You are here
Home > Preporuke > Sigurnosni nedostaci programskog paketa openstack

Sigurnosni nedostaci programskog paketa openstack

  • Detalji os-a: WN7
  • Važnost: IMP
  • Operativni sustavi: L
  • Kategorije: LRH

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Important: openstack-ironic-inspector security update
Advisory ID: RHSA-2019:1669-01
Product: Red Hat Enterprise Linux OpenStack Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2019:1669
Issue date: 2019-07-02
CVE Names: CVE-2019-10141
=====================================================================

1. Summary:

An update for openstack-ironic-inspector is now available for Red Hat
OpenStack Platform 14.0 (Rocky).

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenStack Platform 14.0 – noarch

3. Description:

Nodes managed by Ironic may use the ironic-inspector auxiliary service to
discover hardware properties. Hardware introspection or hardware properties
discovery is a process of getting hardware parameters required for
scheduling from a bare metal node, given its power management credentials
(e.g. IPMI address, user name and password).

Security Fix(es):

* openstack-ironic-inspector: SQL Injection vulnerability when receiving
introspection data (CVE-2019-10141)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1711722 – CVE-2019-10141 openstack-ironic-inspector: SQL Injection vulnerability when receiving introspection data
1712027 – Rebase openstack-ironic-inspector to f73967f

6. Package List:

Red Hat OpenStack Platform 14.0:

Source:
openstack-ironic-inspector-8.0.3-0.20190420013817.el7ost.src.rpm

noarch:
openstack-ironic-inspector-8.0.3-0.20190420013817.el7ost.noarch.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2019-10141
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2019 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIVAwUBXRu0idzjgjWX9erEAQgGKw/9EJx5zj6ce/FQhGUmnPolQCYlQFNt7h/I
NnSzlZPLT+7n22cg8wW/poHfEq6ckW8S1PEcIeZK7YlDfPCSjFIwvjxk5gkXSoyK
IQSj8eaF7Rwon9oshxtlcdSSEQ+OUU+B5fWJ0AHXz1JFAkCYnF01hbBUTHBM20Uf
c2ZwGxHLXfRZRrrX+7sgdbw55A/eQ3WYv8qf9aHohfW3gp5lLGn5h0AXWUlIVU6Y
0V/WwRJcnPag989EsABq/gyFD0bVjF5hLmpZUJhxjgDZG2jzzyobI5Km4f1unQ9r
ZZNowgJq3Pav1bTBv/YDPYMRFRbeGwXc5oHJ0frnYMXuc8KUXz6yPBV/dBScgQMH
AV28qWKpa1Bpe5BRqvXv0v/2fXU91bW0P5MbUlVl8nHnAUd15Z8WQJHZpMDrW9Vf
hrhVcVtjpZzvDx3atqDpweZgJRAtBjhU+jmgm1WTg8GRs4NIq1iVwg8IuoPkGDXn
y2xONU7sNk1mMCaqU6VJjisxGHPrhm9B5uqMOnHQcoP9eIJtAq5J5aYE+GDqY8sf
SpnxqhAEL6hM4UhZQR/WcMbYv7cD3w8u/sCZt+DNXEqvB+EHFIIUblst+H76xSsF
2HkwPcX0xvZdoz59ayjOzrX5nz2ks21wiSOfMKJD1Q1gBCU5aUDA54e14DOlDtSI
WGvbyf5VyLg=
=rycA
—–END PGP SIGNATURE—–


RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: openstack-tripleo-common security and bug fix update
Advisory ID: RHSA-2019:1683-01
Product: Red Hat Enterprise Linux OpenStack Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2019:1683
Issue date: 2019-07-02
CVE Names: CVE-2019-3895
=====================================================================

1. Summary:

An update for openstack-tripleo-common is now available for Red Hat
OpenStack Platform 14.0 (Rocky).

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenStack Platform 14.0 – noarch

3. Description:

openstack-tripleo-common contains the python library for code common to the
Red Hat OpenStack Platform director CLI and GUI (codename tripleo).

Security Fix(es):

* openstack-tripleo-common: Allows running new amphorae based on arbitrary
images (CVE-2019-3895)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Bug Fix(es):

* Upgrade prepare command hangs until timeout is reached (BZ#1667894)

* [OSP14] nova_metadata container is in unhealthy state on undercloud and
overcloud nodes (BZ#1700760)

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1667894 – Upgrade prepare command hangs until timeout is reached
1694608 – CVE-2019-3895 openstack-tripleo-common: Allows running new amphorae based on arbitrary images
1700760 – [OSP14] nova_metadata container is in unhealthy state on undercloud and overcloud nodes

6. Package List:

Red Hat OpenStack Platform 14.0:

Source:
openstack-tripleo-common-9.5.0-5.el7ost.src.rpm

noarch:
openstack-tripleo-common-9.5.0-5.el7ost.noarch.rpm
openstack-tripleo-common-container-base-9.5.0-5.el7ost.noarch.rpm
openstack-tripleo-common-containers-9.5.0-5.el7ost.noarch.rpm
openstack-tripleo-common-devtools-9.5.0-5.el7ost.noarch.rpm
python2-tripleo-common-9.5.0-5.el7ost.noarch.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2019-3895
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2019 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIVAwUBXRu0SdzjgjWX9erEAQhvZA//WyP+PwXqddf7IA2vv2onBGYcs5bjHb5u
8UOKAPUD9SveatLBHfKeaab2I/gIZ3xIkJVpUQqHiyVutqoMWd79FPG8/jBVWHvT
Im9GwxKVsQwmdPxsW2zB/X729QB33NH9OWT6tnCld5E1HgEPrbbOgE9hXcMGNqUi
gpOduJ5Vs+5FBN9wTDhrGv0zi4FIX6tfOLxXBEMDEL/2UxFP5ak2yuZSH8RR/l+u
NEXxq54zpyZVsswALEZ7ctGhucRETl193wyO0o1KWskOUb2eJQdwKWWMYzHBxYod
N0cGz8w49dFHlnnm1ui2nrp3xuedued53m9TMi/I+GMCvOY5AOf1zB7xxIseCpvX
QdvUIhoeQZVkPloaAaGuxldY6s1sxmSllCk1YmL29MFLNZsplguRUG4vgeT1pyxL
wFNA2T7JnPJr9ldPRYqaJRfUl6Mh30QhAFd2hBBS0wIZ5gpgLx2qXWjNrtJ+ozgQ
cNHGg5sCv/vy/4JjQv/CPTL9wMY4h6HhVHMoqwCd8cb8CL176BgWOrzz6ipqA6qG
ar33JApbBjFh3eCPKCdylS/AOq8D6McTVYqWLDz4jpq4djMR8EOPgLpFRylTJbS9
5h8RU16Cq59P4LUiHkwblHbjiQA3e7od6k/qG0FVPxWTJAn4ocVufKeJoHH/t+EB
GoPK0EgofkI=
=MXqt
—–END PGP SIGNATURE—–


RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

AutorJosip Papratovic
Cert idNCERT-REF-2019-07-0001-ADV
CveCERT-CVE-DUMMY
ID izvornikaCERT-ORIGID-DUMMY
ProizvodCERT-DUMMY-PRODUCT
IzvorAdobe
Top
More in Preporuke
Sigurnosni nedostatak jezgre operacijskog sustava

Otkriven je sigurnosni nedostatak jezgre operacijskog sustava Fedora. Otkriveni nedostatak potencijalnim napadačima omogućuje izazivanje DoS stanja ili stjecanje uvećanih ovlasti....

Close