CVE-2020-10744

An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5, 3.5.6 and 3.6.4 as well as previous versions are affected.

An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5, 3.5.6 and 3.6.4 as well as previous versions are affected.

An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5, 3.5.6 and 3.6.4 as well as previous versions are affected.

This update for ansible, crowbar-core, crowbar-openstack, grafana, grafana-natel-discrete-panel, openstack-aodh, openstack-barbican, openstack-cinder, openstack-gnocchi, openstack-heat, openstack-ironic, openstack-magnum, openstack-manila, openstack-monasca-agent, openstack-murano, openstack-neutron, openstack-neutron-vpnaas, openstack-nova, openstack-sahara, python-Pillow, rubygem-crowbar-client fixes the following issues:

Security fixes included on this update:

for ansible:

• CVE-2020-1733,CVE-2020-10744: Fixed a race condition and insecure permissions which could have allowed another user on the node to gain control of the become user (bsc#1171823 and bsc#1164140).

for grafana:

• CVE-2020-11110, CVE-2018-18623, CVE-2018-18624, CVE-2018-18625: Fixed XSS vulnerabilities in dashboard due to an incomplete fix for CVE-2018-12099

for openstack-nova:

• CVE-2020-17376: Fixed an issue in which live migration failed to update persistent domain XML (bsc#1175484)

for python-pillow:

• CVE-2016-0775: Fixed a buffer overflow in FliDecode.c (bsc#965582)
• CVE-2020-10177: Fix-OOB-reads-in-FLI-decoding (bsc#1173413)
• CVE-2020-10994: Fix-bounds-overflow-in-JPEG-2000-decoding (bsc#1173418)
• CVE-2020-10378: Fix-bounds-overflow-in-PCX-decoding (bsc#1173416)

for rubygem-crowbar-client:

• CVE-2018-17954: Fixed an issue where provision leaks admin password to all nodes in cleartext (bsc#1117080)

Non-security fixes included on this update:

Changes in ansible:

• Update CVE-2020-10744_avoid_mkdir_p.patch to include missing parts and rename to CVE-2020-1733_avoid_mkdir_p.patch to make it clear which CVE is fixed there (bsc#1164140)

• Add CVE-2020-10744_avoid_mkdir_p.patch (bsc#1171823) to fix insecure temporary directory creation.

Changes in crowbar-core:

• Update to version 4.0+git.1600767499.0615a418f:

  • provisioner: check for client_user (SOC-11389)
  • crowbar: Also add access to /restricted/ in SSL vhost (SOC-11352)
  • crowbar: Allow hardware-installing -> discovering transition (noref)
  • crowbar: Add Restricted controller with API for restricted clients (bsc#1117080)
  • crowbar: Add complete list of states to Crowbar::State (noref)
  • provisioner: Remove the need for /updates/parse_node_data (noref)
  • crowbar: Create helper module to validate states (noref)
  • provisioner: Use new restricted API (bsc#1117080)
  • provisioner: Do not read /etc/crowbar.install.key from crowbar_joi (bsc#1117080)
  • provisioner: Remove use of privileged user for Windows machine (bsc#1117080)
  • provisioner: Use restricted client during provisioning (bsc#1117080)
  • provisioner: Use restricted client for crowbar_register (bsc#1117080)
  • provisioner: Drop /etc/crowbar.install.key bits from autoyast prof (bsc#1117080)
  • Avoid hardcoding machine-install user (bsc#1117080)
  • crowbar: Restrict admin access (bsc#1117080)

• Update to version 4.0+git.1600416364.5a9286e31:

  • Whitelist fixed CVEs in travis (noref)
  • Disable cookbook tests (noref)

Changes in crowbar-openstack:

• Update to version 4.0+git.1599037255.25b759234:
  • horizon: Update configuration for Grafana 5.x

Changes in grafana:

• BuildRequire go1.14 explicitly
• Add recompress source service
• Add go_modules source service to create vendor.tar.gz containing 3rd party go modules.
• Adjust spec to work for Grafana-6.7.4
• Adjust Makefile to work for Grafana-6.7.4
• Remove CVE-2019-15043.patch (merged upstream)
• Remove CVE-2020-13379.patch (merged upstream)
• Remove 0001-CVE-2020-12052-bsc1170657-XSS-annotation-popup-vulnerability.patch (merged upstream)
• Update to version 6.7.4 (bsc#1172450, CVE-2018-18623, CVE-2018-18624, CVE-2018-18625, bsc#1174583, CVE-2020-11110)
  • Only allow 32 hexadecimal digits for the avatar hash
  • 6.7.3 cherry-picks (#23808)
  • Fix CI for pushing a multi-architecture manifest (#23327)
  • AzureMonitor: Fix Log Analytics and Application Insights for Azure China (#21803) (#22753)
  • Revert 'grafana/data:…

This update for ansible, ardana-ansible, ardana-cinder, ardana-glance, ardana-mq, ardana-nova, ardana-osconfig, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, grafana-natel-discrete-panel, openstack-cinder, openstack-monasca-installer, openstack-neutron, openstack-nova, python-Django, python-Flask-Cors, python-Pillow, python-ardana-packager, python-keystoneclient, python-keystonemiddleware, python-kombu, python-straight-plugin, python-urllib3, release-notes-suse-openstack-cloud, storm, storm-kit, venv-openstack-cinder, venv-openstack-swift contains the following fixes:

Security fixes included in this update: ansible to 2.9.14:

• CVE-2020-1733: Fixed insecure temporary directory when running become_user (bsc#1164140).
• CVE-2020-1753: Kubectl connection plugin - connection plugin now redact kubectl_token and kubectl_password in console log. (bsc#1166389)
• CVE-2020-14365: Previously, regardless of the disable_gpg_check option, packages were not GPG validated. They are now. (bsc#1175993)
• CVE-2020-14332: copy - Redact the value of the no_log 'content' parameter in the result's invocation.module_args in check mode. Previously when used with check mode and with '-vvv', the module would not censor the content if a change would be made to the destination path. (bsc#1174302)
• CVE-2020-1736: atomic_move - Change default permissions when creating temporary files so they are not world readable (bsc#1164134).
• CVE-2020-14330: Sanitize no_log values from any response keys that might be returned from the uri module (bsc#1174145).
• CVE-2019-14846: Reset logging level to INFO. (bsc#1153452).
• CVE-2020-10744: incomplete fix for CVE-2020-1733 (bsc#1171823).

grafana:

• CVE-2018-18623, CVE-2018-18624,CVE-2018-18625: Fixed multiple XSS vulnerabilities in dashboard due to a incomplete fix for CVE-2018-12099 (bsc#1172450).
• CVE-2020-11110: Fixed a stored XSS (bsc#1174583).

openstack-nova:

• CVE-2020-17376: Fixed an information leak during live migration (bsc#1175484).

python-Django to 1.11.29

• CVE-2020-7471: Fixed a SQL injection via StringAgg delimiter (bsc#1161919).
• CVE-2020-9402: Fixed a SQL injection via tolerance parameter in GIS functions and aggregates (bsc#1165022).
• CVE-2019-19844: Fixed a potential account hijack via password reset form (bsc#1159447).

python-Flask-Cors

• CVE-2020-25032: Fixed a potential information leak through path traversal (bsc#1175986).

python-Pillow

• CVE-2020-10177: Fixed multiple out-of-bounds reads in libImaging/FliDecode.c (bsc#1173413).
• CVE-2020-10994: Fixed multiple out-of-bounds reads via a crafted JP2 files (bsc#1173418).
• CVE-2020-10378: Fixed an out-of-bounds read when reading PCX files (bsc#1173416).

python-urllib3

• CVE-2020-26137: Fixed CRLF injection via HTTP request method (bsc#1177120)

storm:

• CVE-2018-11779: Fixed java deserialization vulnerability related to the usage of storm-kafka-client or storm-kafka modules (bsc#1143163).
• CVE-2019-0202: Fixed an information leak related to the log viewer (bsc#1142617).

rubygem-crowbar-client update to 3.9.3:

• CVE-2018-17954: Fixed information leak of the admin password to all nodes in cleartext during provisioning (bsc#1117080)

Non-security fixes included on this update:

Changes in ansible:

• Update to ansible 2.9.14:
  • minor bugs and fixes, including security bugs:
    • CVE-2020-1753, bsc#1166389: Kubectl connection plugin - connection plugin now redact kubectl_token and kubectl_password in console log.
    • revert CVE-2020-1736. Users are encouraged to specify a mode parameter in their file-based tasks when the files being manipulated contain sensitive data.
    • CVE-2020-14365, bsc#1175993: Previously, regardless of the disable_gpg_check option, packages were not GPG validated. They are now.
    • CVE-2020-14332, bsc#1174302: copy - Redact the value of the no_log 'content' parameter in the result's invocation.module_args in …

This update fixes the following issues:

POS_Image-Graphical7 was updated to version 0.1.1710765237.46af599:

• Version 0.1.1710765237.46af599

  • Moved image services to dracut-saltboot package
  • Use salt bundle

• Version 0.1.1645440615.7f1328c

  • Removed deprecated kiwi functions

POS_Image-JeOS7 was updated to version 0.1.1710765237.46af599:

• Version 0.1.1710765237.46af599

  • Moved image services to dracut-saltboot package
  • Use salt bundle

• Version 0.1.1645440615.7f1328c

  • Removed deprecated kiwi functions

ansible received the following fixes:

• Security issues fixed:

  • CVE-2023-5764: Address issues where internal templating can cause unsafe variables to lose their unsafe designation (bsc#1216854)

    • Breaking changes: assert - Nested templating may result in an inability for the conditional to be evaluated. See the porting guide for more information.

  • CVE-2024-0690: Address issue where ANSIBLE_NO_LOG was ignored (bsc#1219002)

  • CVE-2020-14365: Ensure that packages are GPG validated (bsc#1175993)

  • CVE-2020-10744: Fixed insecure temporary directory creation (bsc#1171823)

  • CVE-2018-10874: Fixed inventory variables loading from current working directory when running ad-hoc command that can lead to code execution (bsc#1099805)

• Bugs fixed:

  • Don't Require python-coverage, it is needed only for testing (bsc#1177948)

dracut-saltboot was updated to version 0.1.1710765237.46af599:

• Version 0.1.1710765237.46af599

  • Load only first available leaseinfo (bsc#1221092)

• Version 0.1.1681904360.84ef141

grafana was updated to version 9.5.18:

• Grafana now requires Go 1.20

• Security issues fixed:

  • CVE-2024-1313: Require same organisation when deleting snapshots (bsc#1222155)
  • CVE-2023-6152: Add email verification when updating user email (bsc#1219912)

• Other non-security related changes:

  • Version 9.5.17:

    • [FEATURE] Alerting: Backport use Alertmanager API v2

  • Version 9.5.16:

    • [BUGFIX] Annotations: Split cleanup into separate queries and deletes to avoid deadlocks on MySQL

  • Version 9.5.15:

    • [FEATURE] Alerting: Attempt to retry retryable errors

  • Version 9.5.14:

    • [BUGFIX] Alerting: Fix state manager to not keep datasource_uid and ref_id labels in state after Error
    • [BUGFIX] Transformations: Config overrides being lost when config from query transform is applied
    • [BUGFIX] LDAP: Fix enable users on successfull login

  • Version 9.5.13:

    • [BUGFIX] BrowseDashboards: Only remember the most recent expanded folder
    • [BUGFIX] Licensing: Pass func to update env variables when starting plugin

  • Version 9.5.12:

    • [FEATURE] Azure: Add support for Workload Identity authentication

  • Version 9.5.9:

    • [FEATURE] SSE: Fix DSNode to not panic when response has empty response
    • [FEATURE] Prometheus: Handle the response with different field key order
    • [BUGFIX] LDAP: Fix user disabling

mgr-daemon was updated to version 4.3.9-0:

• Version 4.3.9-0

  • Update translation strings

spacecmd was updated to version 4.3.27-0:

• Version 4.3.27-0

  • Update translation strings

spacewalk-client-tools was updated to version 4.3.19-0:

• Version 4.3.19-0

  • Update translation strings

spacewalk-koan was updated to version version 4.3.6-0:

• Version 4.3.6-0

  • Change Docker image location for test

uyuni-common-libs was updated to version 4.3.10-0:

• Version 4.3.10-0

  • Add support for package signature type V4 RSA/SHA384
  • Add support for package signature type V4 RSA/SHA512 (bsc#1221465)

uyuni-proxy-systemd-services was updated to version 4.3.12-0:

• Version 4.3.12-0

  • Update to SUSE Manager 4.3.12

It was discovered that Ansible did not properly manage directory permissions when running playbooks with an unprivileged become user. A local attacker could possibly use this issue to cause a race condition, escalate privileges and execute arbitrary code. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-1733)

It was discovered that the fix to address CVE-2020-1733 in Ansible was incomplete on systems using ACLs and FUSE filesystems. A local attacker could possibly use this issue to cause a race condition, escalate privileges and execute arbitrary code. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-10744)

It was discovered that Ansible did not properly manage multi-line YAML strings and special template characters. A local attacker could possibly use this issue to cause a template injection, resulting in the disclosure of sensitive information or other unspecified impact. (CVE-2021-3583)

It was discovered that the ansible-connection module in Ansible did not properly manage certain error messages. A local attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 20.04 ESM and Ubuntu 22.04 ESM. (CVE-2021-3620)