{"id":"CVE-2019-16865","aliases":["DEBIAN-CVE-2019-16865","EUVD-2019-0102","GHSA-j7mj-748x-7p78","MGASA-2020-0088","PYSEC-2019-110","RHSA-2020:0566","RHSA-2020:0578","RHSA-2020:0580","SUSE-RU-2020:2072-1","SUSE-RU-2020:2161-1","SUSE-SU-2020:1901-1","SUSE-SU-2020:2057-1","UBUNTU-CVE-2019-16865","USN-4272-1"],"status":"published","title":"DOS attack in Pillow when processing specially crafted image files","description":"An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.03128,"percentile":0.87941,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2019-10-04T21:09:23Z","modified":"2026-10-24T10:30:24Z","fixes":[{"ecosystem":"PyPI","package":"pillow","fixed_in":["6.2.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"pillow","fixed_in":["6.2.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"pillow","fixed_in":["6.2.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pillow","fixed_in":["6.2.0-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"pillow","fixed_in":["2.3.0-1ubuntu3.4+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"pillow","fixed_in":["3.1.2-0ubuntu1.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"pillow","fixed_in":["5.1.0-1ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0"}]}],"versions":["1.0","1.1","1.2","1.3","1.4","1.5","1.6","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","2.0.0","2.1.0","2.2.0","2.2.1","2.2.2","2.3.0","2.3.1","2.3.2","2.4.0","2.5.0","2.5.1","2.5.2","2.5.3","2.6.0","2.6.1","2.6.2","2.7.0","2.8.0","2.8.1","2.8.2","2.9.0","3.0.0","3.1.0","3.1.0.rc1","3.1.0rc1","3.1.1","3.1.2","3.2.0","3.3.0","3.3.1","3.3.2","3.3.3","3.4.0","3.4.1","3.4.2","4.0.0","4.1.0","4.1.1","4.2.0","4.2.1","4.3.0","5.0.0","5.1.0","5.2.0","5.3.0","5.4.0","5.4.0.dev0","5.4.1","6.0.0","6.1.0"]},{"source":"osv","ecosystem":"Mageia:7","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.1-1.1.mga7"}]}],"bundled":6},{"source":"osv","ecosystem":"PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0"}]}],"versions":["1.0","1.1","1.2","1.3","1.4","1.5","1.6","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","2.0.0","2.1.0","2.2.0","2.2.1","2.2.2","2.3.0","2.3.1","2.3.2","2.4.0","2.5.0","2.5.1","2.5.2","2.5.3","2.6.0","2.6.1","2.6.2","2.7.0","2.8.0","2.8.1","2.8.2","2.9.0","3.0.0","3.1.0rc1","3.1.0.rc1","3.1.0","3.1.1","3.1.2","3.2.0","3.3.0","3.3.1","3.3.2","3.3.3","3.4.0","3.4.1","3.4.2","4.0.0","4.1.0","4.1.1","4.2.0","4.2.1","4.3.0","5.0.0","5.1.0","5.2.0","5.3.0","5.4.0.dev0","5.4.0","5.4.1","6.0.0","6.1.0"]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-10.el8_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"python-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-10.el8_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-10.el8_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"python3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-10.el8_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"python3-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-10.el8_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"python3-pillow-tk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-10.el8_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-20.gitd1c6db8.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-20.gitd1c6db8.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-pillow-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-20.gitd1c6db8.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-pillow-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-20.gitd1c6db8.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-pillow-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-20.gitd1c6db8.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-pillow-sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-20.gitd1c6db8.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-pillow-tk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-20.gitd1c6db8.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-20.gitd1c6db8.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-20.gitd1c6db8.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python-pillow-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-20.gitd1c6db8.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python-pillow-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-20.gitd1c6db8.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python-pillow-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-20.gitd1c6db8.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python-pillow-sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-20.gitd1c6db8.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python-pillow-tk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-20.gitd1c6db8.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-20.gitd1c6db8.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-20.gitd1c6db8.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-pillow-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-20.gitd1c6db8.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-pillow-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-20.gitd1c6db8.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-pillow-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-20.gitd1c6db8.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-pillow-sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-20.gitd1c6db8.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-pillow-tk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-20.gitd1c6db8.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-20.gitd1c6db8.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-20.gitd1c6db8.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-pillow-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-20.gitd1c6db8.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-pillow-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-20.gitd1c6db8.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-pillow-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-20.gitd1c6db8.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-pillow-sane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-20.gitd1c6db8.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-pillow-tk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-20.gitd1c6db8.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-10.el8_1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-10.el8_1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-10.el8_1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-10.el8_1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-10.el8_1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-pillow-tk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-10.el8_1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3.0-12.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"crowbar-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0+git.1580209654.1d112d31f-9.66.5"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"crowbar-ha","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0+git.1585316203.d6ad2c8-4.52.4"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"crowbar-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0+git.1589804581.9972163f0-9.71.4"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.5-1.14.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"keepalived","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.19-1.8.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"kibana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.3-5.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.17-3.6.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"monasca-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20180608_12.47-12.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openstack-dashboard-theme-SUSE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.2-5.12.4"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openstack-manila","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1~dev30-4.12.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openstack-manila-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1~dev30-4.12.3"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openstack-neutron-fwaas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2~dev5-4.9.3"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openstack-neutron-fwaas-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2~dev5-4.9.4"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.11~dev13-4.40.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openstack-nova-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.11~dev13-4.40.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openstack-tempest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.1~a0~dev177-4.9.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.19-3.23.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.1-4.12.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-psql2mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0+git.1589351878.4ef877c-1.12.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-psutil","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-21.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-11.12.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-pysaml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-3.17.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-3.3.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-3.16.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"release-notes-suse-openstack-cloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.20180803-3.18.3"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"rubygem-activeresource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-3.3.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"rubygem-crowbar-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.2-7.20.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"rubygem-json-1_7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.7-3.3.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"rubygem-puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.0-4.6.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.10-6.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ansible1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.6-9.7.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1591138508.e269bdb-3.22.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1588181228.bae3b1f-3.13.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1593631708.9354a78-3.13.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-input-model","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1589740948.c24fc0b-3.19.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-logging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1591193994.d93b668-3.13.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-manila","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1594158642.b5905e4-3.12.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1589385256.7fbfaaf-3.19.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-mq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1593618110.cbd1a37-3.16.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1590756257.e09d54f-3.22.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1590079609.a2ae6ab-3.19.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-tempest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1593033709.9495bb2-3.16.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.5-3.12.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"kibana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.3-4.3.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.1~dev24-3.9.5"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-ceilometer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.1~dev7-3.16.3"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.10~dev12-3.22.4"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.1.1~dev6-3.15.5"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.2~dev2-3.19.3"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-heat-templates","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0+git.1582270132.8a20477-3.6.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.5~dev6-3.19.3"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1~dev4-3.22.3"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-magnum","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.1~dev1-3.13.3"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-manila","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.2~dev31-4.24.3"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-monasca-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2~dev5-3.9.3"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev68-3.25.3"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-neutron-vsphere","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1~dev167-3.3.3"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.3.1~dev38-3.25.4"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3~dev7-3.25.3"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-octavia-amphora-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.4-7.12.3"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-resource-agents","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0+git.1569436425.8b9c49f-5.3.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Django1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.29-3.15.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-3.3.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-ardana-packager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.3-9.3.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-heatclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-3.3.3"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-neutron-tempest-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.0-3.3.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-octavia-tempest-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.0-3.3.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-os-brick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.10-3.12.3"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-oslo.messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.4-3.6.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-pyroute2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-4.3.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23-3.12.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-3.3.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"release-notes-suse-openstack-cloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20200610-3.21.4"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.1~dev24-3.19.3"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.10~dev12-3.19.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.2~dev2-3.19.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.1~dev30-3.17.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.3~dev35-3.19.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.1.1~dev6-4.18.3"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.5~dev6-4.15.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1~dev4-3.19.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-magnum","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.1~dev1-4.19.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-manila","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.2~dev31-3.21.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1~dev10-3.17.3"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-monasca-ceilometer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2~dev3-3.19.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev68-6.19.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.3.1~dev38-3.19.3"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3~dev7-4.19.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-sahara","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2~dev15-3.19.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.2~dev48-2.14.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"crowbar-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0+git.1594619891.b75a61d0d-3.25.5"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"crowbar-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0+git.1591795073.49cb6400e-3.25.3"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.5-3.12.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"kibana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.3-4.3.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.1~dev24-3.9.5"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-ceilometer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.1~dev7-3.16.3"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.10~dev12-3.22.4"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.1.1~dev6-3.15.5"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.2~dev2-3.19.3"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-heat-templates","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0+git.1582270132.8a20477-3.6.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.5~dev6-3.19.3"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1~dev4-3.22.3"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-magnum","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.1~dev1-3.13.3"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-manila","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.2~dev31-4.24.3"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-monasca-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2~dev5-3.9.3"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev68-3.25.3"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-neutron-vsphere","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1~dev167-3.3.3"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.3.1~dev38-3.25.4"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3~dev7-3.25.3"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-octavia-amphora-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.4-7.12.3"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-resource-agents","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0+git.1569436425.8b9c49f-5.3.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Django1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.29-3.15.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-3.3.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-heatclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-3.3.3"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-neutron-tempest-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.0-3.3.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-octavia-tempest-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.0-3.3.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-os-brick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.10-3.12.3"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-oslo.messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.4-3.6.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-pyroute2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-4.3.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23-3.12.2"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-3.3.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"release-notes-suse-openstack-cloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20200610-3.21.4"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"rubygem-activeresource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-4.3.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"rubygem-json-1_7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.7-4.3.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"rubygem-puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.0-4.9.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6.0-3.9.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"ansible1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.6-7.3.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"ardana-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1589740980.6c3bcdc-3.73.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"ardana-cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1585685203.3e71e49-3.36.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"ardana-freezer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1586539529.b7d295f-3.21.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"ardana-input-model","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1589740934.0e0ad61-3.39.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"ardana-logging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1591194866.b7375d0-3.24.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"ardana-mq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1589715269.62ad6df-3.22.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"ardana-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1590756744.ba84abc-3.42.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"ardana-octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1590100427.cf4cc8f-3.29.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"ardana-osconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1587034587.eac37b8-3.45.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"caasp-openstack-heat-templates","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0+git.1560518045.ad7dc6d-4.18.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"documentation-hpe-helion-openstack-installation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20200527-1.26.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"documentation-hpe-helion-openstack-operations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20200527-1.26.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"documentation-hpe-helion-openstack-opsconsole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20200527-1.26.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"documentation-hpe-helion-openstack-planning","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20200527-1.26.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"documentation-hpe-helion-openstack-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20200527-1.26.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"documentation-hpe-helion-openstack-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20200527-1.26.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.5-4.9.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"kibana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.3-3.3.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.5~dev3-3.26.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-dashboard-theme-HPE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8+git.1523473653.6599ec8-3.3.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-heat-templates","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0+git.1582270132.8a20477-3.15.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.4~dev11-5.33.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-keystone-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.4~dev11-5.33.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-monasca-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.6~dev4-3.18.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-monasca-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20190923_16.32-3.12.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.9~dev65-3.33.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-neutron-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.9~dev65-3.33.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-octavia-amphora-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.4-3.12.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-3.15.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-Flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.1-3.3.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.8-3.3.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-3.5.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-amqp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-3.12.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-apicapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-3.6.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-keystoneauth1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2~dev2-3.3.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-oslo.messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.30.8-3.11.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-psutil","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-3.3.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-pyroute2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.21-3.3.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-pysaml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-5.6.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-tooz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.58.1-3.3.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-3.3.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"storm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-3.3.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-aodh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1~dev7-12.26.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2~dev3-12.27.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-ceilometer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.8~dev7-12.24.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.3~dev23-14.27.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.3~dev7-12.25.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-freezer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0.0~xrc2~dev2-10.22.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.0.3~dev3-12.25.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.8~dev22-12.27.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-horizon-hpe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.5~dev3-14.30.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.8~dev8-12.27.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.4~dev11-11.28.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-magnum","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2_5.0.2_5.0.2~dev31-11.26.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-manila","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1~dev5-12.31.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2~dev1-11.22.3"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-monasca-ceilometer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1_1.5.1_1.5.1~dev3-8.22.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-murano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2~dev2-12.22.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.9~dev65-13.30.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1.9~dev61-11.28.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6~dev3-12.27.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-sahara","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.5~dev4-11.26.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.2_2.15.2_2.15.2~dev32-11.18.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-trove","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.2~dev2-11.26.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6.0-3.9.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"ansible1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.6-7.3.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"ardana-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1589740980.6c3bcdc-3.73.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"ardana-cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1585685203.3e71e49-3.36.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"ardana-freezer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1586539529.b7d295f-3.21.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"ardana-input-model","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1589740934.0e0ad61-3.39.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"ardana-logging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1591194866.b7375d0-3.24.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"ardana-mq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1589715269.62ad6df-3.22.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"ardana-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1590756744.ba84abc-3.42.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"ardana-octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1590100427.cf4cc8f-3.29.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"ardana-osconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1587034587.eac37b8-3.45.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"caasp-openstack-heat-templates","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0+git.1560518045.ad7dc6d-4.18.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-installation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20200527-1.26.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-operations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20200527-1.26.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-opsconsole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20200527-1.26.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-planning","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20200527-1.26.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20200527-1.26.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-supplement","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20200527-1.26.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-upstream-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20200527-1.26.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-upstream-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20200527-1.26.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20200527-1.26.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.5-4.9.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"kibana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.3-3.3.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.5~dev3-3.26.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-heat-templates","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0+git.1582270132.8a20477-3.15.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.4~dev11-5.33.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-keystone-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.4~dev11-5.33.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-monasca-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.6~dev4-3.18.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-monasca-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20190923_16.32-3.12.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.9~dev65-3.33.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-neutron-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.9~dev65-3.33.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-octavia-amphora-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.4-3.12.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-3.15.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-Flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.1-3.3.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-GitPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.8-3.3.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-3.5.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-amqp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-3.12.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-apicapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-3.6.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-keystoneauth1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2~dev2-3.3.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-oslo.messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.30.8-3.11.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-psutil","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-3.3.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-pyroute2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.21-3.3.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-pysaml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-5.6.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-tooz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.58.1-3.3.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-3.3.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"storm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-3.3.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-aodh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1~dev7-12.26.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2~dev3-12.27.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-ceilometer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.8~dev7-12.24.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.3~dev23-14.27.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.3~dev7-12.25.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-freezer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0.0~xrc2~dev2-10.22.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.0.3~dev3-12.25.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.8~dev22-12.27.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.5~dev3-14.30.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.8~dev8-12.27.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.4~dev11-11.28.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-magnum","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2_5.0.2_5.0.2~dev31-11.26.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-manila","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1~dev5-12.31.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2~dev1-11.22.3"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-monasca-ceilometer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1_1.5.1_1.5.1~dev3-8.22.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-murano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2~dev2-12.22.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.9~dev65-13.30.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1.9~dev61-11.28.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6~dev3-12.27.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-sahara","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.5~dev4-11.26.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.2_2.15.2_2.15.2~dev32-11.18.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-trove","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.2~dev2-11.26.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6.0-3.9.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"caasp-openstack-heat-templates","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0+git.1560518045.ad7dc6d-4.18.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"crowbar-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0+git.1593156248.55bbdb26d-3.41.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"crowbar-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0+git.1593085772.64c4ab43c-4.40.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"documentation-suse-openstack-cloud-deployment","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20200527-1.26.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"documentation-suse-openstack-cloud-supplement","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20200527-1.26.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"documentation-suse-openstack-cloud-upstream-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20200527-1.26.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"documentation-suse-openstack-cloud-upstream-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20200527-1.26.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.5-4.9.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"kibana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.3-3.3.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.5~dev3-3.26.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-heat-templates","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0+git.1582270132.8a20477-3.15.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.4~dev11-5.33.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-keystone-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.4~dev11-5.33.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-monasca-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.6~dev4-3.18.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-monasca-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20190923_16.32-3.12.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.9~dev65-3.33.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-neutron-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.9~dev65-3.33.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-octavia-amphora-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.4-3.12.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-3.15.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-Flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.1-3.3.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-3.5.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-amqp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-3.12.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-apicapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-3.6.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-keystoneauth1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2~dev2-3.3.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-oslo.messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.30.8-3.11.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-psutil","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-3.3.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-pyroute2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.21-3.3.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-pysaml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-5.6.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-tooz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.58.1-3.3.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-waitress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-3.3.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"rubygem-activeresource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-3.3.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"rubygem-crowbar-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.2-3.12.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"rubygem-json-1_7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.7-3.3.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"rubygem-puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.0-3.9.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"storm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-3.3.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.1-3.9.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-1ubuntu3.4+esm1"}]}],"versions":["2.2.1-1ubuntu2","2.2.1-2ubuntu1","2.2.1-3ubuntu2","2.2.1-3ubuntu3","2.2.1-3ubuntu4","2.2.1-3ubuntu6","2.3.0-1ubuntu1","2.3.0-1ubuntu2","2.3.0-1ubuntu3","2.3.0-1ubuntu3.2","2.3.0-1ubuntu3.3","2.3.0-1ubuntu3.4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-0ubuntu1.3"}]}],"versions":["2.9.0-1","3.0.0-1","3.0.0-1build1","3.1.0-1","3.1.1-1","3.1.2-0ubuntu1","3.1.2-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-1ubuntu0.2"}]}],"versions":["4.1.1-3build2","4.3.0-2ubuntu1","5.0.0-1","5.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-1ubuntu3.4+esm1"}]}],"versions":["2.2.1-1ubuntu2","2.2.1-2ubuntu1","2.2.1-3ubuntu2","2.2.1-3ubuntu3","2.2.1-3ubuntu4","2.2.1-3ubuntu6","2.3.0-1ubuntu1","2.3.0-1ubuntu2","2.3.0-1ubuntu3","2.3.0-1ubuntu3.2","2.3.0-1ubuntu3.3","2.3.0-1ubuntu3.4"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-0ubuntu1.3"}]}],"versions":["2.9.0-1","3.0.0-1","3.0.0-1build1","3.1.0-1","3.1.1-1","3.1.2-0ubuntu1","3.1.2-0ubuntu1.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-1ubuntu0.2"}]}],"versions":["4.1.1-3build2","4.3.0-2ubuntu1","5.0.0-1","5.1.0-1"],"bundled":5}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"python","product":"pillow"}],"references":[{"url":"https://pillow.readthedocs.io/en/latest/releasenotes/6.2.0.html","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","advisory","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYDXD7EE4YAEVSTNIFZKNVPRVJX5ZOG3/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EMJBUZQGQ2Q7HXYCQVRLU7OXNC7CAWWU/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://usn.ubuntu.com/4272-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0566","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://www.debian.org/security/2020/dsa-4631","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0580","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0578","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0681","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0683","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0694","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16865","tags":["advisory"]},{"url":"https://github.com/python-pillow/Pillow/issues/4123","tags":["web"]},{"url":"https://github.com/python-pillow/Pillow/commit/ab52630d0644e42a75eb88b78b9a9d7438a6fbeb","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EMJBUZQGQ2Q7HXYCQVRLU7OXNC7CAWWU","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYDXD7EE4YAEVSTNIFZKNVPRVJX5ZOG3","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-4272-1","tags":["web","advisory"]},{"url":"https://usn.ubuntu.com/4272-1","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2019-110.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-j7mj-748x-7p78","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-16865","tags":["advisory"]},{"url":"https://github.com/python-pillow/Pillow","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2020-0088.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25968","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYDXD7EE4YAEVSTNIFZKNVPRVJX5ZOG3/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EMJBUZQGQ2Q7HXYCQVRLU7OXNC7CAWWU/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1774066","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1789533","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1789535","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0566.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-16865","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-16865","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-5311","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-5311","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5311","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-5312","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-5312","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5312","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0578.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0580.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/-2020-2072/suse-ru-20202072-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1037777","tags":["report"]},{"url":"https://bugzilla.suse.com/1068612","tags":["report"]},{"url":"https://bugzilla.suse.com/1069468","tags":["report"]},{"url":"https://bugzilla.suse.com/1070737","tags":["report"]},{"url":"https://bugzilla.suse.com/1077718","tags":["report"]},{"url":"https://bugzilla.suse.com/1083903","tags":["report"]},{"url":"https://bugzilla.suse.com/1111657","tags":["report"]},{"url":"https://bugzilla.suse.com/1126503","tags":["report"]},{"url":"https://bugzilla.suse.com/1133817","tags":["report"]},{"url":"https://bugzilla.suse.com/1135773","tags":["report"]},{"url":"https://bugzilla.suse.com/1138748","tags":["report"]},{"url":"https://bugzilla.suse.com/1148383","tags":["report"]},{"url":"https://bugzilla.suse.com/1149110","tags":["report"]},{"url":"https://bugzilla.suse.com/1149535","tags":["report"]},{"url":"https://bugzilla.suse.com/1153191","tags":["report"]},{"url":"https://bugzilla.suse.com/1156525","tags":["report"]},{"url":"https://bugzilla.suse.com/1159447","tags":["report"]},{"url":"https://bugzilla.suse.com/1160152","tags":["report"]},{"url":"https://bugzilla.suse.com/1160153","tags":["report"]},{"url":"https://bugzilla.suse.com/1160192","tags":["report"]},{"url":"https://bugzilla.suse.com/1160790","tags":["report"]},{"url":"https://bugzilla.suse.com/1160851","tags":["report"]},{"url":"https://bugzilla.suse.com/1161088","tags":["report"]},{"url":"https://bugzilla.suse.com/1161089","tags":["report"]},{"url":"https://bugzilla.suse.com/1161349","tags":["report"]},{"url":"https://bugzilla.suse.com/1161670","tags":["report"]},{"url":"https://bugzilla.suse.com/1164316","tags":["report"]},{"url":"https://bugzilla.suse.com/1165402","tags":["report"]},{"url":"https://bugzilla.suse.com/1167244","tags":["report"]},{"url":"https://bugzilla.suse.com/1170657","tags":["report"]},{"url":"https://bugzilla.suse.com/1171560","tags":["report"]},{"url":"https://bugzilla.suse.com/1171909","tags":["report"]},{"url":"https://bugzilla.suse.com/1172166","tags":["report"]},{"url":"https://bugzilla.suse.com/1172167","tags":["report"]},{"url":"https://bugzilla.suse.com/1172175","tags":["report"]},{"url":"https://bugzilla.suse.com/1172176","tags":["report"]},{"url":"https://bugzilla.suse.com/1172409","tags":["report"]},{"url":"https://bugzilla.suse.com/948198","tags":["report"]},{"url":"https://bugzilla.suse.com/981848","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-4965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-4967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-0201","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-5247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-5312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-5313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-5390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8151","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/-2020-2161/suse-ru-20202161-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1019111","tags":["report"]},{"url":"https://bugzilla.suse.com/1107190","tags":["report"]},{"url":"https://bugzilla.suse.com/1136928","tags":["report"]},{"url":"https://bugzilla.suse.com/1159046","tags":["report"]},{"url":"https://bugzilla.suse.com/1160151","tags":["report"]},{"url":"https://bugzilla.suse.com/1161919","tags":["report"]},{"url":"https://bugzilla.suse.com/1163446","tags":["report"]},{"url":"https://bugzilla.suse.com/1165022","tags":["report"]},{"url":"https://bugzilla.suse.com/1171070","tags":["report"]},{"url":"https://bugzilla.suse.com/1171071","tags":["report"]},{"url":"https://bugzilla.suse.com/1171072","tags":["report"]},{"url":"https://bugzilla.suse.com/1171273","tags":["report"]},{"url":"https://bugzilla.suse.com/1171594","tags":["report"]},{"url":"https://bugzilla.suse.com/1172522","tags":["report"]},{"url":"https://bugzilla.suse.com/1173413","tags":["report"]},{"url":"https://bugzilla.suse.com/1173416","tags":["report"]},{"url":"https://bugzilla.suse.com/1173418","tags":["report"]},{"url":"https://bugzilla.suse.com/1173420","tags":["report"]},{"url":"https://bugzilla.suse.com/1174006","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10994","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-5311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9402","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201901-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1092420","tags":["report"]},{"url":"https://bugzilla.suse.com/1108719","tags":["report"]},{"url":"https://bugzilla.suse.com/1123872","tags":["report"]},{"url":"https://bugzilla.suse.com/1141968","tags":["report"]},{"url":"https://bugzilla.suse.com/11483483","tags":["report"]},{"url":"https://bugzilla.suse.com/1164322","tags":["report"]},{"url":"https://bugzilla.suse.com/1168593","tags":["report"]},{"url":"https://bugzilla.suse.com/1169770","tags":["report"]},{"url":"https://bugzilla.suse.com/1171661","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1010083","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202057-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/965582","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0775","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-16865","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-19911","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-5310","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-5311","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-5312","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-5313","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-16865","description":"An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.","status":"published","published":"2019-10-04T21:09:23Z","modified":"2024-08-05T01:24:48.558Z","updated_at":"2026-11-02T14:32:23.189113Z"}],"euvd":[{"id":"EUVD-2019-0102","description":"An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.","status":"published","published":"2019-10-04T21:09:23Z","modified":"2024-08-05T01:24:48Z","updated_at":"2026-11-03T02:40:31.903592Z"}],"ghsa":[{"id":"GHSA-j7mj-748x-7p78","title":"DOS attack in Pillow when processing specially crafted image files","description":"An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.","status":"published","published":"2019-10-22T14:40:42Z","modified":"2024-10-09T21:07:20Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:38:09.785133Z"}],"nvd":[{"id":"CVE-2019-16865","description":"An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.","status":"published","published":"2019-10-04T22:15:11.19Z","modified":"2026-06-17T02:22:50.877Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:05:31.019577Z"}],"osv":[{"id":"CVE-2019-16865","description":"An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.","status":"published","published":"2019-10-04T22:15:11.19Z","modified":"2026-10-24T10:30:24.796284145Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"DEBIAN-CVE-2019-16865","description":"An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.","status":"published","published":"2019-10-04T22:15:11.19Z","modified":"2026-09-21T07:02:49.130631786Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"GHSA-j7mj-748x-7p78","title":"DOS attack in Pillow when processing specially crafted image files","description":"An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.","status":"published","published":"2019-10-22T14:40:42Z","modified":"2024-10-09T21:24:53.635612Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:49.977351Z"},{"id":"RHSA-2020:0566","title":"Red Hat Security Advisory: python-pillow security update","status":"published","published":"2024-09-14T00:40:13Z","modified":"2026-06-29T10:28:51Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0578","title":"Red Hat Security Advisory: python-pillow security update","status":"published","published":"2024-09-14T00:40:28Z","modified":"2026-06-29T10:28:52Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0580","title":"Red Hat Security Advisory: python-pillow security update","status":"published","published":"2024-09-14T00:40:20Z","modified":"2026-06-29T10:28:53Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"UBUNTU-CVE-2019-16865","description":"An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.","status":"published","published":"2019-10-04T22:15:00Z","modified":"2026-02-04T02:21:00.231906Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"MGASA-2020-0088","title":"Updated python-pillow packages fix security vulnerabilities","description":"Updated python-pillow packages fix security vulnerabilities:\n\nIt was discovered that Pillow incorrectly handled certain images. An attacker\ncould possibly use this issue to cause a denial of service (CVE-2019-16865,\nCVE-2019-19911).\n\nIt was discovered that Pillow incorrectly handled certain TIFF images. An\nattacker could possibly use this issue to cause a crash (CVE-2020-5310).\n\nIt was discovered that Pillow incorrectly handled certain SGI images. An\nattacker could possibly use this issue to execute arbitrary code or cause\na crash (CVE-2020-5311).\n\nIt was discovered that Pillow incorrectly handled certain PCX images. An\nattacker could possibly use this issue to execute arbitrary code or cause\na crash (CVE-2020-5312).\n\nIt was discovered that Pillow incorrectly handled certain Flip images. An\nattacker could possibly use this issue to execute arbitrary code or cause\na crash (CVE-2020-5313).\n","status":"published","published":"2020-02-18T14:05:53Z","modified":"2026-04-16T04:41:39.50697396Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"PYSEC-2019-110","description":"An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.","status":"published","published":"2019-10-04T22:15:00Z","modified":"2023-11-08T04:01:21.95278Z","updated_at":"2026-11-02T15:52:52.192131Z"},{"id":"SUSE-RU-2020:2072-1","title":"Security update for ansible, crowbar-core, crowbar-ha, crowbar-openstack, etcd, flannel, grafana, keepalived, kibana, memcached, monasca-installer, openstack-dashboard-theme-SUSE, openstack-manila, openstack-neutron-fwaas, openstack-nova, openstack-tempest, python-Django, python-Pillow, python-psql2mysql, python-psutil, python-py, python-pysaml2, python-waitress, rabbitmq-server, release-notes-suse-openstack-cloud, zookeeper","description":"This update for ansible, crowbar-core, crowbar-ha, crowbar-openstack, etcd, flannel, grafana, keepalived, kibana, memcached, monasca-installer, openstack-dashboard-theme-SUSE, openstack-manila, openstack-neutron-fwaas, openstack-nova, openstack-tempest, python-Django, python-Pillow, python-psql2mysql, python-psutil, python-py, python-pysaml2, python-waitress, rabbitmq-server, release-notes-suse-openstack-cloud, zookeeper fixes the following issues:\n\nSecurity fixes included ins this update:\n\nansible\n- CVE-2019-3828: Fixed a path traversal in the fetch module (bsc#1126503).\n\ngrafana\n- CVE-2020-13379: Fixed an incorrect access control issue which could\nlead to information leaks or denial of service (bsc#1172409).\n- CVE-2020-12052: Fixed an cross site scripting vulnerability related to\nthe annotation popup (bsc#1170657).\n\nkibana\n- CVE-2020-10743: Fixed a clickjacking vulnerability (bsc#1171909).\n\nmemcached (to version 1.5.17)\n- CVE-2019-15026: Fixed a stack-based buffer over-read\nin conn_to_str()n (bsc#1149110).\n- CVE-2019-11596: Fixed a denial of service in the 'lru' command\n(bsc#1133817)\n- CVE-2018-1000115: Disabled UDP by default to reduce DDoS amplification\nattacks (bsc#1083903).\n\npython-Django\n- CVE-2020-13254: Fixed a data leakage via malformed memcached keys\n(bsc#1172167).\n- CVE-2020-13596: Fixed a cross site scripting vulnerability related to\nthe admin parameters of the ForeignKeyRawIdWidget (bsc#1172166).\n- Fixed a regression with the fix for CVE-2019-3498 (bsc#1161349).\n\npython-Pillow\n- CVE-2019-16865: Fixed a denial of service with specially crafted\nimage files (bsc#1153191).\n- CVE-2020-5312: Fixed a buffer overflow in the PCX P mode (bsc#1160152).\n- CVE-2020-5313: Fixed a buffer overflow related to FLI (bsc#1160153).\n- CVE-2019-19911: Fixed a denial of service in FpxImagePlugin.py\n(bsc#1160192).\n\npython-pysaml2\n- CVE-2020-5390: Fixed an issue with the verification of signatures in\nSAML documents (bsc#1160851)\n- CVE-2017-1000246: Fixed an issue with  weak encryption data, caused by\ninitialization vector reuse(bsc#1068612).\n\npython-waitress (to version 1.4.3)\n- CVE-2019-16785: Fixed HTTP request smuggling through LF vs CRLF\nhandling (bsc#1161088).\n- CVE-2019-16786: Fixed HTTP request smuggling through invalid\nTransfer-Encoding (bsc#1161089).\n- CVE-2019-16789: Fixed HTTP Request Smuggling through invalid\nwhitespace characters (bsc#1160790).\n- CVE-2019-16792: Fixed HTTP Request Smuggling through Content-Length\nheader handling (bsc#1161670).\n\nrubygem-activeresource\n- CVE-2020-8151: Fixed information disclosure issue through specially\ncrafted requests (bsc#1171560)\n\nrubygem-json-1_7\n- CVE-2020-10663: Fixed Unsafe Object Creation Vulnerability in JSON\n(bsc#1167244)\n\nrubygem-puma\n- CVE-2020-11077: Fixed HTTP Request Smuggling through proxy (bsc#1172175)\n- CVE-2020-11076: Fixed HTTP Request smuggling through invalid\nTransfer-Encoding header.\n- CVE-2020-5247: Fixed HTTP Response Splitting through newline characters\nhandling (bsc#1165402)\n\nzookeeper:\n- CVE-2019-0201: Fixed an information disclosure related to\ngetACL() (bsc#1135773).\n\nNon security fixes included in this update:\n\nChanges in ansible:\n- Add 0001-Disallow-use-of-remote-home-directories-containing-..patch\n  (bsc#1126503, CVE-2019-3828)\n\nChanges in crowbar-core:\n- Update to version 4.0+git.1580209654.1d112d31f:\n  * network: start OVS before wickedd (SOC-11067)\n\nChanges in crowbar-ha:\n- Update to version 4.0+git.1585316203.d6ad2c8:\n  * [4.0] add ssl termination on haproxy (bsc#1149535)\n\nChanges in crowbar-openstack:\n- Update to version 4.0+git.1589804581.9972163f0:\n  * [4.0] magnum: fix check for image/flavor (SOC-11251)\n\n- Update to version 4.0+git.1589647351.ccfd9481f:\n  * [4.0] trove: fix rabbitmq connection URL (SOC-11286)\n\n- Update to version 4.0+git.1589458214.9f765aa08:\n  * [4.0] Fix create magnum k8s image and flavor (SOC-11251)\n\n- Update to version 4.0+git.1588271860.131fc8cc1:\n  * run keystone_register on cluster founder only when HA (SOC-11248)\n  * nova: run keystone_register on cluster founder only (SOC-11243)\n\n- Update to version 4.0+git.1588096523.679da5c50:\n  * tempest: retry openstack commands (SOC-11238)\n\n- Update to version 4.0+git.1587129016.c009e43c9:\n  * Disable magnum.tests.functional.api.v1.test_cluster (SOC-11224)\n\n- Update to version 4.0+git.1587035427.abb6e9b4e:\n  * Fix barbican SSL support (SOC-9298)\n\n- Update to version 4.0+git.1586421486.5601320b7:\n  * Fix magnum tempest tests (SOC-9298)\n\n- Update to version 4.0+git.1585331022.609482166:\n  * tempest: update blacklisted tempest test cases (SOC-9801,SOC-11174,SOC-11187)\n\n- Update to version 4.0+git.1585136604.988f3a1da:\n  * Disabling failing tempest tests on SOC7\n  * [4.0] ec2-api: run keystone_register on cluster founder only (SOC-11079)\n\n- Update to version 4.0+git.1582582068.c8c2448c0:\n  * neutron: Place space between CLI arguments\n\n- Update to version 4.0+git.1580894959.1fe5fd282:\n  * Revert '[4.0] rabbitmq: sync startup definitions.json with recipe' (SOC-11082)\n\n- Update to version 4.0+git.1580469474.967ab8baf:\n  * rabbitmq: sync startup definitions.json with recipe (SOC-11077)\n\nChanges in etcd:\n- Build against go 1.6\n\n- Fix etcd build. We are generating 2 binaries, etcd and etcdctl.\n  They need to be built separately \n\n- Ensure /var/lib/etcd is controlled by etcd:etcd\n\n- exclude i586. We don't expect this package to be built on i586. \n\n- remove sysconfig.etcd: this file is not being used \n\n- Update to version 3.1.0:\n  * raft: add node should reset the pendingConf state\n  * v3rpc: don't close watcher if client closes send\n  * e2e: add test for v3 watch over grpc gateway\n  * mvcc: remove unused restore method\n  * integration: don't expect recv to stop on CloseSend in waitResponse\n  * Documentation: add grpc gateway watch example\n  * version: bump up v3.1.0-rc.1+git\n  * discovery: warn on scheme mismatch\n  * grpcproxy: fix deadlock on watch broadcasts stop\n  * etcdmain: add '/metrics' HTTP/1 path to grpc-proxy\n  * etcd-tester: do not resolve localhost\n  * raftexample: confState should be saved after apply\n  * raft: test case to check the duplicate add node propose\n  * raft: fix test case, should wait config propose applied\n  * raft: fix test case for data race\n  * raft: use the channel instead of sleep to make test case reliable\n  * raft: fix TestNodeProposeAddDuplicateNode\n  * etcdmain: handle TLS in grpc-proxy listener\n  * etcd-tester:limit max retry backoff delay\n  * functional-tester: add withBlock() to grpc dial\n  * op-guide: add notes about Prometheus data source in Grafana\n  * clientv3: return copy of endpoints, not pointer\n  * auth: add a timeout mechanism to simple token\n  * client: update README about health monitoring\n  * grpcproxy: fix race between watch ranges delete() and broadcasts empty()\n  * lease: Use monotonic time in lease\n  * integration: use Range to wait for reboot in quota tests\n  * grpcproxy: fix race between coalesce and bcast on nextrev\n  * etcd-tester: refactor lease checker\n  * store: check sorted order in TestStoreGetSorted\n  * vendor: bump go-systemd to v14 to avoid build error\n  * integration: cancel Watch when TestV3WatchWithPrevKV exits\n  * grpcproxy: add richer metrics for watch\n  * grpcproxy: add cache related metrics\n  * raft: Fix election 'logs converge' test\n  * raft: Export Progress.IsPaused\n  * benchmark: add rate limit\n  * etcdctl: remove GetUser check before mutable commands\n  * grpcproxy: lock store when getting size\n  * Documentation: link added to libraries-and-tools.md with a new v2 Scala Client\n  * grpcproxy: fix deadlock in watchbroadcast\n  * etcdserver: time out when readStateC is blocking\n  * store: fix store_test.go comments\n  * vendor: update ugorji/go\n  * client: update generated ugorji codec\n  * doc: initial faq\n  * clientv3/integration: test lease keepalive works following quorum loss\n  * integration: use RequireLeader for TestV3LeaseFailover\n  * v3rpc, etcdserver, leasehttp: ctxize Renew with request timeout\n  * Documentation: add blox and chain as users\n  * etcdserver: do not send v2 sync if ttl keys do not exist\n  * ROADMAP: update for 3.2\n  * Documentation: add more FAQ questions\n  * grpcproxy: fix minor typo\n  * vendor: use versions when possible in glide.yaml\n  * scripts: use glide update if repo exists in glide.lock\n  * github: make bug reporting link non-relative\n  * github: make contribution link non-relative\n  * Documentation: update get examples to be clearer about ranges\n  * etcdserver, embed, v2http: move pprof setup to embed\n  * doc: add faq about apply warning logging\n  * test: exclude '_home' for gosimple, unused\n  * auth: fix gosimple errors\n  * integration: simplify boolean comparison in resp.Created\n  * raft: simplify boolean comparison, remove unused\n  * tools: simplify boolean comparison, remove unused\n  * e2e: remove unused 'ctlV3GetFailPerm'\n  * v3rpc: remove unused 'splitMethodName' function\n  * grpcproxy: remove unused field 'wbs *watchBroadcasts'\n  * doc: add faq about missing heartbeat\n  * etcdctl: 'fields' output formats\n  * build: remove dir use -r flag\n  * etcd-tester: add 'enable-pprof' option\n  * etcd-tester: cancel lease stream; fix OOM panic\n  * doc: add hardware section\n  * auth: improve 'removeSubsetRangePerms' to O(n)\n  * Documentation: use port 2379 in local cluster guide The port in endpoints should be 2379, instead of 12379.\n  * op-guide/clustering: fix typo\n  * embed: deep copy user handlers\n  * Documentation: add more FAQs (follower, leader, sys-require)\n  * clientv3: close Lease on client Close\n  * netutil: ctx-ize URLStringsEqual\n  * etcdserver: retry for 30s on advertise url check\n  * membership: retry for 30s on advertise url check\n  * clientv3: return error from KeepAlive if corresponding loop exits\n  * clientv3: add test for keep alive loop exit case\n  * auth, etcdserver: protect membership change operations with auth\n  * e2e: test cases of protecting membership change with auth\n  * clientv3: better error message for keep alive loop halt\n  * Documentation: FAQ entry for cluster ID mismatches\n  * dev-guide: add limit.md\n  * Documentation: minor fix nodes -\u003e node\n  * etcdctl: warn when backend takes too long to open on migrate\n  * docs: explicitly set ETCDCTL_API=3 in recovery.md\n  * v3api, rpctypes: add ErrTimeoutDueToConnectionLost\n  * clientv3/integration: test lease grant/keepalive with/without failures\n  * clientv3: don't reset keepalive stream on grant failure\n  * etcdctl: tighten up output, reorganize README.md\n  * Documentation: add FAQs on membership operation\n  * Documentation: add 'why.md'\n  * embed: only override default advertised client URL if the client listen URL is 0.0.0.0\n  * raft: make memory storage set method thread safe\n  * raft: resume paused followers on receipt of MsgHeartbeatResp\n  * etcd-tester: fix typo, add endpoint in logs\n  * lease: force leader to apply its pending committed index for lease operations\n  * leasehttp: buffer error channel to prevent goroutine leak\n  * raft: fix pre-vote tests\n  * etcdserver: rework update committed index logic\n  * etcd-tester: remove unused err var from maxRev\n  * e2e: check etcdctl endpoint health is healthy if denied permission to key\n  * benchmark: a new option for configuring dial timeout\n  * ctlv3: consider permission denied error to be healthy for endpoints\n  * etcdmain: add --metrics flag for exposing histogram metrics\n  * e2e: test cluster-health\n  * v2http: submit QGET in health endpoint if no progress\n  * test: bump grpcproxy pass timeout to 15m\n  * lease: use atomics for accessing lease expiry\n  * e2e: poll '/version' in release upgrade tests\n  * e2e: unset ETCDCTL_API env var before running u2e tests\n  * etcdserver: consistent naming in raftReadyHandler\n  * coverage: rework code coverage for unit and integration tests\n  * testutil: whitelist thread created by go cover\n  * rafthttp: bump up timeout in pipeline test\n  * grpcproxy, etcdmain, integration: return done channel with WatchServer\n  * integration: defer clus.Terminate in watch tests\n  * raftexample: load snapshot when opening WAL\n  * etcd-runner: make command compliant\n  * raft: use status to test node stop\n  * etcdserver: expose ErrNotEnoughStartedMembers\n  * etcdserver: resume compactor only if leader\n  * benchmark: enable grpc error logging on stderr\n  * etcd-runner:add flags in watcher for hardcoded values\n  * docs: fix recovery example in recovery.md\n  * auth: use quorum get for GetUser/GetRole for mutable operations\n  * grpcproxy: tear down watch when client context is done\n  * integration: use only digits in unix ports\n  * e2e: dump stack on ctlTest timeout\n  * expect: EXPECT_DEBUG environment variable\n  * why: add origin of the term etcd\n  * testutil: increase size of buffer for stack dump\n  * raft: fix test case for #7042\n  * vendor: update ugorji/go\n  * integration: add grpc auth testing\n  * auth: reject empty user name when checking op permissions\n  * etcdctl: create root role on auth enable if it does not yet exist\n  * raft: add RawNode test case for #6866\n  * pkg/report: support 99.9-percentile, change column name\n  * documentation: display docs.md in github browser\n  * benchmark: option to rate limit range benchmark\n  * etcdserver, clientv3: handle a case of expired auth token\n  * tools: Add etcd 3.0 load test tool refernece\n  * transport: warn on user-provided CA\n  * NEWS: add v3.1.0, v3.0.16 + minor fixes\n  * clienv3: fix balancer test logic\n  * clientv3: don't reset stream on keepaliveonce or revoke failure\n  * grpcproxy: use ccache for key cache\n  * vendor: remove groupcache, add ccache\n  * pkg/report: add 'Stats' to expose report raw data\n  * travis: use Go 1.7.4, drop old env var\n  * ctlv3: print cluster info after adding new member\n  * Documentation: document upgrading to v3.1\n  * pkg/report: add nil checking for getTimeSeries\n  * etcdserver: use ReqTimeout for linearized read\n  * grpcproxy, etcdmain, integration: add close channel to kv proxy\n  * glide: update 'golang.org/x/net'\n  * vendor: update 'golang.org/x/net'\n  * Documentation: update experimental_apis for v3.1 release\n  * NEWS: fix date for v3.1 release\n  * Documentation: fix typo s/endpoint-health/endpoint health/\n  * clientv3/concurrency: fix rev comparison on concurrent key deletion\n  * integration: test STM apply on concurrent deletion\n  * pkg/flags: fixed prefix checking of the env variables\n  * etcdctlv3: snapshot restore works with lease key\n  * test: passed the test script arguments as the test function parameters\n  * documentation: update build documentation\n  * version: bump to v3.1.0\n\n- Update to version 3.1.0rc.1:\n  * grpcproxy: watch next revision should be start revision when not 0\n  * grpcproxy: copy range request before storing in cache\n  * raft: return empty status if node is stopped\n  * mvcc: store.restore taking too long triggering snapshot cycle fix\n  * mvcc: TestStoreRestore fix\n  * mvcc : Added benchmark for store.resotre\n  * pkg/netutil: get default interface for tc commands\n  * version: bump up v3.1.0-rc.1\n\nChanges in grafana:\n- Add CVE-2020-13379.patch\n  * Security: fix unauthorized avatar proxying (bsc#1172409, CVE-2020-13379)\n- Refresh systemd-notification.patch\n- Fix declaration for LICENSE\n\n- Add 0002-CVE-2020-12052-bsc1170657-XSS-annotation-popup-vulnerability.patch    \n  * Security: Fix annotation popup XSS vulnerability                             \n    (bsc#1170657) \n\n- Add CVE-2019-15043.patch (SOC-10357, CVE-2019-15043, bsc#1148383)\nChanges in keepalived:\n- update to 2.0.19\n- new BR pkgconfig(libnftnl) to fix nftables support\n- add nftables to the BR\n- added patch\n  * linux-4.15.patch\n- add buildrequires for file-devel\n  - used in the checker to verify scripts\n- enable json stats and config dump support\n  new BR: pkgconfig(json-c)\n- enable http regexp support: new BR pcre2-devel\n- disable dbus instance creation support as it is marked as\n  dangerous\n- Add BFD build option to keepalived.spec rpm file\n  Issue #1114 identified that the keepalived.spec file was not being\n  generated to build BFD support even if keepalived had been\n  configured to support it.\n- full changelog\n  https://keepalived.org/changelog.html\n\n- update to 1.4.5:\n  * Update snapcraft.yaml for 1.4.x+git\n  * Fix generation of git-commit.h with git commit number.\n  * Set virtual server address family correctly.\n  * Set virtual server address family correctly when using tunnelled\n    real servers.\n  * Fix handling of virtual servers with no real servers at config time.\n  * Add warning if virtual and real servers are different address families.\n    Although normally the virtual server and real servers must have the\n    same address family, if a real server is tunnelled, the address families\n    can be different. However, the kernel didn't support that until 3.18,\n    so add a check that the address families are the same if different\n    address families are not supported by the kernel.\n  * Send correct status in Dbus VrrpStatusChange notification.\n    When an instance transitioned from BACKUP to FAULT, the Dbus\n    status change message reported the old status (BACKUP) rather than\n    the new status (FAULT). This commit attempts to resolved that.\n  * doc: ipvs schedulers update\n  * Fix a couple of typos in configure.ac.\n  * Fix namespace collision with musl if_ether.h.\n  * Check if return value from read_value_block() is null before using.\n  * Fix reporting real server stats via SNMP.\n  * Make checker process handle RTM_NEWLINK messages with -a option\n    Even though the checker process doesn't subscribe to RTNLGRP_LINK\n    messages, it appears that older kernels (certainly 2.6.32) can\n    send RTM_NEWLINK (but not RTM_DELLINK) messages. This occurs\n    when the link is set to up state.\n    Only the VRRP process is interested in link messages, and so the\n    checker process doesn't do the necessary initialisation to be able\n    to handle RTM_NEWLINK messages.\n    This commit makes the checker process simply discard RTM_NEWLINK\n    and RTM_DELLINK messages, rather than assuming that if it receives\n    an RTM_NEWLINK message it must be the VRRP process.\n    This problem was reported in issue #848 since the checker process\n    was segfaulting when a new interface was added when the -a command\n    line option was specified.\n  * Fix handling RTM_NEWLINK when building without VRRP code.\n  * Fix building on Fedora 28.\n    net-snmp-config output can include compiler and linker flags that\n    refer to spec files that were used to build net-snmp but may not\n    exist on the system building keepalived. That would cause the build\n    done by configure to test for net-snmp support to fail; in particular\n    on a Fedora 28 system that doesn't have the redhat-rpm-config package\n    installed.\n    This commit checks that any spec files in the compiler and linker\n    flags returned by net-snmp-config exist on the system building\n    keepalived, and if not it removes the reference(s) to the spec file(s).\n  * keepalived-1.4.3 released.\n  * vrrp: setting '0' as default value for ifa_flags to make gcc happy.\n  * Add additional libraries when testing for presence of SSL_CTX_new().\n    It appears that some systems need -lcrypto when linking with -lssl.\n  * Sanitise checking of libnl3 in configure.ac.\n  * Report and handle missing '}'s in config files.\n  * Add missing '\\n' in keepalived.data output.\n  * Stop backup taking over as master while master reloads.\n    If a reload was initiated just before an advert, and since it took\n    one advert interval after a reload before an advert was sent, if the\n    reload itself took more than one advert interval, the backup could\n    time out and take over as master.\n    This commit makes keepalived send adverts for all instances that are\n    master immediately before a reload, and also sends adverts immediately\n    after a reload, thereby trippling the time available for the reload\n    to complete.\n  * Add route option fastopen_no_cookie and rule option l3mdev.\n  * Fix errors in KEEPALIVED-MIB.txt.\n  * Simplify setting on IN6_ADDR_GEN_MODE.\n  * Cosmetic changes to keepalived(8) man page.\n  * Don't set ipvs sync daemon to master state before becoming master\n    If a vrrp instance which was the one specified for the ipvs sync\n    daemon was configured with initial state master, the sync daemon\n    was being set to master mode before the vrrp instance transitioned\n    to master mode. This caused an error message when the vrrp instance\n    transitioned to master and attempted to make the sync daemon go from\n    backup to master mode.\n    This commit stops setting the sync daemon to master mode at initialisation\n    time, and it is set to master mode when the vrrp instance transitions\n    to master.\n  * Fix freeing vector which has not had any entries allocated.\n  * Add additional mem-check disgnostics\n    vector_alloc, vectot_alloc_slot, vector_free and alloc_strvec all\n    call MALLOC/FREE but the functions written in the mem_check log\n    are vector_alloc etc, not the functions that call them.\n    This commit adds logging of the originating calling function.\n  * Fix memory leak in parser.c.\n  * Improve alignment of new mem-check logging.\n  * Disable all checkers on a virtual server when ha_suspend set.\n    Only the first checker was being disabled; this commit now disables\n    all of them.\n    Also, make the decision to disable a checker when starting/reloading\n    when scheduling the checker, so that the existance of the required\n    address can be checked.\n  * Stop genhash segfaulting when built with --enable-mem-check.\n  * Fix memory allocation problems in genhash.\n  * Properly fix memory allocation problems in genhash.\n  * Fix persistence_granularity IPv4 netmask validation.\n    The logic test from inet_aton() appears to be inverted.\n  * Fix segfault when checker configuration is missing expected parameter\n    Issue #806 mentioned as an aside that 'nb_get_retry' without a parameter\n    was sigfaulting. Commit be7ae80 - 'Stop segfaulting when configuration\n    keyword is missing its parameter' missed the 'hidden' uses of vector_slot()\n    (i.e. those used via definitions in header files).\n    This commit now updates those uses of vector_slot() to use strvec_slot()\n    instead.\n  * Fix compiling on Linux 2.x kernels.\n    There were missing checks for HAVE_DECL_CLONE_NEWNET causing\n    references to an undeclared variable if CLONE_NEWNET wasn't defined.\n  * Improve parsing of kernel release.\n    The kernel EXTRAVERSION can start with any character (although\n    starting with a digit would be daft), so relax the check for it\n    starting with a '-'. Kernels using both '+' and '.' being the\n    first character of EXTRAVERSION have been reported.\n  * Improve grammer.\n  * add support for SNI in SSL_GET check.\n    this adds a `enable_sni` parameter to SSL_GET, making sure the check\n    passes the virtualhost in the SNI extension during SSL handshake.\n  * Optimise setting host name for SSL_GET requests with SNI.\n  * Allow SNI to be used with SSL_GET with OpenSSL v1.0.0 and LibreSSL.\n  * Use configure to check for SSL_set_tlsext_host_name()\n    Rather than checking for a specific version of the OpenSSL library\n    (and it would also need checking the version of the LibreSSL library)\n    let configure check for the presence of SSL_set_tlsext_host_name().\n    Also omit all code related to SNI of SSL_set_tlsext_host_name() is\n    not available.\n  * Use configure to determine available OpenSSL functionality\n    Rather than using version numbers of the OpenSSL library to determine\n    what functions are available, let configure determine whether the\n    functions are supported.\n    The also means that the same tests work for LibreSSL.\n  * Add support for gratuitous ARPs for IP over Infiniband.\n  * Use system header definition instead of local definition IF_HWADDR_MAX\n    linux/netdevice.h has definition MAX_ADDR_LEN, which is 32, whereas\n    IF_HWADDR_MAX was locally defined to be 20.\n    Unfortunately we end up with more system header file juggling to ensure\n    we don't have duplicate definitions.\n  * Fix vrrp_script and check_misc scripts of type \u003c/dev/tcp/127.0.0.1/80.\n  * Add the first pre-defined config definition (${_PWD})\n    ${_PWD} in a configuration file will be replaced with the full\n    path name of the directory that keepalived is reading the current\n    configuration file from.\n  * Open and run the notify fifo and script if no other fifo\n    Due to the way the code was structured the notify_fifo for both\n    checker and vrrp messages wasn't run if neither the vrrp or checker\n    fifo wasn't configured.\n    Also, if all three fifos were configured, the general fifo script\n    was executed by both the vrrp and checker process, causing problems.\n  * Add support for Infiniband interfaces when dumping configuration.\n  * Tidy up layout in vrrp_arp.c.\n  * Add configure check for support of position independant executables (PIE).\n  * Add check for -pie support, and fix writing to keepalived.data.\n  * keepalived-1.4.2 released.\n  * Make genhash exit with exit code 1 on error.\n    Issue #766 identified that genhash always exits with exit code 1\n    even if an error has occurred.\n  * Rationalise printing of http header in genhash.\n  * Use http header Content-Length field in HTTP_CHECK/SSL_CHECK.\n    If a Content-Length is supplied in the http header, use that as a\n    limit to the data length (as wget does). If the length of data\n    received does not match the Content-Length log a warning.\n  * Optimise parameter passing to fprintf in genhash.\n  * Don't declare mark variable if don't have MARK socket option.\n  * Fix sync groups with only one member.\n    Commit c88744a0 allowed sync groups with only 1 member again, but\n    didn't stop removing the sync group if there was only 1 member.\n    This commit now doesn't remove sync groups with only one member.\n  * Make track scripts work with --enable-debug config option.\n  * Add warning if --enable-debug configure option is used.\n  * Allow more flexibility of layout of { and } in config files.\n    keepalived was a bit fussy about where '{'s and '}'s (braces) could\n    be placed in terms of after the keyword, or on a line on their own.\n    It certainly was not possible to have multiple braces on one line.\n    This commit now provides complete flexibility of where braces are, so\n    long as they occur in the correct order.\n  * Make alloc_value_block() report block type if there is an error.\n  * Simplify alloc_value_block() by using libc string functions.\n  * Add dumping of garp delay config when using -d option.\n  * Fix fractions of seconds for garp group garp_interval.\n  * Make read_value_block() use alloc_value_block().\n    This removes quite a bit of duplication of functionality, and\n    ensures the configuration parsing will be more consistent.\n  * Fix build with Linux kernel headers v4.15.\n    Linux kernel version 4.15 changed the libc/kernel headers suppression\n    logic in a way that introduces collisions.\n  * Add missing command line options to keepalived(8) man page.\n  * Fix --dont-release-vrrp.\n    On github, ushuz reported that commit 62e8455 - 'Don't delete vmac\n    interfaces before dropping multicast membership' broke --dont-release-vrrp.\n    This commit restores the correct functionality.\n  * Define _GNU_SOURCE for all compilation units.\n    Rather than defining _GNU_SOURCE when needed, let configure add\n    it to the flags passed to the C compiler, so that it is defined\n    for all compilation units. This ensures consistence.\n  * Fix new warnings procuded by gcc 8.\n  * Fix dumping empty lists.\n    Add a check in dump_list() for an empty list, and don't attempt\n    to dump it if it is empty.\n  * Resolve conversion-check compiler warnings.\n  * Add missing content to installing_keepalived.rst documentation.\n    Issue #778 identified that there was text missing at the end of\n    the document, and that is now added.\n  * Fix systemd service to start after network-online.target.\n    This fix was merged downstream by RedHat in response to\n    RHBZ #1413320.\n  * Update INSTALL file to describe packages needed for building\n    documentation.\n  * INSTALL: note linux distro package that provides 'sphinx_rtd_theme'\n  * Clear /proc/sys/net/ipv6/conf/IF/disable_ipv6 when create VMACs.\n    An issue was identified where keepalived was reporting permission\n    denied when attempting to add an IPv6 address to a VMAC interface.\n    It turned out that this was because\n    /proc/sys/net/ipv6/conf/default/disable_ipv6\n    was set to 1, causing IPv6 to be disables on all interfaces that\n    keepalived created.\n    This commit clears disable_ipv6 on any VMAC interfaces that\n    keepalived creates if the vrrp instance is using IPv6.\n- remove linux-4.15.patch: does not apply anymore and not needed\n  (the distros using 4.15 have moved on to keepalived 2.x)\n\n- Only Require insserv on distributions without systemd.\n- Fix systemd related requires/buildRequires\n- Do not run scriptlets that use insserv when using systemd\n\n- add linux-4.15.patch\n\nChanges in kibana:\n- Add 0001-Configurable-custom-response-headers-for-server.patch\n  (bsc#1171909, CVE-2020-10743)\n\nChanges in memcached:\n- version update to 1.5.17\n  * bugfixes\n    fix strncpy call in stats conns to avoid ASAN violation (bsc#1149110, CVE-2019-15026)\n    extstore: fix indentation\n    add error handling when calling dup function\n    add unlock when item_cachedump malloc failed\n    extstore: emulate pread(v) for macOS\n    fix off-by-one in logger to allow CAS commands to be logged.\n    use strdup for explicitly configured slab sizes\n    move mem_requested from slabs.c to items.c (internal cleanup)\n  * new features\n    add server address to the 'stats conns' output\n    log client connection id with fetchers and mutations\n    Add a handler for seccomp crashes\n- version update to 1.5.16\n  * bugfixes\n    When nsuffix is 0 space for flags hasn't been allocated so don't memcpy them.\n- version update to 1.5.15\n  * bugfixes\n    Speed up incr/decr by replacing snprintf.\n    Use correct buffer size for internal URI encoding.\n    change some links from http to https\n    Fix small memory leak in testapp.c.\n    free window_global in slab_automove_extstore.c\n    remove inline_ascii_response option\n    -Y [filename] for ascii authentication mode\n    fix: idle-timeout wasn't compatible with binprot\n  * features\n    -Y [authfile] enables an authentication mode for ASCII protocol.\n- modified patches\n  % memcached-autofoo.patch (refreshed)\n\n- version update to 1.5.14\n  * update -h output for -I (max item size)\n  * fix segfault in 'lru' command (bsc#1133817, CVE-2019-11596)\n  * fix compile error on centos7\n  * extstore: error adjusting page_size after ext_path\n  * extstore: fix segfault if page_count is too high.\n  * close delete + incr item survival race bug\n  * memcached-tool dump fix loss of exp value\n  * Fix 'qw' in 'MemcachedTest.pm' so wait_ext_flush is exported properly\n  * Experimental TLS support.\n  * Basic implementation of TLS for memcached.\n  * Improve Get And Touch documentation\n  * fix INCR/DECR refcount leak for invalid items\n- modified patches\n  % memcached-autofoo.patch (refreshed)\n\n- Version bump to 1.5.11:\n  * extstore: balance IO thread queues\n- Drop memcached-fix_test.patch that is present now upstream\n\n- Add patch to fix aarch64, ppc64* and s390x tests:\n  * memcached-fix_test.patch\n\n- Fix linter errors regarding COPYING\n\n- update to 1.5.10:\n  * disruptive change in extstore: -o ext_page_count= is deprecated\n    and no longer works. To specify size: -o ext_path=/d/m/e:500G\n    extstore figures out the page count based on your desired page\n    size. M|G|T|P supported.\n  * extstore: Add basic JBOD support: ext_path can be specified\n    multiple times for striping onto simimar devices\n  * fix alignment issues on some ARM platforms for chunked items\n\n- Update to 1.5.9:\n  * Bugfix release.\n  * Important note: if using --enable-seccomp, privilege dropping\n    is no longer on by default. The feature is experimental and many\n    users are reporting hard to diagnose problems on varied platforms.\n  * Seccomp is now marked EXPERIMENTAL, and must be explicitly\n    enabled by adding -o drop_privileges. Once we're more confident\n    with the usability of the feature, it will be enabled in -o modern,\n    like any other new change. You should only use it if you are\n    willing to carefully test it, especially if you're a vendor or\n    distribution.\n  * Also important is a crash fix in extstore when using the ASCII\n    protocol, large items, and running low on memory.\n\n- update to 1.5.8:\n  * Bugfixes for seccomp and extstore\n  * Extstore platform portability has been greatly improved for ARM\n    and 32bit systems\n- includes changes from 1.5.7:\n  * Fix alignment issues for 64bit ARM processors\n  * Fix seccomp portability\n  * Fix refcount leak with extstore while using binary touch commands\n\n- turn on the testsuite again, it seems to pass server side,\n  too\n\n- Home directory shouldn't be world readable bsc#1077718\n- Mention that this stream isn't affected by bsc#1085209, \n  CVE-2018-1000127 to make the checker bots happy.\n\n- update to 1.5.6 (bsc#1083903, CVE-2018-1000115):\n  * This update disables UDP by default to reduce DDoS amplification\n  attacks\n  * see https://github.com/memcached/memcached/wiki/ReleaseNotes156\n  * see https://github.com/memcached/memcached/wiki/ReleaseNotes155\n  * see https://github.com/memcached/memcached/wiki/ReleaseNotes154\n  * see https://github.com/memcached/memcached/wiki/ReleaseNotes153\n  * see https://github.com/memcached/memcached/wiki/ReleaseNotes152\n  * see https://github.com/memcached/memcached/wiki/ReleaseNotes151\n  * see https://github.com/memcached/memcached/wiki/ReleaseNotes150\n\n- Replace references to /var/adm/fillup-templates with new \n  %_fillupdir macro (boo#1069468)\n\nChanges in monasca-installer:\n- Add 0001-kibana:-set-x-frame-options-header.patch (bsc#1171909,\n  CVE-2020-10743)\n\nChanges in openstack-dashboard-theme-SUSE:\n- Switch github URL from git@ to git:// to bypass authentication\n\nChanges in openstack-manila:\n- Add 0001-Fix-exportfs-u-usage-in-generic-driver.patch\n  Backported from upstream patch https://review.opendev.org/#/c/411631/\n  Related Bug (SOC-9801)\n\nChanges in openstack-neutron-fwaas:\n- Add 0050-Remove-tempest-shared-physical-network.patch (SOC-9801)\n  This tempest configuration option is not present in tempest, as\n  it was only added after the SOC7 release cut.\n\nChanges in openstack-nova:\n- Add 0001-live-mig-keep-disk-device-address-same.patch (bsc#1164316)\n  - Fix for https://bugs.launchpad.net/nova/+bug/1715569\n\nChanges in openstack-tempest:\n\n- Add 0001-Use-available-scheduler-filters.patch\n  Backported from upstream patch https://review.opendev.org/#/c/570207/\n  Related Bugs: SOC-9801,SOC-11174\n\n- Add 0001-Remove-volume_feature_enabled.volume_services.patch\n  Backported from upstream patch https://review.opendev.org/#/c/438220/\n  Related Bug (SOC-9801)\n\n\nChanges in python-cffi:\n- Do not build python3 subpackages as C:OS:Newton does not support\n  it\n\n- provide also python-cffi = 1.10.0 and 1.5.2 to avoid breaking the\n  cloud 7 and 8 requirements (bsc#948198)\n\n- Update in SLE-12 (bsc#1138748, jsc#ECO-1256, jsc#PM-1598)\n\n- Add dont-corrupt-memory.patch to fix boo#1111657 (originally\n  from https://bitbucket.org/cffi/cffi/commits/7a76a3815340)\n\n- build python3 subpackage (FATE#324435, FATE#323875)\n\n- Add patch cffi-loader.patch to fix bsc#1070737\n- Sort out with spec-cleaner\n\n- update to version 1.11.2:\n  * Fix Windows issue with managing the thread-state on CPython 3.0 to\n    3.5\n\n- Update pytest in spec to add c directory tests in addition to \n  testing directory.\n- Omit test_init_once_multithread tests as they rely on multiple\n  threads finishing in a given time. Returns sporadic pass/fail\n  within build.\n- Update to 1.11.1:\n  * Fix tests, remove deprecated C API usage\n  * Fix (hack) for 3.6.0/3.6.1/3.6.2 giving incompatible binary\n    extensions (cpython issue #29943)\n  * Fix for 3.7.0a1+\n\n- Update to 1.11.0:\n  * Support the modern standard types char16_t and char32_t. These\n    work like wchar_t: they represent one unicode character, or when\n    used as charN_t * or charN_t[] they represent a unicode string.\n    The difference with wchar_t is that they have a known, fixed\n    size. They should work at all places that used to work with\n    wchar_t (please report an issue if I missed something). Note\n    that with set_source(), you need to make sure that these types\n    are actually defined by the C source you provide (if used in\n    cdef()).\n  * Support the C99 types float _Complex and double _Complex. Note\n    that libffi doesn’t support them, which means that in the ABI\n    mode you still cannot call C functions that take complex\n    numbers directly as arguments or return type.\n  * Fixed a rare race condition when creating multiple FFI instances\n    from multiple threads. (Note that you aren’t meant to create\n    many FFI instances: in inline mode, you should write\n    ffi = cffi.FFI() at module level just after import cffi; and in\n    out-of-line mode you don’t instantiate FFI explicitly at all.)\n  * Windows: using callbacks can be messy because the CFFI internal\n    error messages show up to stderr—but stderr goes nowhere in many\n    applications. This makes it particularly hard to get started\n    with the embedding mode. (Once you get started, you can at least\n    use @ffi.def_extern(onerror=...) and send the error logs where\n    it makes sense for your application, or record them in log\n    files, and so on.) So what is new in CFFI is that now, on\n    Windows CFFI will try to open a non-modal MessageBox (in addition\n    to sending raw messages to stderr). The MessageBox is only\n    visible if the process stays alive: typically, console\n    applications that crash close immediately, but that is also the\n    situation where stderr should be visible anyway.\n  * Progress on support for callbacks in NetBSD.\n  * Functions returning booleans would in some case still return 0\n    or 1 instead of False or True. Fixed.\n  * ffi.gc() now takes an optional third parameter, which gives an\n    estimate of the size (in bytes) of the object. So far, this is\n    only used by PyPy, to make the next GC occur more quickly\n    (issue #320). In the future, this might have an effect on\n    CPython too (provided the CPython issue 31105 is addressed).\n  * Add a note to the documentation: the ABI mode gives function\n    objects that are slower to call than the API mode does. For\n    some reason it is often thought to be faster. It is not!\n- Update to 1.10.1:\n  * Fixed the line numbers reported in case of cdef() errors. Also,\n    I just noticed, but pycparser always supported the preprocessor\n    directive # 42 'foo.h' to mean “from the next line, we’re in\n    file foo.h starting from line 42”, which it puts in the error\n    messages. \n\n- update to 1.10.0:\n * Issue #295: use calloc() directly instead of PyObject_Malloc()+memset()\n   to handle ffi.new() with a default allocator. Speeds up ffi.new(large-array)\n   where most of the time you never touch most of the array.\n  * Some OS/X build fixes (“only with Xcode but without CLT”).\n  * Improve a couple of error messages: when getting mismatched versions of\n    cffi and its backend; and when calling functions which cannot be called with\n    libffi because an argument is a struct that is “too complicated” (and not\n    a struct pointer, which always works).\n  * Add support for some unusual compilers (non-msvc, non-gcc, non-icc, non-clang)\n  * Implemented the remaining cases for ffi.from_buffer. Now all\n    buffer/memoryview objects can be passed. The one remaining check is against\n    passing unicode strings in Python 2. (They support the buffer interface, but\n    that gives the raw bytes behind the UTF16/UCS4 storage, which is most of the\n    times not what you expect. In Python 3 this has been fixed and the unicode\n    strings don’t support the memoryview interface any more.)\n  * The C type _Bool or bool now converts to a Python boolean when reading,\n    instead of the content of the byte as an integer. The potential\n    incompatibility here is what occurs if the byte contains a value different\n    from 0 and 1. Previously, it would just return it; with this change, CFFI\n    raises an exception in this case. But this case means “undefined behavior”\n    in C; if you really have to interface with a library relying on this,\n    don’t use bool in the CFFI side. Also, it is still valid to use a byte\n    string as initializer for a bool[], but now it must only contain \\x00 or\n    \\x01. As an aside, ffi.string() no longer works on bool[] (but it never made\n    much sense, as this function stops at the first zero).\n  * ffi.buffer is now the name of cffi’s buffer type, and ffi.buffer() works\n    like before but is the constructor of that type.\n  * ffi.addressof(lib, 'name') now works also in in-line mode, not only in\n    out-of-line mode. This is useful for taking the address of global variables.\n  * Issue #255: cdata objects of a primitive type (integers, floats, char) are\n    now compared and ordered by value. For example, \u003ccdata 'int' 42\u003e compares\n    equal to 42 and \u003ccdata 'char' b'A'\u003e compares equal to b'A'. Unlike C,\n    \u003ccdata 'int' -1\u003e does not compare equal to ffi.cast('unsigned int', -1): it\n    compares smaller, because -1 \u003c 4294967295.\n  * PyPy: ffi.new() and ffi.new_allocator()() did not record “memory pressure”,\n    causing the GC to run too infrequently if you call ffi.new() very often\n    and/or with large arrays. Fixed in PyPy 5.7.\n  * Support in ffi.cdef() for numeric expressions with + or -. Assumes that\n    there is no overflow; it should be fixed first before we add more general\n    support for arbitrary arithmetic on constants.\n\n- do not generate HTML documentation for packages that are indirect\n  dependencies of Sphinx\n  (see docs at https://cffi.readthedocs.org/ )\n\n- update to 1.9.1\n  - Structs with variable-sized arrays as their last field: now we track the\n    length of the array after ffi.new() is called, just like we always tracked\n    the length of ffi.new('int[]', 42). This lets us detect out-of-range\n    accesses to array items. This also lets us display a better repr(), and\n    have the total size returned by ffi.sizeof() and ffi.buffer(). Previously\n    both functions would return a result based on the size of the declared\n    structure type, with an assumed empty array. (Thanks andrew for starting\n    this refactoring.)\n  - Add support in cdef()/set_source() for unspecified-length arrays in\n    typedefs: typedef int foo_t[...];. It was already supported for global\n    variables or structure fields.\n  - I turned in v1.8 a warning from cffi/model.py into an error: 'enum xxx' has\n    no values explicitly defined: refusing to guess which integer type it is\n    meant to be (unsigned/signed, int/long). Now I’m turning it back to a\n    warning again; it seems that guessing that the enum has size int is a\n    99%-safe bet. (But not 100%, so it stays as a warning.)\n  - Fix leaks in the code handling FILE * arguments. In CPython 3 there is a\n    remaining issue that is hard to fix: if you pass a Python file object to a\n    FILE * argument, then os.dup() is used and the new file descriptor is only\n    closed when the GC reclaims the Python file object—and not at the earlier\n    time when you call close(), which only closes the original file descriptor.\n    If this is an issue, you should avoid this automatic convertion of Python\n    file objects: instead, explicitly manipulate file descriptors and call\n    fdopen() from C (...via cffi).\n  - When passing a void * argument to a function with a different pointer type,\n    or vice-versa, the cast occurs automatically, like in C. The same occurs\n    for initialization with ffi.new() and a few other places. However, I\n    thought that char * had the same property—but I was mistaken. In C you get\n    the usual warning if you try to give a char * to a char ** argument, for\n    example. Sorry about the confusion. This has been fixed in CFFI by giving\n    for now a warning, too. It will turn into an error in a future version.\n  - Issue #283: fixed ffi.new() on structures/unions with nested anonymous\n    structures/unions, when there is at least one union in the mix. When\n    initialized with a list or a dict, it should now behave more closely like\n    the { } syntax does in GCC.\n  - CPython 3.x: experimental: the generated C extension modules now use the\n    “limited API”, which means that, as a compiled .so/.dll, it should work\n    directly on any version of CPython \u003e= 3.2. The name produced by distutils\n    is still version-specific. To get the version-independent name, you can\n    rename it manually to NAME.abi3.so, or use the very recent setuptools 26.\n  - Added ffi.compile(debug=...), similar to python setup.py build --debug but\n    defaulting to True if we are running a debugging version of Python itself.\n  - Removed the restriction that ffi.from_buffer() cannot be used on byte\n    strings. Now you can get a char * out of a byte string, which is valid as\n    long as the string object is kept alive. (But don’t use it to modify the\n    string object! If you need this, use bytearray or other official\n    techniques.)\n  - PyPy 5.4 can now pass a byte string directly to a char * argument (in older\n    versions, a copy would be made). This used to be a CPython-only\n    optimization.\n  - ffi.gc(p, None) removes the destructor on an object previously created by\n    another call to ffi.gc()\n  - bool(ffi.cast('primitive type', x)) now returns False if the value is zero\n    (including -0.0), and True otherwise. Previously this would only return\n    False for cdata objects of a pointer type when the pointer is NULL.\n  - bytearrays: ffi.from_buffer(bytearray-object) is now supported. (The reason\n    it was not supported was that it was hard to do in PyPy, but it works since\n    PyPy 5.3.) To call a C function with a char * argument from a buffer\n    object—now including bytearrays—you write lib.foo(ffi.from_buffer(x)).\n    Additionally, this is now supported: p[0:length] = bytearray-object. The\n    problem with this was that a iterating over bytearrays gives numbers\n    instead of characters. (Now it is implemented with just a memcpy, of\n    course, not actually iterating over the characters.)\n  - C++: compiling the generated C code with C++ was supposed to work, but\n    failed if you make use the bool type (because that is rendered as the C\n    _Bool type, which doesn’t exist in C++).\n  - help(lib) and help(lib.myfunc) now give useful information, as well as\n    dir(p) where p is a struct or pointer-to-struct.\n- drop upstreamed python-cffi-avoid-bitshifting-negative-int.patch\n\n- update for multipython build\n\n- Add python-cffi-avoid-bitshifting-negative-int.patch to actually\n  fix the 'negative left shift' warning by replacing bitshifting\n  in appropriate places by bitwise and comparison to self; patch\n  taken from upstream git. Drop cffi-1.5.2-wnoerror.patch: no\n  longer required.\n\n- disable 'negative left shift' warning in test suite to prevent\n  failures with gcc6, until upstream fixes the undefined code\n  in question (boo#981848, cffi-1.5.2-wnoerror.patch)\n\n- Update to version 1.6.0:\n  * ffi.list_types()\n  * ffi.unpack()\n  * extern “Python+C”\n  * in API mode, lib.foo.__doc__ contains the C signature now.\n  * Yet another attempt at robustness of ffi.def_extern() against\n    CPython’s interpreter shutdown logic.\n\nChanges in python-pylons-sphinx-themes:\n\n- moved LICENSE.txt to docs to match old structure\n\n- specfile:\n  * update copyright year\n- update to version 1.0.11:\n  * Fix the width of linenos table column when used in code-blocks.\n\n- Replace %fdupes -s with plain %fdupes; hardlinks are better.\n\n- Update to version 1.0.10 (2018-09-25)\n  + Add Read the Docs to the recipients of ad revenue.\n- Update to version 1.0.9 (2018-09-23)\n  + Remove hyphenation because it sometimes hyphenates\n    inappropriately, such as in code.\n- Update to version 1.0.8 (2018-09-21)\n  + Fix support for Ethical Ads.\n- Update to version 1.0.7 (2018-09-21)\n  + Added support for Ethical Ads for Read The Docs.\n    See https://github.com/Pylons/pylons-sphinx-themes/pull/12\n\n- Remove superfluous devel dependency for noarch package\n\n- Update to version 1.0.6\n  * Update zest.releaser in order to release to PyPI.\n- Update to version 1.0.5\n  * Clean up licensing\n    https://github.com/Pylons/pylons-sphinx-themes/issues/8\n\n- Provide/obsolete old pylons_sphinx_theme\n\n- Update to version 1.0.4\n  * Specify line spacing for list items for only within the\n    .body class.\n  version 1.0.3\n  * Add line spacing for list items. Closes #4.\n  version 1.0.2:\n  * Remove HTTPS protocol to allow either HTTPS or HTTP.\n  version 1.0.1:\n  * Use HTTPS for protocol of stylesheets.\n  version 1.0:\n  * Use zest.releaser for releasing.\n  * Improve documentation.\n- Converted to single-spec\n\n- version 0.3.1: initial build\n\nChanges in python-Django:\n- Fix merge artifact in CVE-2020-13596.patch\n\n- Add CVE-2019-19844.patch (bsc#1159447, CVE-2019-19844)\n  * Fix Potential account hijack via password reset form\n\n- Security fixes (bsc#1172167, bsc#1172166, CVE-2020-13254,  CVE-2020-13596)\n  * Added patch CVE-2020-13254.patch\n  * Added patch CVE-2020-13596.patch\n\n- Set _defaultlicensedir \n\n- Fix for SG#56542, bsc#1161349:\n  * Fixed CVE-2019-3498-Fixed-content-spoof.patch\n\n- Fix for SG#56542, bsc#1161349:\n  * Fixed CVE-2019-3498-Fixed-content-spoof.patch\n  (There was a bug in this .patch file; some code had been\n  accidentally included in the backport, and this stopped the 404\n  page from loading. See commit message and bug report for more\n  information)\n\nChanges in python-Pillow:\n- Remove decompression_bomb.gif and relevant test case to avoid\n  ClamAV scan alerts during build\n\n- Add 0008-Corrected-negative-seeks.patch\n   * From upstream, backported\n   * Fixes part of CVE-2019-16865, bsc#1153191\n- Add 0009-Make-Image.crop-an-immediate-operation.patch\n   * From upstream, backported\n   * Fixes https://github.com/python-pillow/Pillow/issues/1077\n   * Used by 0012-Added-decompression-bomb-checks.patch\n- Add 0010-Crop-decompression.patch\n   * From upstream, backported\n   * Fixes https://github.com/python-pillow/Pillow/issues/2402\n   * Used by 0012-Added-decompression-bomb-checks.patch\n- Add 0011-Added-DecompressionBombError.patch\n   * From upstream, backported\n   * Adds DecompressionBombError class\n   * Used by 0012-Added-decompression-bomb-checks.patch\n- Add 0012-Added-decompression-bomb-checks.patch\n   * From upstream, backported\n   * Fixes part of CVE-2019-16865, bsc#1153191\n- Add 0013-Raise-error-if-dimension-is-a-string.patch\n   * From upstream, backported\n   * Fixes part of CVE-2019-16865, bsc#1153191\n- Add 0014-Catch-buffer-overruns.patch\n   * From upstream, backported\n   * Fixes part of CVE-2019-16865, bsc#1153191\n- Add 0015-Catch-PCX-P-mode-buffer-overrun.patch\n   * From upstream, backported\n   * Fixes CVE-2020-5312, bsc#1160152\n- Add 0016-Ensure-previous-FLI-frame-is-loaded.patch\n   * From upstream, backported\n   * Fixes https://github.com/python-pillow/Pillow/issues/2649\n   * Uncovers CVE-2020-5313, bsc#1160153\n- Add 0017-Catch-FLI-buffer-overrun.patch\n   * From upstream, backported\n   * Fixes CVE-2020-5313, bsc#1160153\n- Add 018-Invalid-number-of-bands-in-FPX-image.patch\n   * From upstream, backported\n   * Fixes CVE-2019-19911, bsc#1160192\n\nChanges in python-psql2mysql:\n- Update to version 0.5.0+git.1589351878.4ef877c:\n  * Do not fail on instance_info length, it is expected to be LONGTEXT\n\n- Update to version 0.5.0+git.1582192453.98e9561:\n  * Neutron drivers use own naming for alembic migrations, e.g. cisco_alembic_version, aci_alembic_version, etc depending on driver.\n\nChanges in python-psutil:\n- Add bsc1156525-CVE-2019-18874.patch (bsc#1156525, CVE-2019-18874)\n\nChanges in python-py:\n- update to version 1.5.2\n-----------------------------------------------------------------\n- update to version 1.4.33\n\nChanges in python-py:\n- update to version 1.5.2:\n  * fix #169, #170: error importing py.log on Windows: no module named\n    'syslog'.\n- changes from version 1.5.1:\n  * fix #167 - prevent pip from installing py in unsupported Python\n    versions.\n- changes from version 1.5.0:\n  * python 2.6 and 3.3 are no longer supported\n  * deprecate py.std and remove all internal uses\n  * fix #73 turn py.error into an actual module\n  * path join to / no longer produces leading double slashes\n  * fix #82 - remove unsupportable aliases\n  * fix python37 compatibility of path.sysfind on windows by correctly\n    replacing vars\n  * turn iniconfig and apipkg into vendored packages and ease\n    de-vendoring for distributions\n  * fix #68 remove invalid py.test.ensuretemp references\n  * fix #25 - deprecate path.listdir(sort=callable)\n  * add TerminalWriter.chars_on_current_line read-only property that\n    tracks how many characters have been written to the current line.\n- changes from version 1.4.34\n  * fix issue119 / pytest issue708 where tmpdir may fail to make\n    numbered directories when the filesystem is case-insensitive.\n\n- update to version 1.4.33:\n  * avoid imports in calls to py.path.local().fnmatch(). Thanks\n    Andreas Pelme for the PR.\n  * fix issue106: Naive unicode encoding when calling fspath() in\n    python2. Thanks Tiago Nobrega for the PR.\n  * fix issue110: unittest.TestCase.assertWarns fails with py\n    imported.\n- changes from version 1.4.32\n  * fix issue70: aded ability to copy all stat info in\n    py.path.local.copy.\n  * make TerminalWriter.fullwidth a property. This results in the\n    correct value when the terminal gets resized.\n  * update supported html tags to include recent additions.\n    Thanks Denis Afonso for the PR.\n  * Remove internal code in ``Source.compile`` meant to support\n    earlier Python 3 versions that produced the side effect\n    of leaving ``None`` in ``sys.modules`` when called (see\n    pytest-dev/pytest#2103). Thanks Bruno Oliveira for the PR.\n\nChanges in python-pysaml2:\n- Add 0001-Always-generate-a-random-IV-for-AES-operations.patch\n  (CVE-2017-1000246, bsc#1068612)\n\n- Add 0001-Fix-XML-Signature-Wrapping-XSW-vulnerabilities.patch\n  (CVE-2020-5390, bsc#1160851)\n\nChanges in python-waitress:\n- update to 1.4.3 to include fixes for:\n  * CVE-2019-16785 / bsc#1161088\n  * CVE-2019-16786 / bsc#1161089\n  * CVE-2019-16789 / bsc#1160790\n  * CVE-2019-16792 / bsc#1161670\n\n- moved LICENSE.txt to docs to match old structure \n\n- make sure UTF8 locale is used when runnning tests\n  * Sometimes functional tests executed in python3 failed if stdout was not\n    set to UTF-8. The error message was:\n      ValueError: underlying buffer has been detached\n\n- %python3_only -\u003e %python_alternative\n\n- update to 1.4.3\n  * Waitress did not properly validate that the HTTP headers it received \n    were properly formed, thereby potentially allowing a front-end server \n    to treat a request different from Waitress. This could lead to HTTP \n    request smuggling/splitting.\n- drop patch local-intersphinx-inventories.patch\n  * it was commented out, anyway\n\n- update to 1.4.0:\n  - Waitress used to slam the door shut on HTTP pipelined requests without\n  setting the ``Connection: close`` header as appropriate in the response. This\n  is of course not very friendly. Waitress now explicitly sets the header when\n  responding with an internally generated error such as 400 Bad Request or 500\n  Internal Server Error to notify the remote client that it will be closing the\n  connection after the response is sent.\n  - Waitress no longer allows any spaces to exist between the header field-name\n  and the colon. While waitress did not strip the space and thereby was not\n  vulnerable to any potential header field-name confusion, it should have sent\n  back a 400 Bad Request. See https://github.com/Pylons/waitress/issues/273\n  - CRLR handling Security fixes\n\n- update to 1.3.1\n  * Waitress won’t accidentally throw away part of the path if it \n    starts with a double slash\n\n- version update to 1.3.0\n  Deprecations\n  ~~~~~~~~~~~~\n  - The ``send_bytes`` adjustment now defaults to ``1`` and is deprecated\n    pending removal in a future release.\n    and https://github.com/Pylons/waitress/pull/246\n  Features\n  ~~~~~~~~\n  - Add a new ``outbuf_high_watermark`` adjustment which is used to apply\n    backpressure on the ``app_iter`` to avoid letting it spin faster than data\n    can be written to the socket. This stabilizes responses that iterate quickly\n    with a lot of data.\n    See https://github.com/Pylons/waitress/pull/242\n  - Stop early and close the ``app_iter`` when attempting to write to a closed\n    socket due to a client disconnect. This should notify a long-lived streaming\n    response when a client hangs up.\n    See https://github.com/Pylons/waitress/pull/238\n    and https://github.com/Pylons/waitress/pull/240\n    and https://github.com/Pylons/waitress/pull/241\n  - Adjust the flush to output ``SO_SNDBUF`` bytes instead of whatever was\n    set in the ``send_bytes`` adjustment. ``send_bytes`` now only controls how\n    much waitress will buffer internally before flushing to the kernel, whereas\n    previously it used to also throttle how much data was sent to the kernel.\n    This change enables a streaming ``app_iter`` containing small chunks to\n    still be flushed efficiently.\n    See https://github.com/Pylons/waitress/pull/246\n  Bugfixes\n  ~~~~~~~~\n  - Upon receiving a request that does not include HTTP/1.0 or HTTP/1.1 we will\n    no longer set the version to the string value 'None'. See\n    https://github.com/Pylons/waitress/pull/252 and\n    https://github.com/Pylons/waitress/issues/110\n  - When a client closes a socket unexpectedly there was potential for memory\n    leaks in which data was written to the buffers after they were closed,\n    causing them to reopen.\n    See https://github.com/Pylons/waitress/pull/239\n  - Fix the queue depth warnings to only show when all threads are busy.\n    See https://github.com/Pylons/waitress/pull/243\n    and https://github.com/Pylons/waitress/pull/247\n  - Trigger the ``app_iter`` to close as part of shutdown. This will only be\n    noticeable for users of the internal server api. In more typical operations\n    the server will die before benefiting from these changes.\n    See https://github.com/Pylons/waitress/pull/245\n  - Fix a bug in which a streaming ``app_iter`` may never cleanup data that has\n    already been sent. This would cause buffers in waitress to grow without\n    bounds. These buffers now properly rotate and release their data.\n    See https://github.com/Pylons/waitress/pull/242\n  - Fix a bug in which non-seekable subclasses of ``io.IOBase`` would trigger\n    an exception when passed to the ``wsgi.file_wrapper`` callback.\n    See https://github.com/Pylons/waitress/pull/249\n\n- Trim marketing wording and other platform mentions.\n\n- Add fetch-intersphinx-inventories.sh to sources\n- Add local-intersphinx-inventories.patch for generating the docs\n  correctly\n\n- update to version 1.2.1:\n  too many changes to list here, see:\n  https://github.com/Pylons/waitress/blob/master/CHANGES.txt\n  or even:\n  https://github.com/Pylons/waitress/commits/master\n\n- Remove superfluous devel dependency for noarch package\n\n- update to version 1.1.0:\n  * Features\n    + Waitress now has a __main__ and thus may be called with 'python\n      -mwaitress'\n  * Bugfixes\n    + Waitress no longer allows lowercase HTTP verbs. This change was\n      made to fall in line with most HTTP servers. See\n      https://github.com/Pylons/waitress/pull/170\n    + When receiving non-ascii bytes in the request URL, waitress will\n      no longer abruptly close the connection, instead returning a 400\n      Bad Request. See https://github.com/Pylons/waitress/pull/162 and\n      https://github.com/Pylons/waitress/issues/64\n\n- Update to 1.0.2\n  * Python 3.6 is now officially supported in Waitress\n  * Add a work-around for libc issue on Linux not following the\n    documented standards. If getnameinfo() fails because of DNS not\n    being available it should return the IP address instead of the\n    reverse DNS entry, however instead getnameinfo() raises. We\n    catch this, and ask getnameinfo() for the same information\n    again, explicitly asking for IP address instead of reverse\n    DNS hostname.\n- Implement single-spec version.\n- Fix source URL.\n\n- update to 1.0.1:\n  - IPv6 support on Windows was broken due to missing constants in the socket\n    module. This has been resolved by setting the constants on Windows if they\n    are missing. See https://github.com/Pylons/waitress/issues/138\n  - A ValueError was raised on Windows when passing a string for the port, on\n    Windows in Python 2 using service names instead of port numbers doesn't work\n    with `getaddrinfo`. This has been resolved by attempting to convert the port\n    number to an integer, if that fails a ValueError will be raised. See\n    https://github.com/Pylons/waitress/issues/139\n  - Removed `AI_ADDRCONFIG` from the call to `getaddrinfo`, this resolves an\n    issue whereby `getaddrinfo` wouldn't return any addresses to `bind` to on\n    hosts where there is no internet connection but localhost is requested to be\n    bound to. See https://github.com/Pylons/waitress/issues/131 for more\n    information.\n- disable tests. need network access.\n\nChanges in rabbitmq-server:\n- Apply patches to resolve CVE-2017-4967,CVE-2017-4965 (bsc#1037777)\n   0001-Escape-HTML-tags-in-policy-definition-fields.patch\n   0002-Don-t-echo-provided-encoding-value-back.patch\n   0003-Strip-off-pids-and-format-consumer-details-for-2-end.patch\n   0004-Format-Web-contexts.patch\n\nChanges in release-notes-suse-openstack-cloud:\n- Switch github URL from git@ to https:// to bypass authentication \n\nChanges in rubygem-activeresource:\n- Add bsc#1171560-CVE-2020-8151-encode-id-param.patch\n  Prevent possible information disclosure issue that could allow\n  an attacker to create specially crafted requests to access data\n  in an unexpected way (bsc#1171560 CVE-2020-8151)) \n\nChanges in rubygem-crowbar-client:\n- Update to 3.9.2\n  - Enable SES commands in Cloud8 (SOC-11122)\n\nChanges in rubygem-json-1_7:\n- Add CVE-2020-10663.patch (CVE-2020-10663, bsc#1167244)\n\nChanges in rubygem-puma:\n- Fix indentation in gem2rpm.yml \n\n- Add CVE-2020-11077.patch (bsc#1172175, CVE-2020-11077)\n- Add chunked-request-handling.patch (needed for CVE-2020-11076.patch)\n- Add CVE-2020-11076.patch (bsc#1172176, CVE-2020-11076)\n- Add all patches to gem2rpm.yml\n\n- Add CVE-2020-5247.patch (bsc#1165402)\n  'Fixes a problem where we were not splitting newlines in headers\n  according to Rack spec'\n  The patch is reduced compared to the upstream version, which was\n  patching also the parts that are not implemented in our old Puma\n  version. This applies to unit test as well.\n\nChanges in zookeeper:\n- Apply 0002-Apply-patch-to-resolve-CVE-2019-0201.patch\n  This applies the patch for ZOOKEEPER-1392 to resolve CVE-2019-0201\n  Should not allow to read ACL when not authorized to read node \n  (bsc#1135773)\n\n- Various cleanups in spec file\n\n","status":"published","published":"2020-07-29T14:31:35Z","modified":"2026-02-04T03:28:35.724909Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-RU-2020:2161-1","title":"Security update for ansible1, ardana-ansible, ardana-cobbler, ardana-glance, ardana-input-model, ardana-logging, ardana-manila, ardana-monasca, ardana-mq, ardana-neutron, ardana-octavia, ardana-tempest, crowbar-core, crowbar-openstack, grafana, kibana, openstack-barbican, openstack-ceilometer, openstack-cinder, openstack-dashboard, openstack-designate, openstack-heat-templates, openstack-ironic, openstack-keystone, openstack-magnum, openstack-manila, openstack-monasca-agent, openstack-neutron, openstack-neutron-vsphere, openstack-nova, openstack-octavia, openstack-octavia-amphora-image, openstack-resource-agents, python-Django1, python-Pillow, python-ardana-packager, python-heatclient, python-neutron-tempest-plugin, python-octavia-tempest-plugin, python-os-brick, python-oslo.messaging, python-pyroute2, python-urllib3, python-waitress, release-notes-suse-openstack-cloud, rubygem-activeresource, rubygem-json-1_7, rubygem-puma","description":"This update for ansible1, ardana-ansible, ardana-cobbler, ardana-glance, ardana-input-model, ardana-logging, ardana-manila, ardana-monasca, ardana-mq, ardana-neutron, ardana-octavia, ardana-tempest, crowbar-core, crowbar-openstack, grafana, kibana, openstack-barbican, openstack-ceilometer, openstack-cinder, openstack-dashboard, openstack-designate, openstack-heat-templates, openstack-ironic, openstack-keystone, openstack-magnum, openstack-manila, openstack-monasca-agent, openstack-neutron, openstack-neutron-vsphere, openstack-nova, openstack-octavia, openstack-octavia-amphora-image, openstack-resource-agents, python-Django1, python-Pillow, python-ardana-packager, python-heatclient, python-neutron-tempest-plugin, python-octavia-tempest-plugin, python-os-brick, python-oslo.messaging, python-pyroute2, python-urllib3, python-waitress, release-notes-suse-openstack-cloud, rubygem-activeresource, rubygem-json-1_7, rubygem-puma fixes the following issues:\n\nSecurity fixes included in this update:\n\nansible1:\n- CVE-2019-3828: Fixed a path traversal in the fetch module (bsc#1126503).\n\ngrafana:\n- CVE-2020-13379: Fixed an incorrect access control issue which could\nlead to information leaks or denial of service (bsc#1172409).\n- CVE-2020-12052: Fixed an cross site scripting vulnerability related to\nthe annotation popup (bsc#1170657).\n\nkibana:\n- CVE-2020-10743: Fixed a clickjacking vulnerability (bsc#1171909).\n\npython-Django1 to 1.11.29:\n- CVE-2020-13254: Fixed a data leakage via malformed memcached keys\n(bsc#1172167).\n- CVE-2020-13596: Fixed a cross site scripting vulnerability related to\nthe admin parameters of the ForeignKeyRawIdWidget (bsc#1172166).\n- CVE-2020-7471: Fixed a SQL injection via StringAgg delimiter\n(bsc#1161919).\n- CVE-2020-9402: Fixed a SQL injection via tolerance parameter in GIS\nfunctions and aggregates (bsc#1165022).\n- CVE-2019-19844: Fixed a potential account hijack via password reset\nform (bsc#1159447).\n\npython-Pillow:\n- CVE-2020-10177: Fixed multiple out-of-bounds reads in\nlibImaging/FliDecode.c (bsc#1173413).\n- CVE-2020-11538: Fixed multiple out-of-bounds reads via a crafted JP2\nfiles (bsc#1173420).\n- CVE-2020-10994: Fixed multiple out-of-bounds reads via a crafted JP2\nfiles (bsc#1173418).\n- CVE-2020-10378: Fixed an out-of-bounds read when reading PCX files\n(bsc#1173416).\n- CVE-2019-16865: Fixed a denial of service with specially crafted\nimage files (bsc#1153191).\n- CVE-2020-5311: Fixed an SGI buffer overflow (bsc#1160151).\n- CVE-2020-5312: Fixed a buffer overflow in the PCX P mode (bsc#1160152).\n- CVE-2020-5313: Fixed a buffer overflow related to FLI (bsc#1160153).\n- CVE-2019-19911: Fixed a denial of service in FpxImagePlugin.py\n(bsc#1160192).\n\npython-waitress to version 1.4.3:\n- CVE-2019-16785: Fixed HTTP request smuggling through LF vs CRLF\nhandling (bsc#1161088).\n- CVE-2019-16786: Fixed HTTP request smuggling through invalid\nTransfer-Encoding (bsc#1161089).\n- CVE-2019-16789: Fixed HTTP Request Smuggling through invalid\nwhitespace characters (bsc#1160790).\n- CVE-2019-16792: Fixed HTTP Request Smuggling through Content-Length\nheader handling (bsc#1161670).\n\nrubygem-activeresource:\n- CVE-2020-8151: Fixed possible information disclosure through specially\ncrafted requests (bsc#1171560).\n\nNon security fixes:\n\nChanges in ansible1.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Add 0001-Disallow-use-of-remote-home-directories-containing-..patch\n  (bsc#1126503, CVE-2019-3828)\n\nChanges in ardana-ansible.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update to version 9.0+git.1591138508.e269bdb:\n  * Use internal endpoint for upload image (SOC-11294)\n\n- Update to version 9.0+git.1589740968.d339a28:\n  * Reconfigure rabbitmq user permissions on update (SOC-11082)\n\n- Update to version 9.0+git.1588953276.b8b5512:\n  * Fix incorrect prefix used to collect supportconfig files (bsc#1171273)\n\nChanges in ardana-cobbler.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update to version 9.0+git.1588181228.bae3b1f:\n  * Ensure distro_signatures.json gets updated if needed (SOC-11249)\n\nChanges in ardana-glance.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update to version 9.0+git.1593631708.9354a78:\n  * Idempotent cirros image upload to glance (SOC-11342)\n\nChanges in ardana-input-model.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update to version 9.0+git.1589740948.c24fc0b:\n  * Add default rabbitmq exchange write permissions (SOC-11082)\n\nChanges in ardana-logging.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update to version 9.0+git.1591193994.d93b668:\n  * kibana: set x-frame-options header (bsc#1171909)\n\nChanges in ardana-manila.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update to version 9.0+git.1594158642.b5905e4:\n  * Ensure manila_upgrade_mode is initialised appropriately (SOC-11341)\n\n- Update to version 9.0+git.1593516580.6c83767:\n  * Skip openstack-manila-share status check during upgrade (SOC-11341)\n\nChanges in ardana-monasca.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update to version 9.0+git.1589385256.7fbfaaf:\n  * Fix stop start/stop logic (SOC-11209)\n\n- Update to version 9.0+git.1588610558.98958f3:\n  * Fix monasca-thresh-wrapper status action (SOC-11209)\n\n- Update to version 9.0+git.1588343155.0e67455:\n  * monasca-thresh restart and storm upgrade enhancements (SOC-11209)\n\nChanges in ardana-mq.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update to version 9.0+git.1593618110.cbd1a37:\n  * Ensure epmd.service started/stopped independent of rabbitmq (SOC-6780)\n\n- Update to version 9.0+git.1589715197.9196f62:\n  * Don't mirror reply queues (SOC-10317)\n\nChanges in ardana-neutron.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update to version 9.0+git.1590756257.e09d54f:\n  * Update L3 rootwrap filters (SOC-11306)\n\nChanges in ardana-octavia.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update to version 9.0+git.1590079609.a2ae6ab:\n  * fix octavia to glance communication over internal endpoint (SOC-11294)\n\nChanges in ardana-tempest.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update to version 9.0+git.1593033709.9495bb2:\n  * load-balancer: set check timeout to 120 seconds (SOC-11330)\n\n- Update to version 9.0+git.1593010160.cb417d7:\n  * Blacklist neutron test_snat_external_ip test (SOC-11279)\n\n- Update to version 9.0+git.1592341936.3b5ad41:\n  * Remove blacklisted octavia test (SOC-11289)\n\n- Update to version 9.0+git.1592239656.b18289a:\n  * Blacklist NetworkMigration tests (SOC-11279)\n\n- Update to version 9.0+git.1590429931.4fa308a:\n  * Install only needed tempest pluguins (SOC-11297)\n\n- Update to version 9.0+git.1590164310.9e7888e:\n  * Enable tempest shelve tests (SOC-9775)\n\n- Update to version 9.0+git.1590151267.16bddd9:\n  * Add NetworkMigration tests back in neutron filter (SOC-11279)\n\n- Update to version 9.0+git.1589460689.e3bd243:\n  * Enable test_delete_policies_while_tenant_attached_to_net test (SOC-9235)\n\n- Update to version 9.0+git.1589206665.aedb17d:\n  * Blacklist some NetworkMigration tests (SOC-11279)\n\nChanges in crowbar-core.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update to version 6.0+git.1594619891.b75a61d0d:\n  * upgrade: Do not stop pacemaker managed apache service (SOC-11298)\n\n- Update to version 6.0+git.1593156244.533c05c01:\n  * Ignore CVE-2020-8184 (SOC-11299)\n\n- Update to version 6.0+git.1592589539.e0cbb8c8f:\n  * provisioner: allow tftp access from admin network only (bsc#1019111)\n\n- Update to version 6.0+git.1590650924.e7548b2ac:\n  * Ignore latest ruby-related CVEs in the CI (SOC-11299)\n\n- Update to version 6.0+git.1589803358.48ba3f4a6:\n  * provisioner: Fix ssh key validation (SOC-11126)\n\n- Update to version 6.0+git.1588062060.de79301bf:\n  * upgrade: disable zypper process check temporarily (SOC-11203)\n\nChanges in crowbar-openstack.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update to version 6.0+git.1591795073.49cb6400e:\n  * kibana: set x-frame-options header (bsc#1171909, CVE-2020-10743)\n\n- Update to version 6.0+git.1591104467.7de344556:\n  * Restore undeprecated nova dhcp_domain option (bsc#1171594)\n\n- Update to version 6.0+git.1590579980.5258ac04a:\n  * tempest: Enable shelve tests when using RBD ephemeral (SOC-11176)\n\n- Update to version 6.0+git.1589957131.fcfccecc1:\n  * galera: Make sure checks are executed without password (bsc#1136928)\n\n- Update to version 6.0+git.1589573559.3bf36a7cd:\n  * rabbitmq: sync startup definitions.json with recipe (SOC-11077,SOC-11274)\n\n- Update to version 6.0+git.1589544034.e52fd938a:\n  * trove: fix rabbitmq connection URL (SOC-11286)\n\n- Update to version 6.0+git.1589389407.5a306c6d3:\n  * tempest: remove port_admin_state_change workaround (SOC-10029)\n\n- Update to version 6.0+git.1588686448.3c0060ca7:\n  * Fix monasca libvirt ping checks (bsc#1107190)\n\n- Update to version 6.0+git.1588259003.a4e938422:\n  * run keystone_register on cluster founder only when HA (SOC-11248)\n  * ceilometer: Post API removal cleanup (SOC-10124)\n\n- Update to version 6.0+git.1588096476.79154bb30:\n  * nova: run keystone_register on cluster founder only (SOC-11243)\n\nChanges in grafana.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Add CVE-2020-13379.patch\n  * Security: fix unauthorized avatar proxying (bsc#1172409, CVE-2020-13379)\n\n- Add 0001-CVE-2020-12052-bsc1170657-XSS-annotation-popup-vulnerability.patch\n  * Security: Fix annotation popup XSS vulnerability\n    (bsc#1170657, CVE-2020-12052)\n\n- Add CVE-2019-15043.patch (SOC-10357, CVE-2019-15043, bsc#1148383)\n- Create plugin directory and clean up (create in %install,\n  add to %files) handling of /var/lib/grafana/* and\nChanges in kibana.SUSE_SLE-12-SP4_Update_Products_Cloud9:\n- Add 0001-Configurable-custom-response-headers-for-server.patch\n  (bsc#1171909, CVE-2020-10743)\n\nChanges in openstack-barbican.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- drop python-argparse buildrequires\n\nChanges in openstack-ceilometer.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update to version ceilometer-11.1.1.dev7:\n  * [stable-only] Add confluent-kafka to test-requirements\n\n- Update to version ceilometer-11.1.1.dev6:\n  * Temporary failures should be treated as temporary\n\nChanges in openstack-ceilometer.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update to version ceilometer-11.1.1.dev7:\n  * [stable-only] Add confluent-kafka to test-requirements\n\n- Update to version ceilometer-11.1.1.dev6:\n  * Temporary failures should be treated as temporary\n\nChanges in openstack-cinder.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update to version cinder-13.0.10.dev12:\n  * Remove VxFlex OS credentials from connection\\_properties\n\n- Update to version cinder-13.0.10.dev11:\n  * [stable only] Add warning about rbd\\_keyring\\_conf\n\n- Update to version cinder-13.0.10.dev10:\n  * VMAX Driver - Backport fix for Rocky and Queens\n\nChanges in openstack-cinder.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- drop obsolete python-argparse buildrequires\n\n- Update to version cinder-13.0.10.dev12:\n  * Remove VxFlex OS credentials from connection\\_properties\n\n- Update to version cinder-13.0.10.dev11:\n  * [stable only] Add warning about rbd\\_keyring\\_conf\n\n- Update to version cinder-13.0.10.dev10:\n  * VMAX Driver - Backport fix for Rocky and Queens\n\nChanges in openstack-dashboard.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update to version horizon-14.1.1.dev6:\n  * Fix tenant\\_id for a new port\n\n- Update to version horizon-14.1.1.dev5:\n  * Fix .zuul.yaml syntax errors\n  * Gate fix: use tempest-horizon 0.2.0 explicitly\n  * Authenticate before Authorization\n\nChanges in openstack-designate.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update to version designate-7.0.2.dev2:\n  * Worker should send NOTIFY also to all servers in 'also\\_notifies' pool settings\n\n- Update to version designate-7.0.2.dev1:\n  * Pin stable/rocky tempest tests to 0.7.0 tag\n  7.0.1\n\nChanges in openstack-designate.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update to version designate-7.0.2.dev2:\n  * Worker should send NOTIFY also to all servers in 'also\\_notifies' pool settings\n\n- Update to version designate-7.0.2.dev1:\n  * Pin stable/rocky tempest tests to 0.7.0 tag\n  7.0.1\n\nChanges in openstack-heat-templates.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update to version 0.0.0+git.1582270132.8a20477:\n  * Drop use of git.openstack.org\n  * Add example for running Zun container\n  * OpenDev Migration Patch\n  * Replace openstack.org git:// URLs with https://\n  * Add sample templates for Blazar\n  * Remove docs, deprecated hooks, tests\n  * Update the bugs link to storyboard\n  * Add an example of OS::Mistral::ExternalResource\n\nChanges in openstack-ironic.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update to version ironic-11.1.5.dev6:\n  * Fix issue where server fails to reboot\n\n- Update to version ironic-11.1.5.dev4:\n  * Fix SpanLength calculation for DRAC RAID configuration\n\nChanges in openstack-ironic.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update to version ironic-11.1.5.dev6:\n  * Fix issue where server fails to reboot\n\n- Update to version ironic-11.1.5.dev4:\n  * Fix SpanLength calculation for DRAC RAID configuration\n\nChanges in openstack-keystone.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update to version keystone-14.2.1.dev4:\n  * Fix security issues with EC2 credentials\n  * Ensure OAuth1 authorized roles are respected\n\n- Update to version keystone-14.2.1.dev2:\n  * Check timestamp of signed EC2 token request\n\n- Update to version keystone-14.2.1.dev1:\n  * Add cadf auditing to credentials\n  14.2.0\n\n\nChanges in openstack-keystone.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Remove patches (merged upstream)\n  * 0002-Check-timestamp-of-signed-EC2-token-request.patch\n  * 0002-Ensure-OAuth1-authorized-roles-are-respected.patch\n  * 0002-Fix-security-issues-with-EC2-credentials.patch\n\n- Update to version keystone-14.2.1.dev4:\n  * Fix security issues with EC2 credentials\n  * Ensure OAuth1 authorized roles are respected\n\n- Update to version keystone-14.2.1.dev2:\n  * Check timestamp of signed EC2 token request\n\n- Add security patches (bsc#1171070, bsc#1171071, bsc#1171072):\n  * 0002-Check-timestamp-of-signed-EC2-token-request.patch\n  * 0002-Ensure-OAuth1-authorized-roles-are-respected.patch\n  * 0002-Fix-security-issues-with-EC2-credentials.patch\n\n- Update to version keystone-14.2.1.dev1:\n  * Add cadf auditing to credentials\n  14.2.0\n\nChanges in openstack-magnum.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- drop obsolete python-argparse buildrequires\n\nChanges in openstack-manila.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update to version manila-7.4.2.dev31:\n  * [Unity]: Failed to delete cifs share if wrong access set\n\n- Update to version manila-7.4.2.dev29:\n  * [devstack][ci] Move bgp setup to plugin\n\n- Update to version manila-7.4.2.dev27:\n  * [devstack][ci] Modify firewall in ds-plugin\n\n- Update to version manila-7.4.2.dev25:\n  * [devstack][ci] Set public network ID in tempest.conf\n  * Make manila-tempest-plugin installation optional\n\n- Update to version manila-7.4.2.dev21:\n  * fix bug in consume from share\n\n- Update to version manila-7.4.2.dev19:\n  * Conditionally restore default route in setup\\_ipv6\n\n- Update to version manila-7.4.2.dev18:\n  * [NetApp] Fix driver to honor standard extra specs\n  * [NetApp] cDOT to set valid QoS during migration\n\n- Update to version manila-7.4.2.dev14:\n  * Remove provisioned calculation on non thin provision backends\n\n- Update to version manila-7.4.2.dev12:\n  * [NetApp] Fix share replica failing for 'transfer in progress' error\n  * [NetApp] Fix share shrink error status\n  * Delete type access list when deleting types\n  * fix bug in quota checking\n  * Prevent share type deletion if linked to group types\n\nChanges in openstack-manila.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- drop obsolete python-argparse buildrequires\n\n- Update to version manila-7.4.2.dev31:\n  * [Unity]: Failed to delete cifs share if wrong access set\n\n- Update to version manila-7.4.2.dev29:\n  * [devstack][ci] Move bgp setup to plugin\n\n- Update to version manila-7.4.2.dev27:\n  * [devstack][ci] Modify firewall in ds-plugin\n\n- Update to version manila-7.4.2.dev25:\n  * [devstack][ci] Set public network ID in tempest.conf\n  * Make manila-tempest-plugin installation optional\n\n- Update to version manila-7.4.2.dev21:\n  * fix bug in consume from share\n\n- Update to version manila-7.4.2.dev19:\n  * Conditionally restore default route in setup\\_ipv6\n\n- Update to version manila-7.4.2.dev18:\n  * [NetApp] Fix driver to honor standard extra specs\n  * [NetApp] cDOT to set valid QoS during migration\n\n- Update to version manila-7.4.2.dev14:\n  * Remove provisioned calculation on non thin provision backends\n\n- Update to version manila-7.4.2.dev12:\n  * [NetApp] Fix share replica failing for 'transfer in progress' error\n  * [NetApp] Fix share shrink error status\n  * Delete type access list when deleting types\n  * fix bug in quota checking\n  * Prevent share type deletion if linked to group types\n\nChanges in openstack-monasca-agent.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- update to version 2.8.2~dev5\n  - Fix libvirt ping_checks documentation\n\n- update to version 2.8.2~dev3\n  - Add debug output for libvirt ping checks\n\n- Lockdown /bin/ip permissions for the monasca-agent (bsc#1107190)\n  - add addtional arguments to /bin/ip in sudoers\n\n- Fix missing sudo privleges (bsc#1107190)\n  - add /bin/ip and /usr/bin/ovs-vsctl to monasca-agent sudoers\n\n- update to version 2.8.2~dev2\n  - Remove incorrect assignment of ping_cmd to 'True'\n  - Do not copy /sbin/ip to /usr/bin/monasa-agent-ip\n\nChanges in openstack-neutron.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update to version neutron-13.0.8.dev68:\n  * [DVR] Related routers should be included if are requested\n\n- Update to version neutron-13.0.8.dev67:\n  * [EM releases] Move non-voting jobs to the experimental queue\n  * [OVS] Make QoS OVS agent deletion operations more resilient\n  * Add 'igmp\\_snooping\\_enable' config option for OVS agent\n\n- Update to version neutron-13.0.8.dev61:\n  * Unnecessary routers should not be created\n  * Ensure that stale flows are cleaned from phys\\_bridges\n  * Do not block connection between br-int and br-phys on startup\n  * Improve log message when port losts its vlan tag\n  * [DVR] Reconfigure re-created physical bridges for dvr routers\n\n- Update to version neutron-13.0.8.dev52:\n  * Fix rocky gates, multiple fixes\n\n- Update to version neutron-13.0.8.dev51:\n  * Dynamically increase l3 router process queue green pool size\n\n- Update to version neutron-13.0.8.dev49:\n  * Allow usage of legacy 3rd-party interface drivers\n\n- Update to version neutron-13.0.8.dev47:\n  * Router synch shouldn't return unrelated routers\n\n- Update to version neutron-13.0.8.dev45:\n  * Only notify nova of port status changes if configured\n\n- Update to version neutron-13.0.8.dev44:\n  * Add Rocky milestone tag for alembic migration revisions\n\n- Update to version neutron-13.0.8.dev42:\n  * Cap pycodestyle to be \u003c 2.6.0\n  * Report L3 extensions enabled in the L3 agent's config\n\n- Update to version neutron-13.0.8.dev39:\n  * Adding LOG statements to debug 1838449\n\n- Update to version neutron-13.0.8.dev38:\n  * Improve VLAN allocations synchronization\n  * [L3 HA] Add 'no\\_track' option to VIPs in keepalived config\n  * Change ovs-agent iteration log level to INFO\n  * Refactor the L3 agent batch notifier\n  * Do not link up HA router gateway in backup node\n\nChanges in openstack-neutron.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update to version neutron-13.0.8.dev68:\n  * [DVR] Related routers should be included if are requested\n\n- Add 0001-Revert-Do-not-block-connection-between-br-int-and-br.patch (LP#1887148)\n\n- Update to version neutron-13.0.8.dev67:\n  * [EM releases] Move non-voting jobs to the experimental queue\n  * [OVS] Make QoS OVS agent deletion operations more resilient\n  * Add 'igmp\\_snooping\\_enable' config option for OVS agent\n\n- Update to version neutron-13.0.8.dev61:\n  * Unnecessary routers should not be created\n  * Ensure that stale flows are cleaned from phys\\_bridges\n  * Do not block connection between br-int and br-phys on startup\n  * Improve log message when port losts its vlan tag\n  * [DVR] Reconfigure re-created physical bridges for dvr routers\n\n- Update to version neutron-13.0.8.dev52:\n  * Fix rocky gates, multiple fixes\n\n- Update to version neutron-13.0.8.dev51:\n  * Dynamically increase l3 router process queue green pool size\n\n- Update to version neutron-13.0.8.dev49:\n  * Allow usage of legacy 3rd-party interface drivers\n\n- Update to version neutron-13.0.8.dev47:\n  * Router synch shouldn't return unrelated routers\n\n- Update to version neutron-13.0.8.dev45:\n  * Only notify nova of port status changes if configured\n\n- Update to version neutron-13.0.8.dev44:\n  * Add Rocky milestone tag for alembic migration revisions\n\n- Update to version neutron-13.0.8.dev42:\n  * Cap pycodestyle to be \u003c 2.6.0\n  * Report L3 extensions enabled in the L3 agent's config\n\n- Update to version neutron-13.0.8.dev39:\n  * Adding LOG statements to debug 1838449\n\n- Update to version neutron-13.0.8.dev38:\n  * Improve VLAN allocations synchronization\n  * [L3 HA] Add 'no\\_track' option to VIPs in keepalived config\n  * Change ovs-agent iteration log level to INFO\n  * Refactor the L3 agent batch notifier\n  * Do not link up HA router gateway in backup node\n\nChanges in openstack-neutron-vsphere.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- The networking-vsphere repo got moved from github to opendev.org.\n  We no longer able to automatically generate changelogs from\n  opendev.org as it doesn't provide the same API as github.\n  We'll need to manually update it from now on.\n- update to version 2.0.1~dev167\n  - Making networking-vsphere run under Python3\n  - OVSvApp Security Group Changes\n\nChanges in openstack-nova.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update to version nova-18.3.1.dev38:\n  * libvirt: Don't delete disks on shared storage during evacuate\n  * Add functional test for bug 1550919\n\n- Update to version nova-18.3.1.dev36:\n  * Fix os\\_CODENAME detection and repo refresh during ceph tests\n\n- Update to version nova-18.3.1.dev35:\n  * Update scheduler instance info at confirm resize\n\n- Update to version nova-18.3.1.dev33:\n  * Reproduce bug 1869050\n\n- Update to version nova-18.3.1.dev31:\n  * Revert 'nova shared storage: rbd is always shared storage'\n\n- Update to version nova-18.3.1.dev29:\n  * Clean up allocation if unshelve fails due to neutron\n  * Reset the cell cache for database access in Service\n  * Reproduce bug 1862633\n  * Make RBD imagebackend flatten method idempotent\n\n- Update to version nova-18.3.1.dev21:\n  * Add config option for neutron client retries\n\n- Update to version nova-18.3.1.dev19:\n  * Add retry to cinder API calls related to volume detach\n\n- Update to version nova-18.3.1.dev18:\n  * Lowercase ironic driver hash ring and ignore case in cache\n\nChanges in openstack-nova.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update to version nova-18.3.1.dev38:\n  * libvirt: Don't delete disks on shared storage during evacuate\n  * Add functional test for bug 1550919\n\n- Update to version nova-18.3.1.dev36:\n  * Fix os\\_CODENAME detection and repo refresh during ceph tests\n\n- Update to version nova-18.3.1.dev35:\n  * Update scheduler instance info at confirm resize\n\n- Update to version nova-18.3.1.dev33:\n  * Reproduce bug 1869050\n\n- Update to version nova-18.3.1.dev31:\n  * Revert 'nova shared storage: rbd is always shared storage'\n\n- Update to version nova-18.3.1.dev29:\n  * Clean up allocation if unshelve fails due to neutron\n  * Reset the cell cache for database access in Service\n  * Reproduce bug 1862633\n  * Make RBD imagebackend flatten method idempotent\n\n- Update to version nova-18.3.1.dev21:\n  * Add config option for neutron client retries\n\n- Update to version nova-18.3.1.dev19:\n  * Add retry to cinder API calls related to volume detach\n\n- Update to version nova-18.3.1.dev18:\n  * Lowercase ironic driver hash ring and ignore case in cache\n\nChanges in openstack-octavia.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update patch for SUSE distro support\n  * Fix osutils.py to handle secondary interfaces (SOC-11289)\n  * Add 020-amphora-logging.conf for configuring log targets\n\n- Update to version octavia-3.2.3.dev7:\n  * Fix the amphora noop driver\n  * Validate resource access when creating loadbalancer or member\n\n- Update to version octavia-3.2.3.dev3:\n  * Fix Rocky v2 scenario and grenade jobs\n\nChanges in openstack-octavia-amphora-image.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update image to 0.1.4 to include latest changes\n\nChanges in openstack-resource-agents.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update to version 1.0+git.1569436425.8b9c49f:\n  * Add a configurable delay to Nova Evacuate calls\n  * OpenDev Migration Patch\n  * NovaEvacuate: fix a syntax error\n  * NovaEvacuate: Support the new split-out IHA fence agents with backwards compatibility\n  * NovaEvacuate: Correctly handle stopped hypervisors\n  * neutron-ha-tool: do not replicate dhcp\n  * NovaCompute: Support parsing host option from /etc/nova/nova.conf.d\n  * NovaCompute: Use variable to avoid calling crudini a second time\n  * NovaEvacuate: Allow debug logging to be turned on easily\n\nChanges in python-Django1.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update to version 1.11.29 (bsc#1161919, CVE-2020-7471, bsc#1165022, CVE-2020-9402, bsc#1159447, CVE-2019-19844)\n  * Fixed CVE-2020-9402 -- Properly escaped tolerance parameter in GIS functions and aggregates on Oracle.\n  * Pinned PyYAML \u003c 5.3 in test requirements.\n  * Fixed CVE-2020-7471 -- Properly escaped StringAgg(delimiter) parameter.\n  * Fixed timezones tests for PyYAML 5.3+.\n  * Fixed CVE-2019-19844 -- Used verified user email for password reset requests.\n  * Fixed #31073 -- Prevented CheckboxInput.get_context() from mutating attrs.\n  * Fixed #30826 -- Fixed crash of many JSONField lookups when one hand side is key transform.\n  * Fixed #30769 -- Fixed a crash when filtering against a subquery JSON/HStoreField annotation.\n\n- Security fixes (bsc#1172167, bsc#1172166, CVE-2020-13254,  CVE-2020-13596)\n  * Added patch CVE-2020-13254.patch\n  * Added patch CVE-2020-13596.patch\n\nChanges in python-Pillow.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Add 010-Fix-OOB-reads-in-FLI-decoding.patch\n   * From upstream, backported\n   * Fixes CVE-2020-10177, bsc#1173413\n- Add 011-Fix-buffer-overflow-in-SGI-RLE-decoding.patch\n   * From upstream, backported\n   * Fixes CVE-2020-11538, bsc#1173420\n- Add 012-Fix-bounds-overflow-in-JPEG-2000-decoding.patch\n   * From upstream, backported\n   * Fixes CVE-2020-10994, bsc#1173418\n- Add 013-Fix-bounds-overflow-in-PCX-decoding.patch\n   * From upstream, backported\n   * Fixes CVE-2020-10378, bsc#1173416\n\n- Remove decompression_bomb.gif and relevant test case to avoid\n  ClamAV scan alerts during build\n\n- Add 001-Corrected-negative-seeks.patch\n   * From upstream, backported\n   * Fixes part of CVE-2019-16865, bsc#1153191\n- Add 002-Added-decompression-bomb-checks.patch\n   * From upstream, backported\n   * Fixes part of CVE-2019-16865, bsc#1153191\n- Add 003-Raise-error-if-dimension-is-a-string.patch\n   * From upstream, backported\n   * Fixes part of CVE-2019-16865, bsc#1153191\n- Add 004-Catch-buffer-overruns.patch\n   * From upstream, backported\n   * Fixes part of CVE-2019-16865, bsc#1153191\n- Add 005-Catch-PCX-P-mode-buffer-overrun.patch\n   * From upstream, backported\n   * Fixes CVE-2020-5312, bsc#1160152\n- Add 006-Catch-SGI-buffer-overruns.patch\n   * From upstream, backported\n   * Fixes CVE-2020-5311, bsc#1160151\n- Add 007-Ensure-previous-FLI-frame-is-loaded.patch\n   * From upstream, backported\n   * Fixes https://github.com/python-pillow/Pillow/issues/2649\n   * Uncovers CVE-2020-5313, bsc#1160153\n- Add 008-Catch-FLI-buffer-overrun.patch\n   * From upstream, backported\n   * Fixes CVE-2020-5313, bsc#1160153\n- Add 009-Invalid-number-of-bands-in-FPX-image.patch\n   * From upstream, backported\n   * Fixes CVE-2019-19911, bsc#1160192\n\nChanges in python-ardana-packager.SUSE_SLE-12-SP4_Update_Products_Cloud9:\n- fetch updated nova_host_aggregate from git\n - Add missing novaclient required domain entries (bsc#1174006)\n\n- update from git repo\n - Add missing novaclient required domain entries (bsc#1174006)\n\nChanges in python-heatclient.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- update to version 1.16.3\n  - Replace openstack.org git:// URLs with https://\n  - OpenDev Migration Patch\n\nChanges in python-neutron-tempest-plugin.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- added 0002-Ensure-that-external-network-dont-have-any-ports-before-deletion.patch\n\nChanges in python-octavia-tempest-plugin.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Fix broken compile options for httpd.bin\n\nChanges in python-os-brick.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Apply patches to resolve CVE-2020-10755 (bsc#1172522)\n - 0001-Remove-VxFlex-OS-credentials-from-connection_propert.patch\n - 0002-Fix-Remove-VxFlex-OS-credentials-regression.patch\n\nChanges in python-oslo.messaging.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- added 0001-Use-default-exchange-for-direct-messaging.patch\n  (SOC-11082, SOC-11274, bsc#1159046)\n\nChanges in python-pyroute2.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- update to 0.5.2\n    * ndb: read-only DB prototype\n    * remote: support communication via stdio\n    * general: fix async keyword -- Python 3.7 compatibility\n        * \u003chttps://github.com/svinota/pyroute2/issues/467\u003e\n        * \u003chttps://bugzilla.redhat.com/show_bug.cgi?id=1583800\u003e\n    * iproute: support monitoring on BSD systems via PF_ROUTE\n    * rtnl: support for SQL schema in message classes\n    * nl80211: improvements\n        * \u003chttps://github.com/svinota/pyroute2/issues/512\u003e\n        * \u003chttps://github.com/svinota/pyroute2/issues/514\u003e\n        * \u003chttps://github.com/svinota/pyroute2/issues/515\u003e\n    * netlink: support generators\n- update to 0.5.1\n    * ipdb: #310 -- route keying fix\n    * ipdb: #483, #484 -- callback internals change\n    * ipdb: #499 -- eventloop interface\n    * ipdb: #500 -- fix non-default :: routes\n    * netns: #448 -- API change: setns() doesn't remove FD\n    * netns: #504 -- fix resource leakage\n    * bsd: initial commits\n\n- update to 0.5.0\n    * ACHTUNG: ipdb commit logic is changed\n    * ipdb: do not drop failed transactions\n    * ipdb: #388 -- normalize IPv6 addresses\n    * ipdb: #391 -- support both IPv4 and IPv6 default routes\n    * ipdb: #392 -- fix MPLS route key reference\n    * ipdb: #394 -- correctly work with route priorities\n    * ipdb: #408 -- fix IPv6 routes in tables \u003e= 256\n    * ipdb: #416 -- fix VRF interfaces creation\n    * ipset: multiple improvements\n    * tuntap: #469 -- support s390x arch\n    * nlsocket: #443 -- fix socket methods resolve order for Python2\n    * netns: non-destructive `netns.create()`\n\nChanges in python-urllib3.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Skip test_source_address_error as we raise different error with\n  fixes that we provide in new python2/3\n- Update python-urllib3-recent-date.patch to have RECENT_DATE within\n  the needed boundaries for the test suite.\n\nChanges in python-waitress.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- update to 1.4.3 to include fixes for:\n  * CVE-2019-16785 / bsc#1161088\n  * CVE-2019-16786 / bsc#1161089\n  * CVE-2019-16789 / bsc#1160790\n  * CVE-2019-16792 / bsc#1161670\n\n- make sure UTF8 locale is used when runnning tests\n  * Sometimes functional tests executed in python3 failed if stdout was not\n    set to UTF-8. The error message was:\n      ValueError: underlying buffer has been detached\n\n- %python3_only -\u003e %python_alternative\n\n- update to 1.4.3\n  * Waitress did not properly validate that the HTTP headers it received\n    were properly formed, thereby potentially allowing a front-end server\n    to treat a request different from Waitress. This could lead to HTTP\n    request smuggling/splitting.\n- drop patch local-intersphinx-inventories.patch\n  * it was commented out, anyway\n\n- update to 1.4.0:\n  - Waitress used to slam the door shut on HTTP pipelined requests without\n  setting the ``Connection: close`` header as appropriate in the response. This\n  is of course not very friendly. Waitress now explicitly sets the header when\n  responding with an internally generated error such as 400 Bad Request or 500\n  Internal Server Error to notify the remote client that it will be closing the\n  connection after the response is sent.\n  - Waitress no longer allows any spaces to exist between the header field-name\n  and the colon. While waitress did not strip the space and thereby was not\n  vulnerable to any potential header field-name confusion, it should have sent\n  back a 400 Bad Request. See https://github.com/Pylons/waitress/issues/273\n  - CRLR handling Security fixes\n\n- update to 1.3.1\n  * Waitress won’t accidentally throw away part of the path if it\n    starts with a double slash\n\n- version update to 1.3.0\n  Deprecations\n  ~~~~~~~~~~~~\n  - The ``send_bytes`` adjustment now defaults to ``1`` and is deprecated\n    pending removal in a future release.\n    and https://github.com/Pylons/waitress/pull/246\n  Features\n  ~~~~~~~~\n  - Add a new ``outbuf_high_watermark`` adjustment which is used to apply\n    backpressure on the ``app_iter`` to avoid letting it spin faster than data\n    can be written to the socket. This stabilizes responses that iterate quickly\n    with a lot of data.\n    See https://github.com/Pylons/waitress/pull/242\n  - Stop early and close the ``app_iter`` when attempting to write to a closed\n    socket due to a client disconnect. This should notify a long-lived streaming\n    response when a client hangs up.\n    See https://github.com/Pylons/waitress/pull/238\n    and https://github.com/Pylons/waitress/pull/240\n    and https://github.com/Pylons/waitress/pull/241\n  - Adjust the flush to output ``SO_SNDBUF`` bytes instead of whatever was\n    set in the ``send_bytes`` adjustment. ``send_bytes`` now only controls how\n    much waitress will buffer internally before flushing to the kernel, whereas\n    previously it used to also throttle how much data was sent to the kernel.\n    This change enables a streaming ``app_iter`` containing small chunks to\n    still be flushed efficiently.\n    See https://github.com/Pylons/waitress/pull/246\n  Bugfixes\n  ~~~~~~~~\n  - Upon receiving a request that does not include HTTP/1.0 or HTTP/1.1 we will\n    no longer set the version to the string value 'None'. See\n    https://github.com/Pylons/waitress/pull/252 and\n    https://github.com/Pylons/waitress/issues/110\n  - When a client closes a socket unexpectedly there was potential for memory\n    leaks in which data was written to the buffers after they were closed,\n    causing them to reopen.\n    See https://github.com/Pylons/waitress/pull/239\n  - Fix the queue depth warnings to only show when all threads are busy.\n    See https://github.com/Pylons/waitress/pull/243\n    and https://github.com/Pylons/waitress/pull/247\n  - Trigger the ``app_iter`` to close as part of shutdown. This will only be\n    noticeable for users of the internal server api. In more typical operations\n    the server will die before benefiting from these changes.\n    See https://github.com/Pylons/waitress/pull/245\n  - Fix a bug in which a streaming ``app_iter`` may never cleanup data that has\n    already been sent. This would cause buffers in waitress to grow without\n    bounds. These buffers now properly rotate and release their data.\n    See https://github.com/Pylons/waitress/pull/242\n  - Fix a bug in which non-seekable subclasses of ``io.IOBase`` would trigger\n    an exception when passed to the ``wsgi.file_wrapper`` callback.\n    See https://github.com/Pylons/waitress/pull/249\n\n- Trim marketing wording and other platform mentions.\n\n- Add fetch-intersphinx-inventories.sh to sources\n- Add local-intersphinx-inventories.patch for generating the docs\n  correctly\n\n- update to version 1.2.1:\n  too many changes to list here, see:\n  https://github.com/Pylons/waitress/blob/master/CHANGES.txt\n  or even:\n  https://github.com/Pylons/waitress/commits/master\n\n- Remove superfluous devel dependency for noarch package\n\nChanges in rubygem-activeresource.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Add bsc#1171560-CVE-2020-8151-encode-id-param.patch\n  Prevent possible information disclosure issue that could allow\n  an attacker to create specially crafted requests to access data\n  in an unexpected way (bsc#1171560 CVE-2020-8151))_\n\nChanges in rubygem-json-1_7.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Add CVE-2020-10663.patch (CVE-2020-10663, bsc#1167244)\n\nChanges in rubygem-puma.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Fix indentation in gem2rpm.yml_\n\n- Add CVE-2020-11077.patch (bsc#1172175, CVE-2020-11077)\n- Add chunked-request-handling.patch (needed for CVE-2020-11076.patch)\n- Add CVE-2020-11076.patch (bsc#1172176, CVE-2020-11076)\n- Add all patches to gem2rpm.yml\n\nChanges in release-notes-suse-openstack-cloud.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:\n- Update to version 9.20200610:\n  * Terraform support validation release note added (SOC-11314)\n\n- Update to version 9.20200504:\n  * language change for accuracy - MANAGEMENT network group (SOC-10106)\n  * add limitation about MANAGEMENT network group (SOC-10106)\n\n- Update to version 9.20200429:\n  * Mark identity api v2 as deprecated (bsc#1163446)\n\n- Update to version 9.20200428:\n  * Update release notes to indicate Octavia support has shipped (SOC-11241)\n  ","status":"published","published":"2020-08-06T22:09:12Z","modified":"2026-02-04T03:29:55.085664Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2020:1901-1","title":"Security update for ansible, ansible1, ardana-ansible, ardana-cluster, ardana-freezer, ardana-input-model, ardana-logging, ardana-mq, ardana-neutron, ardana-octavia, ardana-osconfig, caasp-openstack-heat-templates, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, kibana, openstack-dashboard, openstack-dashboard-theme-HPE, openstack-heat-templates, openstack-keystone, openstack-monasca-agent, openstack-monasca-installer, openstack-neutron, openstack-octavia-amphora-image, python-Django, python-Flask, python-GitPython, python-Pillow, python-amqp, python-apicapi, python-keystoneauth1, python-oslo.messaging, python-psutil, python-pyroute2, python-pysaml2, python-tooz, python-waitress, storm","description":"This update for ansible, ansible1, ardana-ansible, ardana-cluster, ardana-freezer, ardana-input-model, ardana-logging, ardana-mq, ardana-neutron, ardana-octavia, ardana-osconfig, caasp-openstack-heat-templates, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, kibana, openstack-dashboard, openstack-dashboard-theme-HPE, openstack-heat-templates, openstack-keystone, openstack-monasca-agent, openstack-monasca-installer, openstack-neutron, openstack-octavia-amphora-image, python-Django, python-Flask, python-GitPython, python-Pillow, python-amqp, python-apicapi, python-keystoneauth1, python-oslo.messaging, python-psutil, python-pyroute2, python-pysaml2, python-tooz, python-waitress, storm contains the following fixes:\n\nThe update fixes several security issues:\n\nansible\n- CVE-2019-3828: Fixed a path traversal in the fetch module (bsc#1126503).\n\ngrafana\n- CVE-2020-13379: Fixed an incorrect access control issue which could lead to information\n  leaks or denial of service (bsc#1172409).\n- CVE-2020-12052: Fixed an cross site scripting vulnerability related to the annotation\n  popup (bsc#1170657).\n\nkibana\n- CVE-2020-10743: Fixed a clickjacking vulnerability (bsc#1171909).\n\npython-Django\n- CVE-2020-13254: Fixed a data leakage via malformed memcached keys. (bsc#1172167)\n- CVE-2020-13596: Fixed a cross site scripting vulnerability related to the admin\n  parameters of the ForeignKeyRawIdWidget. (bsc#1172166)\n\npython-Flask\n- CVE-2019-1010083: Fixed a denial of service via crafted encoded JSON. (bsc#1141968)\n\n\npython-Pillow\n- CVE-2019-16865: Fixed a denial of service with specially crafted\nimage files. (bsc#1153191)\n- CVE-2020-5312: Fixed a buffer overflow in the PCX P mode. (bsc#1160152)\n- CVE-2020-5313: Fixed a buffer overflow related to FLI. (bsc#1160153)\n- CVE-2019-19911: Fixed a denial of service in FpxImagePlugin.py. (bsc#1160192)\n\npython-psutil\n- CVE-2019-18874: Fixed a double free caused by refcount mishandling. (bsc#1156525)\n\npython-pysaml2\n- CVE-2020-5390: Fixed an issue with the verification of signatures in SAML documents.\n  (bsc#1160851)\n- CVE-2017-1000246: Fixed an issue with  weak encryption data, caused by initialization\n  vector reuse. (bsc#1068612)\n\npython-waitress (to version 1.4.3)\n- CVE-2019-16785: Fixed HTTP request smuggling through LF vs CRLF handling. (bsc#1161088)\n- CVE-2019-16786: Fixed HTTP request smuggling through invalid Transfer-Encoding.\n  (bsc#1161089)\n- CVE-2019-16789: Fixed HTTP Request Smuggling through Invalid whitespace characters.\n  (bsc#1160790)\n- CVE-2019-16792: Fixed HTTP Request Smuggling through Content-Length header handling.\n  (bsc#1161670)\n\nrubygem-activeresource\n- CVE-2020-8151: Fixed information disclosure issue via specially crafted requests.\n  (bsc#1171560)\n\nrubygem-json-1_7\n- CVE-2020-10663: Fixed an unsafe object creation vulnerability. (bsc#1167244)\n\nrubygem-puma\n- CVE-2020-11077: Fixed a HTTP smuggling issue related to proxy usage. (bsc#1172175)\n- CVE-2020-11076: Fixed a HTTP smuggling issue when using an invalid transfer-encoding\n  header. (bsc#1172176)\n\n\n\nOther non-security fixes in in the update below:\n\nChanges in ansible:\n- Add 0001-Disallow-use-of-remote-home-directories-containing-..patch\n  (bsc#1126503, CVE-2019-3828)\n\nChanges in ansible1:\n- Add 0001-Disallow-use-of-remote-home-directories-containing-..patch\n  (bsc#1126503, CVE-2019-3828)\n\nChanges in ardana-ansible:\n- Update to version 8.0+git.1589740980.6c3bcdc:\n  * Reconfigure rabbitmq user permissions on update (SOC-11082)\n\n- Update to version 8.0+git.1588953487.9bfd5cb:\n  * Fix incorrect prefix used to collect supportconfig files (bsc#1171273)\n\n- Update to version 8.0+git.1585690828.81d8f45:\n  * Cleanup keystone-ansible (bsc#1108719)\n\nChanges in ardana-cluster:\n- Update to version 8.0+git.1585685203.3e71e49:\n  * Use bool filter to ensure valid boolean evaluation (SOC-11192)\n\nChanges in ardana-freezer:\n- Update to version 8.0+git.1586539529.b7d295f:\n  * Recovering Cloud8 using Freezer or SSH backups if upgrade fails (SOC-10137)\n\nChanges in ardana-input-model:\n- Update to version 8.0+git.1589740934.0e0ad61:\n  * Add default rabbitmq exchange write permissions (SOC-11082)\n\n- Update to version 8.0+git.1586174594.2b92ec3:\n  * add port neutron security extension to CI models (SOC-11027)\n\nChanges in ardana-logging:\n- Update to version 8.0+git.1591194866.b7375d0:\n  * kibana: set x-frame-options header (bsc#1171909)\n\n- Update to version 8.0+git.1586179244.ae61f62:\n  * Fix YAMLLoadWarning: calling yaml.load() without Loader (bsc#1168593)\n\nChanges in ardana-mq:\n- Update to version 8.0+git.1589715269.62ad6df:\n  * Don't mirror reply queues (SOC-10317)\n\n- Update to version 8.0+git.1586784724.586343d:\n  * Actually fail if sync HA queues retries exceeded (SOC-11083)\n\nChanges in ardana-neutron:\n- Update to version 8.0+git.1590756744.ba84abc:\n  * Update L3 rootwrap filters (SOC-11306)\n\n- Update to version 8.0+git.1587737509.4e09de3:\n  * Add network.target 'After' option (bsc#1169770)\n\n- Update to version 8.0+git.1586546152.e7bc07f:\n  * Add neutron-common role dependencies (SOC-10875)\n\n- Update to version 8.0+git.1586543712.62bb5a3:\n  * Fix neutron-ovsvapp-agent status (SOC-10637)\n\n- Update to version 8.0+git.1586535447.55769df:\n  * Improve neutron service restart limit handling (SOC-8746)\n\n- Update to version 8.0+git.1586519528.a28db53:\n  * Correctly setup ardana_notify_... fact (SOC-10902)\n\nChanges in ardana-octavia:\n- Update to version 8.0+git.1590100427.cf4cc8f:\n  * fix octavia to glance communication over internal endpoint (SOC-11294)\n\nChanges in ardana-osconfig:\n- Update to version 8.0+git.1587034587.eac37b8:\n  * Include SLE 12 SP3 LTSS repos in list of managed repos (SOC-11223)\n\nChanges in caasp-openstack-heat-templates:\n- Switch github URL from git@ to git:// to bypass authentication\n\nChanges in crowbar-core:\n- Update to version 5.0+git.1593156248.55bbdb26d:\n  * Ignore CVE-8184 (SOC-11299)\n  * Ignore latest ruby-related CVEs in the CI (SOC-11299)\n\n- Update to version 5.0+git.1589804984.44a89be24:\n  * provisioner: Fix ssh key validation (SOC-11126)\n  * assign host to hostless keys (noref)\n\nChanges in crowbar-openstack:\n- Update to version 5.0+git.1593085772.64c4ab43c:\n  * monasca: Prevent deploying monasca-server to the node in pacemaker cluster (SOC-6354)\n\n- Update to version 5.0+git.1591171674.1f299cd1c:\n  * Restore undeprecated nova dhcp_domain option (bsc#1171594)\n\n- Update to version 5.0+git.1591104265.683d76534:\n  * [5.0] Fix availability zone script (bsc#1171661)\n\n- Update to version 5.0+git.1590398068.f5cfacc12:\n  * nova: only create nonexistent cell1\n\n- Update to version 5.0+git.1590150829.e86326d03:\n  * [5.0] Tempest: enable test_volume_boot_pattern test (SOC-10874)\n\n- Update to version 5.0+git.1589814633.23fde86ab:\n  * rabbitmq: sync startup definitions.json with recipe (SOC-11077,SOC-11274)\n\n- Update to version 5.0+git.1589647291.73c7f1cb6:\n  * [5.0] trove: fix rabbitmq connection URL (SOC-11286)\n\n- Update to version 5.0+git.1589214669.8332efff3:\n  * Fix monasca libvirt ping checks (bsc#1107190)\n\n- Update to version 5.0+git.1588271874.90adebc7a:\n  * run keystone_register on cluster founder only when HA (SOC-11248)\n  * nova: run keystone_register on cluster founder only (SOC-11243)\n\n- Update to version 5.0+git.1588059034.3823515b7:\n  * tempest: retry openstack commands (SOC-11238)\n\n- Update to version 5.0+git.1587403360.c43cd9905:\n  * tempest: disable block migration when using RBD (SOC-11176)\n\n- Update to version 5.0+git.1586293860.901cb0f55:\n  * monasca: disable postgres backend monitoring by default (SOC-11190)\n\n- Update to version 5.0+git.1585659861.c29fac257:\n  * magnum: Populate SSL configuration (SOC-9849)\n  * magnum: Add SSL support (SOC-9849)\n  * nova: Populate cinder SES settings early (SOC-11179)\n\nChanges in documentation-suse-openstack-cloud:\n- Update to version 8.20200527:\n  * Update Travis config: new container name (noref)\n\n- Update to version 8.20200417:\n  * Recovering Cloud8 using Freezer or SSH backups if upgrade fails (SOC-10137)\n\n- Update to version 8.20200326:\n  * Clarify wipe_disks does not affect non-OS partitions (bsc#1092420)\n\nChanges in grafana:\n- Add CVE-2020-13379.patch\n  * Security: fix unauthorized avatar proxying (bsc#1172409, CVE-2020-13379)\n- Refresh systemd-notification.patch\n- Fix declaration for LICENSE\n\n- Add 0002-CVE-2020-12052-bsc1170657-XSS-annotation-popup-vulnerability.patch\n  * Security: Fix annotation popup XSS vulnerability\n    (bsc#1170657)\n\n- Add CVE-2019-15043.patch (SOC-10357, CVE-2019-15043, bsc#11483483)\nChanges in kibana:\n- Add 0001-Configurable-custom-response-headers-for-server.patch\n  (bsc#1171909, CVE-2020-10743)\n\nChanges in openstack-dashboard:\n- Update to version horizon-12.0.5.dev3:\n  * Fix typo in publicize\\_image policy name\n\nChanges in openstack-dashboard-theme-HPE:\n- Switch github URL from git@ to https:// to bypass authentication\n\nChanges in openstack-heat-templates:\n- Update to version 0.0.0+git.1582270132.8a20477:\n  * Drop use of git.openstack.org\n  * Add sample templates for Blazar\n\nChanges in openstack-keystone:\n- Update to version keystone-12.0.4.dev11:\n  * Fix security issues with EC2 credentials\n\n- Update to version keystone-12.0.4.dev10:\n  * Check timestamp of signed EC2 token request\n  * Ensure OAuth1 authorized roles are respected\n\n- Update to version keystone-12.0.4.dev6:\n  * Remove neutron-grenade job\n\nChanges in openstack-keystone:\n- Update to version keystone-12.0.4.dev11:\n  * Fix security issues with EC2 credentials\n\n- Update to version keystone-12.0.4.dev10:\n  * Check timestamp of signed EC2 token request\n  * Ensure OAuth1 authorized roles are respected\n\n- Update to version keystone-12.0.4.dev6:\n  * Remove neutron-grenade job\n\nChanges in openstack-monasca-agent:\n- update to version 2.2.6~dev4\n  - Add debug output for libvirt ping checks\n\n- Lockdown /bin/ip permissions for the monasca-agent (bsc#1107190)\n  - add addtional arguments to /bin/ip in sudoers\n\n- Fix missing sudo privleges (bsc#1107190)\n  - add /bin/ip and /usr/bin/ovs-vsctl to monasca-agent sudoers\n\n- removed 0001-Avoid-overwriting-sys.path-ip-command.patch\n- update to version 2.2.6~dev3\n  - Do not copy /sbin/ip to /usr/bin/monasa-agent-ip\n\n- update to version 2.2.6~dev2\n  - Remove incorrect assignment of ping_cmd to 'True'\n\n- update to version 2.2.6~dev1\n  - Update hacking version to 1.1.x\n\nChanges in openstack-monasca-installer:\n- Add 0001-kibana:-set-x-frame-options-header.patch (bsc#1171909,\n  CVE-2020-10743)\n\nChanges in openstack-neutron:\n- Update to version neutron-11.0.9.dev65:\n  * Revert iptables TCP checksum-fill code\n\n- Update to version neutron-11.0.9.dev64:\n  * [Pike-only]: make grenade jobs non-voting\n\nChanges in openstack-neutron:\n- Update to version neutron-11.0.9.dev65:\n  * Revert iptables TCP checksum-fill code\n\n- Update to version neutron-11.0.9.dev64:\n  * [Pike-only]: make grenade jobs non-voting\n\nChanges in openstack-octavia-amphora-image:\n- Update image to 0.1.4 to include latest changes\n\nChanges in python-Django:\n- Security fixes (bsc#1172167, bsc#1172166, CVE-2020-13254,  CVE-2020-13596)\n  * Added patch CVE-2020-13254-1.8.19.patch\n  * Added patch CVE-2020-13596-1.8.19.patch\n\nChanges in python-Flask:\n- Apply patch to resolve CVE-2019-1010083 (bsc#1141968)\n  - 0001-detect-UTF-encodings-when-loading-json.patch\n\nChanges in python-GitPython:\n- Require git-core instead of git\n\nChanges in python-Pillow:\n- Remove decompression_bomb.gif and relevant test case to avoid\n  ClamAV scan alerts during build\n\n- Add 001-Corrected-negative-seeks.patch\n   * From upstream, backported\n   * Fixes part of CVE-2019-16865, bsc#1153191\n- Add 002-Added-DecompressionBombError.patch\n   * From upstream, backported\n   * Adds DecompressionBombError class\n   * Used by 003-Added-decompression-bomb-checks.patch\n- Add 003-Added-decompression-bomb-checks.patch\n   * From upstream, backported\n   * Fixes part of CVE-2019-16865, bsc#1153191\n- Add 004-Raise-error-if-dimension-is-a-string.patch\n   * From upstream, backported\n   * Fixes part of CVE-2019-16865, bsc#1153191\n- Add 005-Catch-buffer-overruns.patch\n   * From upstream, backported\n   * Fixes part of CVE-2019-16865, bsc#1153191\n- Add 006-Catch-PCX-P-mode-buffer-overrun.patch\n   * From upstream, backported\n   * Fixes CVE-2020-5312, bsc#1160152\n- Add 007-Test-animated-FLI-file.patch\n   * From upstream, backported\n   * Adds test animated FLI file\n   * Used by 008-Ensure-previous-FLI-frame-is-loaded.patch\n- Add 008-Ensure-previous-FLI-frame-is-loaded.patch\n   * From upstream, backported\n   * Fixes https://github.com/python-pillow/Pillow/issues/2649\n   * Uncovers CVE-2020-5313, bsc#1160153\n- Add 009-Catch-FLI-buffer-overrun.patch\n   * From upstream, backported\n   * Fixes CVE-2020-5313, bsc#1160153\n- Add 010-Invalid-number-of-bands-in-FPX-image.patch\n   * From upstream, backported\n   * Fixes CVE-2019-19911, bsc#1160192\n\nChanges in python-amqp:\n- Add python-devel as build dependecy\n  * Required when building against python 2.7.17\n\nChanges in python-apicapi:\n- Add python-devel as build dependecy\n  * Required when building against python 2.7.17\n\nChanges in python-keystoneauth1:\n- switch to tracking stable/pike tarball\n- disable renderspec\n- update to version 3.1.2.dev2\n  - Make tests pass in 2020\n  - OpenDev Migration Patch\n  - import zuul job settings from project-config into stable/pike\n  - Remove tox_install.sh\n  - import zuul job settings from project-config\n  - Update UPPER_CONSTRAINTS_FILE for stable/pike into stable/pike\n  - Update .gitreview for stable/pike into stable/pike\n  - Updated from global requirements\n  - Update UPPER_CONSTRAINTS_FILE for stable/pike\n  - Update .gitreview for stable/pike\n\nChanges in python-oslo.messaging:\n- added 0001-Use-default-exchange-for-direct-messaging.patch\n  (SOC-11082, SOC-11274, bsc#1159046)\n\n- Add 0001-Retry-to-declare-a-queue-after-internal-error.patch (bsc#1123872)\n   After receiving 'AMQP internal error 541', retry to create the queue after a delay.\n\nChanges in python-psutil:\n- Add bsc1156525-CVE-2019-18874.patch (bsc#1156525, CVE-2019-18874))\n\nChanges in python-pyroute2:\n- netns: fix NetNS resource leakage (#504) (bsc#1164322)\n\nChanges in python-pysaml2:\n- Add 0001-Always-generate-a-random-IV-for-AES-operations.patch\n  (CVE-2017-1000246, bsc#1068612)\n\n- Add 0001-Fix-XML-Signature-Wrapping-XSW-vulnerabilities.patch\n  (CVE-2020-5390, bsc#1160851)\n\nChanges in python-tooz:\n- update to version 1.58.1\n  - Update .gitreview for stable/pike\n  - import zuul job settings from project-config\n  - Add doc/requirements.txt\n  - Fix sphinx-docs job for stable branch\n\nChanges in python-waitress:\n- update to 1.4.3 to include fixes for:\n  * CVE-2019-16785 / bsc#1161088\n  * CVE-2019-16786 / bsc#1161089\n  * CVE-2019-16789 / bsc#1160790\n  * CVE-2019-16792 / bsc#1161670\n\n- make sure UTF8 locale is used when runnning tests\n  * Sometimes functional tests executed in python3 failed if stdout was not\n    set to UTF-8. The error message was:\n      ValueError: underlying buffer has been detached\n\n- %python3_only -\u003e %python_alternative\n\n- update to 1.4.3\n  * Waitress did not properly validate that the HTTP headers it received\n    were properly formed, thereby potentially allowing a front-end server\n    to treat a request different from Waitress. This could lead to HTTP\n    request smuggling/splitting.\n- drop patch local-intersphinx-inventories.patch\n  * it was commented out, anyway\n\n- update to 1.4.0:\n  - Waitress used to slam the door shut on HTTP pipelined requests without\n  setting the ``Connection: close`` header as appropriate in the response. This\n  is of course not very friendly. Waitress now explicitly sets the header when\n  responding with an internally generated error such as 400 Bad Request or 500\n  Internal Server Error to notify the remote client that it will be closing the\n  connection after the response is sent.\n  - Waitress no longer allows any spaces to exist between the header field-name\n  and the colon. While waitress did not strip the space and thereby was not\n  vulnerable to any potential header field-name confusion, it should have sent\n  back a 400 Bad Request. See https://github.com/Pylons/waitress/issues/273\n  - CRLR handling Security fixes\n\n- update to 1.3.1\n  * Waitress won’t accidentally throw away part of the path if it\n    starts with a double slash\n\n- version update to 1.3.0\n  Deprecations\n  ~~~~~~~~~~~~\n  - The ``send_bytes`` adjustment now defaults to ``1`` and is deprecated\n    pending removal in a future release.\n    and https://github.com/Pylons/waitress/pull/246\n  Features\n  ~~~~~~~~\n  - Add a new ``outbuf_high_watermark`` adjustment which is used to apply\n    backpressure on the ``app_iter`` to avoid letting it spin faster than data\n    can be written to the socket. This stabilizes responses that iterate quickly\n    with a lot of data.\n    See https://github.com/Pylons/waitress/pull/242\n  - Stop early and close the ``app_iter`` when attempting to write to a closed\n    socket due to a client disconnect. This should notify a long-lived streaming\n    response when a client hangs up.\n    See https://github.com/Pylons/waitress/pull/238\n    and https://github.com/Pylons/waitress/pull/240\n    and https://github.com/Pylons/waitress/pull/241\n  - Adjust the flush to output ``SO_SNDBUF`` bytes instead of whatever was\n    set in the ``send_bytes`` adjustment. ``send_bytes`` now only controls how\n    much waitress will buffer internally before flushing to the kernel, whereas\n    previously it used to also throttle how much data was sent to the kernel.\n    This change enables a streaming ``app_iter`` containing small chunks to\n    still be flushed efficiently.\n    See https://github.com/Pylons/waitress/pull/246\n  Bugfixes\n  ~~~~~~~~\n  - Upon receiving a request that does not include HTTP/1.0 or HTTP/1.1 we will\n    no longer set the version to the string value 'None'. See\n    https://github.com/Pylons/waitress/pull/252 and\n    https://github.com/Pylons/waitress/issues/110\n  - When a client closes a socket unexpectedly there was potential for memory\n    leaks in which data was written to the buffers after they were closed,\n    causing them to reopen.\n    See https://github.com/Pylons/waitress/pull/239\n  - Fix the queue depth warnings to only show when all threads are busy.\n    See https://github.com/Pylons/waitress/pull/243\n    and https://github.com/Pylons/waitress/pull/247\n  - Trigger the ``app_iter`` to close as part of shutdown. This will only be\n    noticeable for users of the internal server api. In more typical operations\n    the server will die before benefiting from these changes.\n    See https://github.com/Pylons/waitress/pull/245\n  - Fix a bug in which a streaming ``app_iter`` may never cleanup data that has\n    already been sent. This would cause buffers in waitress to grow without\n    bounds. These buffers now properly rotate and release their data.\n    See https://github.com/Pylons/waitress/pull/242\n  - Fix a bug in which non-seekable subclasses of ``io.IOBase`` would trigger\n    an exception when passed to the ``wsgi.file_wrapper`` callback.\n    See https://github.com/Pylons/waitress/pull/249\n\n- Trim marketing wording and other platform mentions.\n\n- Add fetch-intersphinx-inventories.sh to sources\n- Add local-intersphinx-inventories.patch for generating the docs\n  correctly\n\n- update to version 1.2.1:\n  too many changes to list here, see:\n  https://github.com/Pylons/waitress/blob/master/CHANGES.txt\n  or even:\n  https://github.com/Pylons/waitress/commits/master\n\n- Remove superfluous devel dependency for noarch package\n\n- update to version 1.1.0:\n  * Features\n    + Waitress now has a __main__ and thus may be called with 'python\n      -mwaitress'\n  * Bugfixes\n    + Waitress no longer allows lowercase HTTP verbs. This change was\n      made to fall in line with most HTTP servers. See\n      https://github.com/Pylons/waitress/pull/170\n    + When receiving non-ascii bytes in the request URL, waitress will\n      no longer abruptly close the connection, instead returning a 400\n      Bad Request. See https://github.com/Pylons/waitress/pull/162 and\n      https://github.com/Pylons/waitress/issues/64\n\n- Update to 1.0.2\n  * Python 3.6 is now officially supported in Waitress\n  * Add a work-around for libc issue on Linux not following the\n    documented standards. If getnameinfo() fails because of DNS not\n    being available it should return the IP address instead of the\n    reverse DNS entry, however instead getnameinfo() raises. We\n    catch this, and ask getnameinfo() for the same information\n    again, explicitly asking for IP address instead of reverse\n    DNS hostname.\n- Implement single-spec version.\n- Fix source URL.\n\n- update to 1.0.1:\n  - IPv6 support on Windows was broken due to missing constants in the socket\n    module. This has been resolved by setting the constants on Windows if they\n    are missing. See https://github.com/Pylons/waitress/issues/138\n  - A ValueError was raised on Windows when passing a string for the port, on\n    Windows in Python 2 using service names instead of port numbers doesn't work\n    with `getaddrinfo`. This has been resolved by attempting to convert the port\n    number to an integer, if that fails a ValueError will be raised. See\n    https://github.com/Pylons/waitress/issues/139\n  - Removed `AI_ADDRCONFIG` from the call to `getaddrinfo`, this resolves an\n    issue whereby `getaddrinfo` wouldn't return any addresses to `bind` to on\n    hosts where there is no internet connection but localhost is requested to be\n    bound to. See https://github.com/Pylons/waitress/issues/131 for more\n    information.\n- disable tests. need network access.\n\nChanges in storm:\n- update to 1.1.3:\n  * 1.1.3:\n    * [STORM-3026] - Upgrade ZK instance for security\n    * [STORM-3027] - Make Impersonation Optional\n    * [STORM-3011] - Use default bin path in flight.bash if $JAVA_HOME is undefined\n    * [STORM-3039] - Ports of killed topologies remain in TIME_WAIT state preventing to start new topology\n    * [STORM-2911] - SpoutConfig is serializable but does not declare a serialVersionUID field\n    * [STORM-2978] - The fix for STORM-2706 is broken, and adds a transitive dependency on Zookeeper 3.5.3-beta for projects that depend on e.g. storm-kafka\n    * [STORM-2979] - WorkerHooks EOFException during run_worker_shutdown_hooks\n    * [STORM-2981] - Upgrade Curator to lastest patch version\n    * [STORM-2985] - Add jackson-annotations to dependency management\n    * [STORM-2989] - LogCleaner should preserve current worker.log.metrics\n    * [STORM-2994] - KafkaSpout consumes messages but doesn't commit offsets\n    * [STORM-3043] - NullPointerException thrown in SimpleRecordTranslator.apply()\n    * [STORM-3052] - Let blobs un archive\n    * [STORM-3059] - KafkaSpout throws NPE when hitting a null tuple if the processing guarantee is not AT_LEAST_ONCE\n    * [STORM-2960] - Better to stress importance of setting up proper OS account for Storm processes\n    * [STORM-3060] - Configuration mapping between storm-kafka \u0026 storm-kafka-client\n    * [STORM-2952] - Deprecate storm-kafka in 1.x\n    * [STORM-3005] - [DRPC] LinearDRPCTopologyBuilder shouldn't be deprecated\n    * [STORM-2841] - testNoAcksIfFlushFails UT fails with NullPointerException\n  * 1.1.2:\n    * [STORM-2512] - Change KafkaSpoutConfig in storm-kafka-client to make it work with flux\n    * [STORM-2616] - Document the built in metrics (just in time to replace them???)\n    * [STORM-2657] - Update SECURITY.MD\n    * [STORM-2663] - Backport STORM-2558 and deprecate storm.cmd on 1.x-branch\n    * [STORM-2712] - accept arbitrary number of rows per tuple in storm-cassandra\n    * [STORM-2775] - Improve KafkaPartition Metric Names\n    * [STORM-2807] - Integration test should shut down topologies immediately after the test\n    * [STORM-2862] - More flexible logging in multilang (Python, Ruby, JS)\n    * [STORM-2877] - Introduce an option to configure pagination in Storm UI\n    * [STORM-2917] - Check the config(nimbus.host) before using it to connect\n    * [STORM-2231] - NULL in DisruptorQueue while multi-threaded ack\n    * [STORM-2426] - First tuples fail after worker is respawn\n    * [STORM-2500] - waitUntilReady in PacemakerClient cannot be invoked\n    * [STORM-2525] - Fix flaky integration tests\n    * [STORM-2535] - test-reset-timeout is flaky. Replace with a more reliable test.\n    * [STORM-2541] - Manual partition assignment doesn't work\n    * [STORM-2607] - [kafka-client] Consumer group every time with lag 1\n    * [STORM-2642] - Storm-kafka-client spout cannot be serialized when using manual partition assignment\n    * [STORM-2660] - The Nimbus storm-local directory is relative to the working directory of the shell executing 'storm nimbus'\n    * [STORM-2666] - Storm-kafka-client spout can sometimes emit messages that were already committed.\n    * [STORM-2674] - NoNodeException when ZooKeeper tries to delete nodes\n    * [STORM-2677] - consider all sampled tuples which took greater than 0 ms processing time\n    * [STORM-2682] - Supervisor crashes with NullPointerException\n    * [STORM-2690] - resurrect invocation of ISupervisor.assigned() \u0026 make Supervisor.launchDaemon() accessible\n    * [STORM-2695] - BlobStore uncompress argument should be Boolean\n    * [STORM-2705] - DRPCSpout sleeps twice when idle\n    * [STORM-2706] - Nimbus stuck in exception and does not fail fast\n    * [STORM-2724] - ExecutorService in WaterMarkEventGenerator never shutdown\n    * [STORM-2736] - o.a.s.b.BlobStoreUtils [ERROR] Could not update the blob with key\n    * [STORM-2750] - fix double_checked locking\n    * [STORM-2751] - Remove AsyncLoggingContext from Supervisor\n    * [STORM-2764] - HDFSBlobStore leaks file system objects\n    * [STORM-2769] - Fast-fail if output stream Id is null\n    * [STORM-2771] - Some tests are being run twice\n    * [STORM-2779] - NPE on shutting down WindowedBoltExecutor\n    * [STORM-2786] - Ackers leak tracking info on failure and lots of other cases.\n    * [STORM-2810] - Storm-hdfs tests are leaking resources\n    * [STORM-2811] - Nimbus may throw NPE if the same topology is killed multiple times, and the integration test kills the same topology multiple times\n    * [STORM-2814] - Logviewer HTTP server should return 403 instead of 200 if the user is unauthorized\n    * [STORM-2815] - UI HTTP server should return 403 if the user is unauthorized\n    * [STORM-2833] - Cached Netty Connections can have different keys for the same thing.\n    * [STORM-2853] - Deactivated topologies cause high cpu utilization\n    * [STORM-2855] - Travis build doesn't work after update of Ubuntu image\n    * [STORM-2856] - Make Storm build work on post 2017Q4 Travis Trusty image\n    * [STORM-2868] - Address handling activate/deactivate in multilang module files\n    * [STORM-2870] - FileBasedEventLogger leaks non-daemon ExecutorService which prevents process to be finished\n    * [STORM-2876] - Some storm-hdfs tests fail with out of memory periodically\n    * [STORM-2879] - Supervisor collapse continuously when there is a expired assignment for overdue storm\n    * [STORM-2892] - Flux test fails to parse valid PATH environment variable\n    * [STORM-2894] - fix some random typos in tests\n    * [STORM-2912] - Tick tuple is being shared without resetting start time and incur side-effect to break metrics\n    * [STORM-2918] - Upgrade Netty version\n    * [STORM-2942] - Remove javadoc and source jars from toollib directory in binary distribution\n    * [STORM-2874] - Minor style improvements to backpressure code\n    * [STORM-2858] - Fix worker-launcher build\n  * 1.1.1:\n    * STORM-2659: Add daemon.name variable to storm.cmd to fix log4j logging\n    * STORM-2652: fix error in open method of JmsSpout\n    * STORM-2645: Update storm.py to be python3 compatible\n    * STORM-2621: add tuple_population metric\n    * STORM-2639: Kafka Spout incorrectly computes numCommittedOffsets due to voids in the topic (topic compaction)\n    * STORM-2544: Fixing issue in acking of tuples that hit retry limit under manual commit mode\n    * STORM-2618: Add TridentKafkaStateUpdater for storm-kafka-client\n    * STORM-2608: Remove any pending offsets that are no longer valid\n    * STORM-2503: Fix lgtm.com alerts on equality and comparison operations\n    * STORM-2478: Fix BlobStoreTest.testDeleteAfterFailedCreate on Windows\n    * STORM-2602: storm.zookeeper.topology.auth.payload doesn't work even you set it\n    * STORM-2597: Don't parse passed in class paths\n    * STORM-2564: We should provide a template for storm-cluster-auth.yaml\n    * STORM-2568: Fix getTopicsString\n    * STORM-2563: Remove the workaround to handle missing UGI.loginUserFromSubject\n    * STORM-2552: KafkaSpoutMessageId should be serializable\n    * STORM-2562: Use stronger key size than default for blow fish key generator and get rid of stack trace\n    * STORM-2557: A bug in DisruptorQueue causing severe underestimation of queue arrival rates\n    * STORM-2449: Ensure same key appears only once in State iterator\n    * STORM-2516: Fix timing issues with testPrepareLateTupleStreamWithoutBuilder\n    * STORM-2489: Overlap and data loss on WindowedBolt based on Duration\n    * STORM-2528: Bump log4j version to 2.8.2\n    * STORM-2527: Initialize java.sql.DriverManager earlier to avoid deadlock\n    * STORM-2413: Make new Kafka spout respect tuple retry limits\n    * STORM-2518: Handles empty name for 'USER type' ACL when normalizing ACLs\n    * STORM-2511: Submitting a topology with name containing unicode getting failed\n    * STORM-2496: Dependency artifacts should be uploaded to blobstore with READ permission for all\n    * STORM-2505: Spout to support topic compaction\n    * STORM-2498: Fix Download Full File link\n    * STORM-2343: New Kafka spout can stop emitting tuples if more than maxUncommittedOffsets tuples fail at once.\n    * STORM-2486: Prevent cd from printing target directory to avoid breaking classpath\n    * STORM-2488: The UI user Must be HTTP.\n    * STORM-2481: Upgrade Aether version to resolve Aether bug BUG-451566\n    * STORM-2435: Logging in storm.js inconsistent to console.log and does not support log levels\n    * STORM-2315: New kafka spout can't commit offset when ack is disabled\n    * STORM-2467: Use explicit charset when decoding from array backed buffer\n    * STORM-1114: Race condition in trident zookeeper zk-node create/delete\n    * STORM-2448: Add in Storm and JDK versions when submitting a topology\n    * STORM-2343: Fix new Kafka spout stopping processing if more than maxUncommittedOffsets tuples fail at once\n    * STORM-2431: the default blobstore.dir is storm.local.dir/blobs which is different from distcache-blobstore.md\n    * STORM-2429: Properly validate supervisor.scheduler.meta\n    * STORM-2451: windows storm.cmd does not set log4j2 config file correctly by default\n    * STORM-2450: Write resources into correct local director\n    * STORM-2440: Kill process if executor catches java.net.SocketTimeoutException\n    * STORM-2432: Storm-Kafka-Client Trident Spout Seeks Incorrect Offset With UNCOMMITTED_LATEST Strategy\n  * 1.1.0:\n    * STORM-2425: Storm Hive Bolt not closing open transactions\n    * STORM-2409: Storm-Kafka-Client KafkaSpout Support for Failed and NullTuples\n    * STORM-2423: Join Bolt should use explicit instead of default window anchoring for emitted tuples\n    * STORM-2416: Improve Release Packaging to Reduce File Size\n    * STORM-2414: Skip checking meta's ACL when subject has write privileges for any blobs\n    * STORM-2038: Disable symlinks with a config option\n    * STORM-2240: STORM PMML Bolt - Add Support to Load Models from Blob Store\n    * STORM-2412: Nimbus isLeader check while waiting for max replication\n    * STORM-2408: build failed if storm.kafka.client.version = 0.10.2.0\n    * STORM-2403: Fix KafkaBolt test failure: tick tuple should not be acked\n    * STORM-2361: Kafka spout - after leader change, it stops committing offsets to ZK\n    * STORM-2353: Replace kafka-unit by kafka_2.11 and kafka-clients to test kafka-clients:0.10.1.1\n    * STORM-2387: Handle tick tuples properly for Bolts in external modules\n    * STORM-2345: Type mismatch in ReadClusterState's ProfileAction processing Map\n    * STORM-2400: Upgraded Curator to 2.12.0 and made respective API changes\n    * STORM-2396: setting interrupted status back before throwing a RuntimeException\n    * STORM-1772: Adding Perf module with topologies for measuring performance\n    * STORM-2395: storm.cmd supervisor calls the wrong class name\n    * STORM-2391: Move HdfsSpoutTopology from storm-starter to storm-hdfs-examples\n    * STORM-2389: Avoid instantiating Event Logger when topology.eventlogger.executors=0\n    * STORM-2386: Fail-back Blob deletion also fails in BlobSynchronizer.syncBlobs.\n    * STORM-2388: JoinBolt breaks compilation against JDK 7\n    * STORM-2374: Storm Kafka Client Test Topologies Must be Serializable\n    * STORM-2372: Pacemaker client doesn't clean up heartbeats properly\n    * STORM-2326: Upgrade log4j and slf4j\n    * STORM-2334: Join Bolt implementation\n    * STORM-1363: TridentKafkaState should handle null values from TridentTupleToKafkaMapper.getMessageFromTuple()\n    * STORM-2365: Support for specifying output stream in event hubs spout\n    * STORM-2250: Kafka spout refactoring to increase modularity and testability\n    * STORM-2340: fix AutoCommitMode issue in KafkaSpout\n    * STORM-2344: Flux YAML File Viewer for Nimbus UI\n    * STORM-2350: Storm-HDFS's listFilesByModificationTime is broken\n    * STORM-2270 Kafka spout should consume from latest when ZK partition commit offset bigger than the latest offset\n    * STORM-1464: storm-hdfs support for multiple output files and partitioning\n    * STORM-2320: DRPC client printer class reusable for local and remote DRPC\n    * STORM-2281: Running Multiple Kafka Spouts (Trident) Throws Illegal State Exception\n    * STORM-2296: Kafka spout no dup on leader changes\n    * STORM-2244: Some shaded jars doesn't exclude dependency signature files\n    * STORM-2014: New Kafka spout duplicates checking if failed messages have reached max retries\n    * STORM-1443: [Storm SQL] Support customizing parallelism in StormSQL\n    * STORM-2148: [Storm SQL] Trident mode: back to code generate and compile Trident topology\n    * STORM-2331: Emitting from JavaScript should work when not anchoring.\n    * STORM-2225: change spout config to be simpler.\n    * STORM-2323: Precondition for Leader Nimbus should check all topology blobs and also corresponding dependencies\n    * STORM-2330: Fix storm sql code generation for UDAF with non standard sql types\n    * STORM-2298: Don't kill Nimbus when ClusterMetricsConsumer is failed to initialize\n    * STORM-2301: [storm-cassandra] upgrade cassandra driver to 3.1.2\n    * STORM-1446: Compile the Calcite logical plan to Storm Trident logical plan\n    * STORM-2303: [storm-opentsdb] Fix list invariant issue for JDK 7\n    * STORM-2236: storm kafka client should support manual partition management\n    * STORM-2295: KafkaSpoutStreamsNamedTopics should return output fields with predictable ordering\n    * STORM-2300: [Flux] support list of references\n    * STORM-2297: [storm-opentsdb] Support Flux for OpenTSDBBolt\n    * STORM-2294: Send activate and deactivate command to ShellSpout\n    * STORM-2280: Upgrade Calcite version to 1.11.0\n    * STORM-2278: Allow max number of disruptor queue flusher threads to be configurable\n    * STORM-2277: Add shaded jar for Druid connector\n    * STORM-2274: Support named output streams in Hdfs Spout\n    * STORM-2204: Adding caching capabilities in HBaseLookupBolt\n    * STORM-2267: Use user's local maven repo. directory to local repo.\n    * STORM-2254: Provide Socket time out for nimbus thrift client\n    * STORM-2200: [Storm SQL] Drop Aggregate \u0026 Join support on Trident mode\n    * STORM-2266: Close NimbusClient instances appropriately\n    * STORM-2203: Add a getAll method to KeyValueState interface\n    * STORM-1886: Extend KeyValueState iface with delete\n    * STORM-2022: update Fields test to match new behavior\n    * STORM-2020: Stop using sun internal classes\n    * STORM-1228: port fields_test to java\n    * STORM-2104: New Kafka spout crashes if partitions are reassigned while tuples are in-flight\n    * STORM-2257: Add built in support for sum function with different types.\n    * STORM-2082: add sql external module storm-sql-hdfs\n    * STORM-2256: storm-pmml breaks on java 1.7\n    * STORM-2223: PMML Bolt.\n    * STORM-2222: Repeated NPEs thrown in nimbus if rebalance fails\n    * STORM-2190: reduce contention between submission and scheduling\n    * STORM-2239: Handle InterruptException in new Kafka spout\n    * STORM-2087: Storm-kafka-client: Failed tuples are not always replayed\n    * STORM-2238: Add Timestamp extractor for windowed bolt\n    * STORM-2235: Introduce new option: 'add remote repositories' for dependency resolver\n    * STORM-2215: validate blobs are present before submitting\n    * STORM-2170: [Storm SQL] Add built-in socket datasource to runtime\n    * STORM-2226: Fix kafka spout offset lag ui for kerberized kafka\n    * STORM-2224: Exposed a method to override in computing the field from given tuple in FieldSelector\n    * STORM-2220: Added config support for each bolt in Cassandra bolts, fixed the bolts to be used also as sinks.\n    * STORM-2205: Racecondition in getting nimbus summaries while ZK connectionions are reconnected\n    * STORM-2182: Refactor Storm Kafka Examples Into Own Modules.\n    * STORM-1694: Kafka Spout Trident Implementation Using New Kafka Consumer API\n    * STORM-2173: [SQL] Support CSV as input / output format\n    * STORM-2177: [SQL] Support TSV as input / output format\n    * STORM-2172: [SQL] Support Avro as input / output format\n    * STORM-2185: Storm Supervisor doesn't delete directories properly sometimes\n    * STORM-2103: [SQL] Introduce new sql external module: storm-sql-mongodb\n    * STORM-2175: fix double close of workers\n    * STORM-2109: Under supervisor V2 SUPERVISOR_MEMORY_CAPACITY_MB and SUPERVISOR_CPU_CAPACITY must be Doubles\n    * STORM-2110: in supervisor v2 filter out empty command line args\n    * STORM-2117: Supervisor V2 with local mode extracts resources directory to topology root directory instead of temporary directory\n    * STORM-2131: Add blob command to worker-launcher, make stormdist directory not writeable by topo owner\n    * STORM-2018: Supervisor V2\n    * STORM-2139: Let ShellBolts and ShellSpouts run with scripts from blobs\n    * STORM-2072: Add map, flatMap with different outputs (T-\u003eV) in Trident\n    * STORM-2134: improving the current scheduling strategy for RAS\n    * STORM-2125: Use Calcite's implementation of Rex Compiler\n    * STORM-1546: Adding Read and Write Aggregations for Pacemaker to make it HA compatible\n    * STORM-1444: Support EXPLAIN statement in StormSQL\n    * STORM-2099: Introduce new sql external module: storm-sql-redis\n    * STORM-2097: Improve logging in trident core and examples\n    * STORM-2144: Fix Storm-sql group-by behavior in standalone mode\n    * STORM-2066: make error message in IsolatedPool.java more descriptive\n    * STORM-1870: Allow FluxShellBolt/Spout set custom 'componentConfig' via yaml\n    * STORM-2126: fix NPE due to race condition in compute-new-sched-assign…\n    * STORM-2124: show requested cpu mem for each component\n    * STORM-2089: Replace Consumer of ISqlTridentDataSource with SqlTridentConsumer\n    * STORM-2118: A few fixes for storm-sql standalone mode\n    * STORM-2105: Cluster/Supervisor total and available resources displayed in the UI\n    * STORM-2078: enable paging in worker datatable\n    * STORM-1664: Allow Java users to start a local cluster with a Nimbus Thrift server.\n    * STORM-1872: Release Jedis connection when topology shutdown\n    * STORM-2100: Fix Trident SQL join tests to not rely on ordering\n    * STORM-1837: Fix complete-topology and prevent message loss\n    * STORM-2098: DruidBeamBolt: Pass DruidConfig.Builder as constructor argument\n    * STORM-2092: optimize TridentKafkaState batch sending\n    * STORM-1979: Storm Druid Connector implementation.\n    * STORM-2057: Support JOIN statement in Storm SQL\n    * STORM-1970: external project examples refator\n    * STORM-2074: fix storm-kafka-monitor NPE bug\n    * STORM-1459: Allow not specifying producer properties in read-only Kafka table in StormSQL\n    * STORM-2052: Kafka Spout New Client API - Log Improvements and Parameter Tuning for Better Performance.\n    * STORM-2050: [storm-sql] Support User Defined Aggregate Function for Trident mode\n    * STORM-1434: Support the GROUP BY clause in StormSQL\n    * STORM-2016: Topology submission improvement: support adding local jars and maven artifacts on submission\n    * STORM-1994: Add table with per-topology \u0026 worker resource usage and components in (new) supervisor and topology pages\n    * STORM-2042: Nimbus client connections not closed properly causing connection leaks\n    * STORM-1766: A better algorithm server rack selection for RAS\n    * STORM-1913: Additions and Improvements for Trident RAS API\n    * STORM-2037: debug operation should be whitelisted in SimpleAclAuthorizer.\n    * STORM-2023: Add calcite-core to dependency of storm-sql-runtime\n    * STORM-2036: Fix minor bug in RAS Tests\n    * STORM-1979: Storm Druid Connector implementation.\n    * STORM-1839: Storm spout implementation for Amazon Kinesis Streams.\n    * STORM-1876: Option to build storm-kafka and storm-kafka-client with different kafka client version\n    * STORM-2000: Package storm-opentsdb as part of external dir in installation\n    * STORM-1989: X-Frame-Options support for Storm UI\n    * STORM-1962: support python 3 and 2 in multilang\n    * STORM-1964: Unexpected behavior when using count window together with timestamp extraction\n    * STORM-1890: ensure we refetch static resources after package build\n    * STORM-1988: Kafka Offset not showing due to bad classpath.\n    * STORM-1966: Expand metric having Map type as value into multiple metrics based on entries\n    * STORM-1737: storm-kafka-client has compilation errors with Apache Kafka 0.10\n    * STORM-1968: Storm logviewer does not work for nimbus.log in secure cluster\n    * STORM-1910: One topology cannot use hdfs spout to read from two locations\n    * STORM-1960: Add CORS support to STORM UI Rest api\n    * STORM-1959: Add missing license header to KafkaPartitionOffsetLag\n    * STORM-1950: Change response json of 'Topology Lag' REST API to keyed by spoutId, topic, partition.\n    * STORM-1833: Simple equi-join in storm-sql standalone mode\n    * STORM-1866: Update Resource Aware Scheduler Documentation\n    * STORM-1930: Kafka New Client API - Support for Topic Wildcards\n    * STORM-1924: Adding conf options for Persistent Word Count Topology\n    * STORM-1956: Disabling Backpressure by default\n    * STORM-1934: Fix race condition between sync-supervisor and sync-processes\n    * STORM-1919: Introduce FilterBolt on storm-redis\n    * STORM-1945: Fix NPE bugs on topology spout lag for storm-kafka-monitor\n    * STORM-1888: add description for shell command\n    * STORM-1902: add a simple \u0026 flexible FileNameFormat for storm-hdfs\n    * STORM-1914: Storm Kafka Field Topic Selector\n    * STORM-1907: PartitionedTridentSpoutExecutor has incompatible types that cause ClassCastException\n    * STORM-1925: Remove Nimbus thrift call from Nimbus itself\n    * STORM-1909: Update HDFS spout documentation\n    * STORM-1136: Command line module to return kafka spout offsets lag and display in storm ui\n    * STORM-1911: IClusterMetricsConsumer should use seconds to timestamp unit\n    * STORM-1893: Support OpenTSDB for storing timeseries data.\n    * STORM-1723: Introduce ClusterMetricsConsumer\n    * STORM-1700: Introduce 'whitelist' / 'blacklist' option to MetricsConsumer\n    * STORM-1698: Asynchronous MetricsConsumerBolt\n    * STORM-1705: Cap number of retries for a failed message\n    * STORM-1884: Prioritize pendingPrepare over pendingCommit\n    * STORM-1575: fix TwitterSampleSpout NPE on close\n    * STORM-1874: Update logger private permissions\n    * STORM-1865: update command line client document\n    * STORM-1771: HiveState should flushAndClose before closing old or idle Hive connections\n    * STORM-1882: Expose TextFileReader public\n    * STORM-1873: Implement alternative behaviour for late tuples\n    * STORM-1719: Introduce REST API: Topology metric stats for stream\n    * STORM-1887: Fixed help message for set_log_level command\n    * STORM-1878: Flux can now handle IStatefulBolts\n    * STORM-1864: StormSubmitter should throw respective exceptions and log respective errors forregistered submitter hook invocation\n    * STORM-1868: Modify TridentKafkaWordCount to run in distributed mode\n    * STORM-1859: Ack late tuples in windowed mode\n    * STORM-1851: Fix default nimbus impersonation authorizer config\n    * STORM-1848: Make KafkaMessageId and Partition serializable to support\n    * STORM-1862: Flux ShellSpout and ShellBolt can't emit to named streams\n    * Storm-1728: TransactionalTridentKafkaSpout error\n    * STORM-1850: State Checkpointing Documentation update\n    * STORM-1674: Idle KafkaSpout consumes more bandwidth than needed\n    * STORM-1842: Forward references in storm.thrift cause tooling issues\n    * STORM-1730: LocalCluster#shutdown() does not terminate all storm threads/thread pools.\n    * STORM-1709: Added group by support in storm sql standalone mode\n    * STORM-1720: Support GEO in storm-redis\n  * 1.0.6:\n    * [STORM-2877] - Introduce an option to configure pagination in Storm UI\n    * [STORM-2917] - Check the config(nimbus.host) before using it to connect\n    * [STORM-2451] - windows storm.cmd does not set log4j2 config file correctly by default\n    * [STORM-2690] - resurrect invocation of ISupervisor.assigned() \u0026 make Supervisor.launchDaemon() accessible\n    * [STORM-2751] - Remove AsyncLoggingContext from Supervisor\n    * [STORM-2764] - HDFSBlobStore leaks file system objects\n    * [STORM-2771] - Some tests are being run twice\n    * [STORM-2786] - Ackers leak tracking info on failure and lots of other cases.\n    * [STORM-2853] - Deactivated topologies cause high cpu utilization\n    * [STORM-2856] - Make Storm build work on post 2017Q4 Travis Trusty image\n    * [STORM-2870] - FileBasedEventLogger leaks non-daemon ExecutorService which prevents process to be finished\n    * [STORM-2879] - Supervisor collapse continuously when there is a expired assignment for overdue storm\n    * [STORM-2892] - Flux test fails to parse valid PATH environment variable\n    * [STORM-2894] - fix some random typos in tests\n    * [STORM-2912] - Tick tuple is being shared without resetting start time and incur side-effect to break metrics\n    * [STORM-2918] - Upgrade Netty version\n    * [STORM-2874] - Minor style improvements to backpressure code\n    * [STORM-2937] - Overwrite storm-kafka-client 1.x-branch into 1.0.x-branch\n    * [STORM-2858] - Fix worker-launcher build\n- Use %license macro\n\n  * 1.0.5:\n    * [STORM-2657] - Update SECURITY.MD\n    * [STORM-2231] - NULL in DisruptorQueue while multi-threaded ack\n    * [STORM-2660] - The Nimbus storm-local directory is relative to the working directory of the shell executing 'storm nimbus'\n    * [STORM-2674] - NoNodeException when ZooKeeper tries to delete nodes\n    * [STORM-2677] - consider all sampled tuples which took greater than 0 ms processing time\n    * [STORM-2682] - Supervisor crashes with NullPointerException\n    * [STORM-2695] - BlobStore uncompress argument should be Boolean\n    * [STORM-2705] - DRPCSpout sleeps twice when idle\n  * 1.0.4:\n    * STORM-2627: Update docs for storm.zookeeper.topology.auth.scheme\n    * STORM-2597: Don't parse passed in class paths\n    * STORM-2524: Set Kafka client.id with storm-kafka\n    * STORM-2448: Add in Storm and JDK versions when submitting a topology\n    * STORM-2511: Submitting a topology with name containing unicode getting failed\n    * STORM-2498: Fix Download Full File link\n    * STORM-2486: Prevent cd from printing target directory to avoid breaking classpath\n    * STORM-1114: Race condition in trident zookeeper zk-node create/delete\n    * STORM-2429: Properly validate supervisor.scheduler.meta\n    * STORM-2194: Stop ignoring socket timeout error from executor\n    * STORM-2450: Write resources into correct local director\n    * STORM-2414: Skip checking meta's ACL when subject has write privileges for any blobs\n    * STORM-2038: Disable symlinks with a config option\n    * STORM-2038: No symlinks for local cluster\n    * STORM-2403: Fix KafkaBolt test failure: tick tuple should not be acked\n    * STORM-2361: Kafka spout - after leader change, it stops committing offsets to ZK\n    * STORM-2296: Kafka spout - no duplicates on leader changes\n    * STORM-2387: Handle tick tuples properly for Bolts in external modules\n    * STORM-2345: Type mismatch in ReadClusterState's ProfileAction processing Map\n    * STORM-2104: New Kafka spout crashes if partitions are reassigned while tuples are in-flight\n    * STORM-2396: setting interrupted status back before throwing a RuntimeException\n    * STORM-2395: storm.cmd supervisor calls the wrong class name\n    * STORM-2385: pacemaker_state_factory.clj does not compile on branch-1.0.x\n    * STORM-2389: Avoid instantiating Event Logger when topology.eventlogger.executors=0\n    * STORM-2386: Fail-back Blob deletion also fails in BlobSynchronizer.syncBlobs\n    * STORM-2360: Storm-Hive: Thrift version mismatch with storm-core\n    * STORM-2372: Pacemaker client doesn't clean up heartbeats properly\n    * STORM-2326: Upgrade log4j and slf4j\n    * STORM-2350: Storm-HDFS's listFilesByModificationTime is broken\n  * 1.0.3:\n    * STORM-2197: NimbusClient connectins leak due to leakage in ThriftClient\n    * STORM-2321: Handle blobstore zk key deletion in KeySequenceNumber.\n    * STORM-2324: Fix deployment failure if resources directory is missing in topology jar\n    * STORM-2335: Fix broken Topology visualization with empty ':transferred' in executor stats\n    * STORM-2336: Close Localizer and AsyncLocalizer when supervisor is shutting down\n    * STORM-2338: Subprocess exception handling is broken in storm.py on Windows environment\n    * STORM-2337: Broken documentation generation for storm-metrics-profiling-internal-actions.md and windows-users-guide.md\n    * STORM-2325: Logviewer doesn't consider 'storm.local.hostname'\n    * STORM-1742: More accurate 'complete latency'\n    * STORM-2176: Workers do not shutdown cleanly and worker hooks don't run when a topology is killed\n    * STORM-2293: hostname should only refer node's 'storm.local.hostname'\n    * STORM-2246: Logviewer download link has urlencoding on part of the URL\n    * STORM-1906: Window count/length of zero should be disallowed\n    * STORM-1841: Address a few minor issues in windowing and doc\n    * STORM-2268: Fix integration test for Travis CI build\n    * STORM-2283: Fix DefaultStateHandler kryo multithreading issues\n    * STORM-2264: OpaqueTridentKafkaSpout failing after STORM-2216\n    * STORM-2276: Remove twitter4j usages due to license issue (JSON.org is catalog X)\n    * STORM-2095: remove any remaining files when deleting blobstore directory\n    * STORM-2222: Repeated NPEs thrown in nimbus if rebalance fails\n    * STORM-2251: Integration test refers specific version of Storm which should be project version\n    * STORM-2234: heartBeatExecutorService in shellSpout don't work well with deactivate\n    * STORM-2216: Favor JSONValue.parseWithException\n    * STORM-2208: HDFS State Throws FileNotFoundException in Azure Data Lake Store file system (adl://)\n    * STORM-2213: ShellSpout has race condition when ShellSpout is being inactive longer than heartbeat timeout\n    * STORM-2210: remove array shuffle from ShuffleGrouping\n    * STORM-2052: Kafka Spout - New Client API - Performance Improvements\n    * storm-2205: Racecondition in getting nimbus summaries while ZK connections are reconnected\n    * STORM-2198: perform RotationAction when stopping HdfsBolt\n    * STORM-2196: A typo in RAS_Node::consumeCPU\n    * STORM-2189: RAS_Node::freeCPU outputs incorrect info\n    * STORM-2184: Don't wakeup KafkaConsumer on shutdown\n    * STORM-2185: Storm Supervisor doesn't delete directories properly sometimes\n    * STORM-2175: fix double close of workers\n    * STORM-2018: Supervisor V2\n    * STORM-2145: Leave leader nimbus's hostname to log when trying to connect leader nimbus\n    * STORM-2127: Storm-eventhubs should use latest amqp and eventhubs-client versions\n    * STORM-2040: Fix bug on assert-can-serialize\n    * STORM-2017: ShellBolt stops reporting task ids\n    * STORM-2119: bug in log message printing to stdout\n    * STORM-2120: Emit to _spoutConfig.outputStreamId\n    * STORM-2101: fixes npe in compute-executors in nimbus\n    * STORM-2090: Add integration test for storm windowing\n    * STORM-2003: Make sure config contains TOPIC before get it\n    * STORM-1567: in defaults.yaml 'topology.disable.loadaware' should be 'topology.disable.loadaware.messaging'\n    * STORM-1987: Fix TridentKafkaWordCount arg handling in distributed mode.\n    * STORM-1969: Modify HiveTopology to show usage of non-partition table.\n    * STORM-1849: HDFSFileTopology should use the 3rd argument as topologyName\n    * STORM-2086: use DefaultTopicSelector instead of creating a new one\n    * STORM-2079: Unneccessary readStormConfig operation\n    * STORM-2081: create external directory for storm-sql various data sources and move storm-sql-kafka to it\n    * STORM-2070: Fix sigar native binary download link\n    * STORM-2056: Bugs in logviewer\n    * STORM-1646: Fix ExponentialBackoffMsgRetryManager test\n    * STORM-2039: Backpressure refactoring in worker and executor\n    * STORM-2064: Add storm name and function, access result and function to log-thrift-access\n    * STORM-2063: Add thread name in worker logs\n    * STORM-2042: Nimbus client connections not closed properly causing connection leaks\n    * STORM-2032: removes warning in case more than one metrics tuple is received\n    * STORM-1594: org.apache.storm.tuple.Fields can throw NPE if given invalid field in selector\n    * STORM-1995: downloadChunk in nimbus.clj should close the input stream\n\nChanges in rubygem-activeresource:\n- Add bsc#1171560-CVE-2020-8151-encode-id-param.patch\n  Prevent possible information disclosure issue that could allow\n  an attacker to create specially crafted requests to access data\n  in an unexpected way (bsc#1171560 CVE-2020-8151))_\n\nChanges in rubygem-crowbar-client:\n- Update to 3.9.2\n  - Enable SES commands in Cloud8 (SOC-11122)\n\nChanges in rubygem-json-1_7:\n- Add CVE-2020-10663.patch (CVE-2020-10663, bsc#1167244)\n\nChanges in rubygem-puma:\n- Fix indentation in gem2rpm.yml_\n\n- Add CVE-2020-11077.patch (bsc#1172175, CVE-2020-11077)\n- Add chunked-request-handling.patch (needed for CVE-2020-11076.patch)\n- Add CVE-2020-11076.patch (bsc#1172176, CVE-2020-11076)\n- Add all patches to gem2rpm.yml\n\n","status":"published","published":"2020-07-14T12:42:01Z","modified":"2026-02-04T03:06:11.709086Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:2057-1","title":"Security update for python-Pillow","description":"This update for python-Pillow fixes the following issues:\n\n- Add 0019-FLI-overflow-error-fix-and-testcase.patch\n   * Fixes CVE-2016-0775, bsc#965582\n- Add 0020-Fix-OOB-reads-in-FLI-decoding.patch\n   * Fixes CVE-2020-10177, bsc#1173413\n- Add 0021-Fix-bounds-overflow-in-JPEG-2000-decoding.patch\n   * Fixes CVE-2020-10994, bsc#1173418\n- Add 0022-Fix-bounds-overflow-in-PCX-decoding.patch\n   * Fixes CVE-2020-10378, bsc#1173416\n- Add 0008-Corrected-negative-seeks.patch\n   * Fixes part of CVE-2019-16865, bsc#1153191\n- Add 0009-Make-Image.crop-an-immediate-operation.patch\n   * Fixes https://github.com/python-pillow/Pillow/issues/1077\n   * Used by 0012-Added-decompression-bomb-checks.patch\n- Add 0010-Crop-decompression.patch\n   * Used by 0012-Added-decompression-bomb-checks.patch\n- Add 0011-Added-DecompressionBombError.patch\n   * Used by 0012-Added-decompression-bomb-checks.patch\n- Add 0012-Added-decompression-bomb-checks.patch\n   * Fixes part of CVE-2019-16865, bsc#1153191\n- Add 0013-Raise-error-if-dimension-is-a-string.patch\n   * Fixes part of CVE-2019-16865, bsc#1153191\n- Add 0014-Catch-buffer-overruns.patch\n   * Fixes part of CVE-2019-16865, bsc#1153191\n- Add 0015-Catch-PCX-P-mode-buffer-overrun.patch\n   * Fixes CVE-2020-5312, bsc#1160152\n- Add 0016-Ensure-previous-FLI-frame-is-loaded.patch\n   * Fixes https://github.com/python-pillow/Pillow/issues/2649\n   * Uncovers CVE-2020-5313, bsc#1160153\n- Add 0017-Catch-FLI-buffer-overrun.patch\n   * Fixes CVE-2020-5313, bsc#1160153\n- Add 018-Invalid-number-of-bands-in-FPX-image.patch\n   * Fixes CVE-2019-19911, bsc#1160192\n","status":"published","published":"2020-07-27T20:26:47Z","modified":"2026-02-04T04:15:02.625377Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"USN-4272-1","title":"pillow vulnerabilities","description":"It was discovered that Pillow incorrectly handled certain images.\nAn attacker could possibly use this issue to cause a denial of service.\n(CVE-2019-16865, CVE-2019-19911)\n\nIt was discovered that Pillow incorrectly handled certain images.\nAn attacker could possibly use this issue to execute arbitrary code.\n(CVE-2020-5312)\n\nIt was discovered that Pillow incorrectly handled certain TIFF images.\nAn attacker could possibly use this issue to cause a crash. This issue\nonly affected Ubuntu 19.10. (CVE-2020-5310)\n\nIt was discovered that Pillow incorrectly handled certain SGI images.\nAn attacker could possibly use this issue to execute arbitrary code or\ncause a crash. This issue only affected Ubuntu 18.04 and Ubuntu 19.10.\n(CVE-2020-5311)\n\nIt was discovered that Pillow incorrectly handled certain PCX images.\nAn attackter could possibly use this issue to execute arbitrary code or\ncause a crash. (CVE-2020-5312)\n\nIt was discovered that Pillow incorrectly handled certain Flip images.\nAn attacker could possibly use this issue to execute arbitrary code or\ncause a crash. (CVE-2020-5313)\n","status":"published","published":"2020-02-06T15:14:11Z","modified":"2026-06-29T13:47:54.098805987Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}