You are here
Home > Preporuke > Sigurnosni nedostatak programskog paketa RHEL OpenStack Platform

Sigurnosni nedostatak programskog paketa RHEL OpenStack Platform

  • Detalji os-a: WN7
  • Važnost: IMP
  • Operativni sustavi: L
  • Kategorije: LRH

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Low: openstack-ceilometer security and bug fix update
Advisory ID: RHSA-2019:0566-01
Product: Red Hat Enterprise Linux OpenStack Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2019:0566
Issue date: 2019-03-14
CVE Names: CVE-2019-3830
=====================================================================

1. Summary:

An update for openstack-ceilometer is now available for Red Hat OpenStack
Platform 13.0 (Queens).

Red Hat Product Security has rated this update as having a security impact
of Low. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenStack Platform 13.0 – noarch

3. Description:

OpenStack Telemetry (ceilometer) collects customer usage data for metering
purposes. Telemetry implements bus listener, push, and polling agents for
data collection. This data is stored in a database and presented via the
REST API. In addition, Telemetry’s extensible design means it can be
optionally extended to gather customized data sets.

Security Fix(es):

* openstack-ceilometer: ceilometer-agent prints sensitive data from config
files through log files (CVE-2019-3830)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1659044 – Undercloud installation fails with –skip-metering-database when telemetry is enabled
1669296 – Rebase openstack-ceilometer to 8944142
1671037 – ceilometer writing snmp credentials to log file
1677389 – CVE-2019-3830 openstack-ceilometer: ceilometer-agent prints sensitive data from config files through log files

6. Package List:

Red Hat OpenStack Platform 13.0:

Source:
openstack-ceilometer-10.0.1-6.el7ost.src.rpm

noarch:
openstack-ceilometer-central-10.0.1-6.el7ost.noarch.rpm
openstack-ceilometer-common-10.0.1-6.el7ost.noarch.rpm
openstack-ceilometer-compute-10.0.1-6.el7ost.noarch.rpm
openstack-ceilometer-ipmi-10.0.1-6.el7ost.noarch.rpm
openstack-ceilometer-notification-10.0.1-6.el7ost.noarch.rpm
openstack-ceilometer-polling-10.0.1-6.el7ost.noarch.rpm
python-ceilometer-10.0.1-6.el7ost.noarch.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2019-3830
https://access.redhat.com/security/updates/classification/#low

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2019 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIVAwUBXIpX2NzjgjWX9erEAQgGog/+M7rUpzq67vZ+0WP9EBooybvrnlKHPxEQ
1Xqb7v5gWf6F5zUCuWhdP3ySNRAASVpqpEuW0uLKniA7Wyl00pZd3tYvBY+9uDni
0hnRZMHgQFipfBV9NYsrQEYq97KCnNscjx+0ToXhp+OXcDnARLTAx5K0XIiqYvWB
Vyf5fTjLq1CjhJpIBWxnyc9V2LPE8cFZvFOSQfvRELIldjbOGIPTG/OUA9UEuGam
6Vd/tFfMsU8YYN49E1Jr+fezM2NT1rbxOu+TKgcGdyxlRUTdJ2WolZkaC5pBmDkx
buaixokaYmhyAjsyhhurUKLCtLvfjLJakIBA651LLYTgziNJvC3/VNFXK94eKhFK
vy+KXTVQzk9Mu97YyNLOMKoLiTbuC6TuVcf7AQTmigO7dyclc24Zx4eNuFfUl6At
e2WO0FIq4xjPYPCCBI/8Bdi/EXf7aKlBlm6oOlzVXUOORcaI+UyqGgoFDHYjdqMz
w6T1hQ9/zsI8+Tbt+e5eZJtP5ZjfKIYiIGbGf+bnk7XFsdyuwQ08cSKg+5pK7+qy
RoMkDMss+nQNeBC3OvDB1fuRqP7N66qhc8i3KfJM5O91UhSpRQQuhlzNLtDboPSq
lGKG7NP/HfmnxK1P/29gJU5djDzMAUfIa4dhbeICClNQ9UXsbhODVgso6kXX9Q6Z
8AwYM/tYfo0=
=a8KE
—–END PGP SIGNATURE—–


RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

AutorZvonimir Bosnjak
Cert idNCERT-REF-2019-03-0001-ADV
CveCERT-CVE-DUMMY
ID izvornikaCERT-ORIGID-DUMMY
ProizvodCERT-DUMMY-PRODUCT
IzvorAdobe
Top
More in Preporuke
Sigurnosni nedostatak jezgre operacijskog sustava

Otkrivenje sigurnosni nedostatak jezgre operacijskog sustava Ubuntu. Otkriveni nedostatak potencijalnim napadačima omogućuje zaobilaženje sigurnosnih ograničenja. Savjetuje se ažuriranje izdanim zakrpama.

Close