP packages
• Improved error handling when starting extensions using systemd
• Reduce provisioning time of some custom images
• Improve the handling of extension download errors
• New API for extension authors to handle errors during extension update
• Fix handling of errors in calls to openssl
• Improve logic to determine current distro
• Reduce verbosity of several logging statements

Update to version 2.2.42:

• Poll for artifact blob, addresses goal state procesing issue

Update to version 2.2.41:

• Rewriting the mechanism to start the extension using systemd-run for systems using systemd for managing
• Refactoring of resource monitoring framework using cgroup for both systemd and non-systemd approaches [#1530, #1534]
• Telemetry pipeline for resource monitoring data

Update to version 2.2.40:

• Fixed tracking of memory/cpu usage
• Do not prevent extensions from running if setting up cgroups fails
• Enable systemd-aware deprovisioning on all versions >= 18.04
• Add systemd support for Debian Jessie, Stretch, and Buster
• Support for Linux Openwrt

Update to version 2.2.38:

• CVE-2019-0804: WALinuxAgent could be made to expose sensitive information. (bsc#1127838)
• Add fixes for handling swap file and other nit fixes

Update to version 2.2.37:

• Improves re-try logic to handle errors while downloading extensions

This update for python-azure-agent fixes the following issues:

Update to version 2.2.45 (jsc#ECO-80)

• Add support for Gen2 VM resource disks
• Use alternate systemd detection
• Fix /proc/net/route requirement that causes errors on FreeBSD
• Add cloud-init auto-detect to prevent multiple provisioning mechanisms from relying on configuration for coordination
• Disable cgroups when daemon is setup incorrectly
• Remove upgrade extension loop for the same goal state
• Add container id for extension telemetry events
• Be more exact when detecting IMDS service health
• Changing add_event to start sending missing fields

Update to version 2.2.44:

• Remove outdated extension ZIP packages
• Improved error handling when starting extensions using systemd
• Reduce provisioning time of some custom images
• Improve the handling of extension download errors
• New API for extension authors to handle errors during extension update
• Fix handling of errors in calls to openssl
• Improve logic to determine current distro
• Reduce verbosity of several logging statements

Update to version 2.2.42:

• Poll for artifact blob, addresses goal state procesing issue

Update to version 2.2.41:

• Rewriting the mechanism to start the extension using systemd-run for systems using systemd for managing
• Refactoring of resource monitoring framework using cgroup for both systemd and non-systemd approaches [#1530, #1534]
• Telemetry pipeline for resource monitoring data

Update to version 2.2.40:

• Fixed tracking of memory/cpu usage
• Do not prevent extensions from running if setting up cgroups fails
• Enable systemd-aware deprovisioning on all versions >= 18.04
• Add systemd support for Debian Jessie, Stretch, and Buster
• Support for Linux Openwrt

Update to version 2.2.38:

• CVE-2019-0804: An issue with swapfile handling in the agent creates a data leak situation that exposes system memory data. (bsc#1127838)
• Add fixes for handling swap file and other nit fixes

Update to 2.2.37:

• Improves re-try logic to handle errors while downloading extensions

This update for python-azure-agent fixes the following issues:

python-azure-agent was updated to version 2.2.45 (jsc#ECO-80)

• Add support for Gen2 VM resource disks
• Use alternate systemd detection
• Fix /proc/net/route requirement that causes errors on FreeBSD
• Add cloud-init auto-detect to prevent multiple provisioning mechanisms from relying on configuration for coordination
• Disable cgroups when daemon is setup incorrectly
• Remove upgrade extension loop for the same goal state
• Add container id for extension telemetry events
• Be more exact when detecting IMDS service health
• Changing add_event to start sending missing fields

From 2.2.44 update:

• Remove outdated extension ZIP packages
• Improved error handling when starting extensions using systemd
• Reduce provisioning time of some custom images
• Improve the handling of extension download errors
• New API for extension authors to handle errors during extension update
• Fix handling of errors in calls to openssl
• Improve logic to determine current distro
• Reduce verbosity of several logging statements

From 2.2.42 update:

• Poll for artifact blob, addresses goal state procesing issue

From 2.2.41 update:

• Rewriting the mechanism to start the extension using systemd-run for systems using systemd for managing
• Refactoring of resource monitoring framework using cgroup for both systemd and non-systemd approaches [#1530, #1534]
• Telemetry pipeline for resource monitoring data

From 2.2.40 update:

• Fixed tracking of memory/cpu usage
• Do not prevent extensions from running if setting up cgroups fails
• Enable systemd-aware deprovisioning on all versions >= 18.04
• Add systemd support for Debian Jessie, Stretch, and Buster
• Support for Linux Openwrt

From 2.2.38 update:

Security issue fixed:

• CVE-2019-0804: An issue with swapfile handling in the agent creates a data leak situation that exposes system memory data. (bsc#1127838)
• Add fixes for handling swap file and other nit fixes

From 2.2.37 update:

• Improves re-try logic to handle errors while downloading extensions

This update for python-azure-agent fixes the following issues:

• Properly set the dhcp configuration to push the hostname to the DHCP server (bsc#1173866)
• Do not bring the interface down to push the hostname, just use ifup
• Set the hostname using hostnamectl to ensure setting is properly applied (bsc#1167601, bsc#1167602)

Update to version 2.2.45 (jsc#ECO-80)

• Add support for Gen2 VM resource disks
• Use alternate systemd detection
• Fix /proc/net/route requirement that causes errors on FreeBSD
• Add cloud-init auto-detect to prevent multiple provisioning mechanisms from relying on configuration for coordination
• Disable cgroups when daemon is setup incorrectly
• Remove upgrade extension loop for the same goal state
• Add container id for extension telemetry events
• Be more exact when detecting IMDS service health
• Changing add_event to start sending missing fields

It was discovered that WALinuxAgent created swap files with incorrect permissions. A local attacker could possibly use this issue to obtain sensitive information from the swap file.