SUSE-SU-2019:2562-1 This update for ansible1, ardana-ansible, ardana-cluster, ardana-db, ardana-extensions-nsx, ardana-glance, ardana-input-model, ardana-instal

Not scored Published

Security update for SUSE OpenStack Cloud components addressing IPv6 handling and other issues.

Exploited in the wild
Not known
Login needed
Not stated
Attackable
Not stated
Victim action needed
Not stated
Fix
Available

What is SUSE-SU-2019:2562-1?

SUSE-SU-2019:2562-1 is a vulnerability in ansible1, published on 4 Oct 2019.

Official description

This update for ansible1, ardana-ansible, ardana-cluster, ardana-db, ardana-extensions-nsx, ardana-glance, ardana-input-model, ardana-installer-ui, ardana-manila, ardana-monasca, ardana-neutron, ardana-nova, ardana-octavia, ardana-opsconsole-ui, ardana-osconfig, ardana-service, ardana-tls, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, grafana, novnc, openstack-cinder, openstack-dashboard, openstack-designate, openstack-glance, openstack-heat, openstack-horizon-plugin-heat-ui, openstack-horizon-plugin-monasca-ui, openstack-ironic, openstack-ironic-python-agent, openstack-keystone, openstack-manila, openstack-neutron, openstack-neutron-gbp, openstack-nova, openstack-octavia, openstack-sahara, openstack-tempest, openstack-watcher, python-ardana-configurationprocessor, python-cinder-tempest-plugin, python-urllib3, rubygem-easy_diff contains the following fixes:

  • 0004-add_ipv6_support_to_synchronize_action_plugin.patch fixes: bsc#1145967

    IPv6 addreses need to be wrapped when used in scp command in the form scp user@[ipv6address]:port SOC-10117

  • Update to version 9.0+git.1568385829.54601ac:

    • Enable Cloud9 parallelised upgrade workflow (SOC-10484)
  • Update to version 9.0+git.1568379640.07c5144:

    • Enable DB upgrade in ardana-update.yml (SOC-10094)
  • Update to version 9.0+git.1567617871.4426809:

    • Ensure tls-upgrade.yml called by ardana-update.yml (SOC-9942)
  • Update to version 9.0+git.1566486136.e2f6b0f:

    • Add deprecations cleanup support (SOC-10275)
  • Update to version 9.0+git.1568150980.027f167:

    • Enable auth_openidc Apache2 module (SOC-10509)
  • Update to version 9.0+git.1568382922.6f2cea4:

    • Use galera-upgrade.yml for update/upgrade workflow (SOC-10521)
  • Update to version 9.0+git.1568830037.2eea267:

    • Add missing DHCP options for NSX-T (SOC-5838)
  • Update to version 9.0+git.1568307751.d68a198:

    • Add NSX-T QoS service definition (SOC-10479)
  • Update to version 9.0+git.1567606893.85b4d54:

    • Add NSX-T LBaaS service definition (SOC-9900)
  • Update to version 9.0+git.1567416354.e45fd54:

    • Add missing policies for NSX-T (SOC-5831)
  • Update to version 9.0+git.1567196895.2e056b5:

    • Add NSX-T VPNaaS service definition (SOC-9935)
    • Add NSX-T FWaaS service definition (SOC-9935)
  • Update to version 9.0+git.1567196861.0ca4cc9:

    • Add the NSX-T DNS service definition (SOC-9912)
  • Update to version 9.0+git.1567196262.39a7dd0:

    • Improvements over initial NSX-T support (SOC-5831)
  • Update to version 9.0+git.1566918834.1b7a49a:

    • Update policy json templates for vmware-nsx (SOC-10254)
  • Update to version 9.0+git.1567000146.4569d10:

    • Cloud 8to9 upgrade enhancements for glance (SOC-10043)
  • Update to version 9.0+git.1566409257.eec6360:

    • Add neutron-fwaas.json when neutron-l3-agent is deployed (SOC-10280)
  • Update to version 9.0+git.1569535129.ca87ef0:

    • Add support for running in Docker container (SOC-8524) (#350)
  • Update to version 9.0+git.1567797529.273abf2:

    • Use IPv6 validator on baremetal (SOC-10251)
  • Update to version 9.0+git.1568835830.10c9689:

    • Ensure Manila services don't auto start on reboot (SOC-10641)
  • Update to version 9.0+git.1567695427.5974ab2:

    • Stop existing mon-api services during upgrade (SOC-10470)
  • Update to version 9.0+git.1568817582.a4813e2:

    • Fix neutron-ovsvapp-agent status (SOC-10637)
  • Update to version 9.0+git.1567606982.697a2bf:

    • Let SDNs configure LB service provider (SOC-9900)
  • Update to version 9.0+git.1567606981.c612be8:

    • API extension paths separated by colon (SOC-10447)
  • Update to version 9.0+git.1567000278.309171b:

    • Neutron 8to9 upgrade workflow (SOC-10080)
  • Update to version 9.0+git.1566503987.df6961f:

    • Add policy.d/neutron-fwaas.json.j2 (SOC-10280)
  • Update to version 9.0+git.1567630824.aa6dc2d:

    • api_db sync needed before db_expand.yml (SOC-10023)
  • Update to version 9.0+git.1567125466.9b151d6:

    • Enable tls channel for vnc on compute VM (SOC-9942)
  • Update to version 9.0+git.1566826931.741980f:

    • Install libosinfo package (SOC-10295)
  • Update to version 9.0+git.1568362662.7fba216:

    • Make octavia heartbeat frequency options configurable (SOC-9285)
  • Update to version 9.0+git.1566374458.f58d2bb:

    • Include SES variables when configuring image (SOC-9285)
  • Update to version 9.0+git.1566593422.813e56c:

    • Update ip address validator (SOC-9679)
  • Update to version 9.0+git.1567630791.5ca70a6:

    • Revert Ansible 2.x compatibility change (SOC-10452)
  • Update to version 9.0+git.1567553292.5991a87:

    • Configured openvswitch logrotate user based on system settings (SOC-10282)
  • Update to version 9.0+git.1569439941.6800991:

    • Re-enable streaming of playbook logs (SOC-10720)
  • Update to version 9.0+git.1569257240.456c4fc:

    • Add condition to avoid case with no compute (SOC-10692)
  • Update to version 9.0+git.1568075665.a627f71:

    • Fix missing key error for c9 update (SOC-10476)
  • Update to version 9.0+git.1567640139.61bbe4e:

    • Add support for redhat compute (SOC-9942)
  • Update to version 9.0+git.1567530252.4b0dc66:

    • Generate vnc server cert on compute host (SOC-9942)
  • Update to version 6.0+git.1569587091.3f083d63c:

    • barclamp_lib: Sync timeout with other barclamps (SOC-10513, SOC-10011)
    • Revert 'batch: Use easy_merge for merging (SOC-10505)'
    • batch: Use easy_merge for merging (SOC-10505)
  • Update to version 6.0+git.1569357869.75e2690cc:

    • Update input group to be more specific (SOC-10644)
  • Update to version 6.0+git.1569231374.0fa522d5d:

    • Revert 'batch: Use easy_merge for merging (SOC-10505)'
  • Update to version 6.0+git.1568968829.f21efcf5e:

    • batch: Use easy_merge for merging (SOC-10505)
  • Update to version 6.0+git.1568744770.09e7a1fe1:

    • upgrade: Fix pie chart colors on dashboard (SOC-10619)
  • Update to version 6.0+git.1568201547.4dfc6ffec:

    • gems: Update easy_diff to 1.0.0 (SOC-10505)
  • Update to version 6.0+git.1567846948.0f169d133:

    • upgrade: Reload nova services early (SOC-10273)
    • upgrade: Update release name (trivial)
    • upgrade: Upgrade compute services early (SOC-10273)
  • Update to version 6.0+git.1567731275.6019e8f62:

    • IPV6:Expose methods in chef NetworkHelper to crowbar_framework (SOC-6397)
  • Update to version 6.0+git.1567694723.1a9df112d:

    • Allow designate rndc for all nodes (SOC-10339)
  • Update to version 6.0+git.1567599465.9b1ea2814:

    • upgrade: dump Monasca, Grafana databases (SOC-9772)
  • Update to version 6.0+git.1567195728.44b7cf1d0:

    • Public ips for dns nodes when designate integration is in use (SOC-9635)
  • Update to version 6.0+git.1567161357.ba5de8885:

    • network: Check existing upper layers before bond setup (bsc#1120657)
    • network: never plug two interface into the same ovs bridge (bsc#1120657)
    • network: Avoid plugging the same interface to two ovs bridges (bsc#1120657)
    • nic library: some helper for identifying base interface (bsc#1120657)
    • network: Rework the vlan port replugging code (bsc#1120657)
    • network: DRY out 'kill_nic_files' (noref)
    • network: override sysctl netfilter param(SOC-6229)
  • Update to version 6.0+git.1567094352.24e2a710d:

    • upgrade: Re-run upgrade on non-compute nodes (SOC-10072)
  • Update to version 6.0+git.1566808212.3e1e65b69:

    • allow user to ask for FQDN as public hostname (SOC-9616)
  • Update to version 6.0+git.1567673476.1342c3d:

    • Fix typo in error message
  • Update to version 6.0+git.1569805311.a94583476:

    • Designate: Add dns_domain_ports config (SOC-10740)
  • Update to version 6.0+git.1569429613.2b29fd9d6:

    • horizon: add back horizon service reload (SOC-10191)
    • helper:move config_for_role_exists from horizon to crowbar-openstack(SOC-10191)
    • tempest: don't rely on service catalogue (SOC-10633)
  • Update to version 6.0+git.1569343076.e8ca90fd9:

    • enable LDAP chase_referrals configuration (SOC-7364)
  • Update to version 6.0+git.1569255523.d14bb0d9d:

    • nova: Don't autoselect nodes for Xen (continued) (bsc#1147144)
  • Update to version 6.0+git.1569053948.d0e638900:

    • Ad

Which versions are affected by SUSE-SU-2019:2562-1?

Linux distribution packages (40)
ansible1 SUSE:OpenStack Cloud 9All versions1.9.6-9.3.1
ardana-ansible SUSE:OpenStack Cloud 9All versions9.0+git.1568385829.54601ac-3.10.1
ardana-cluster SUSE:OpenStack Cloud 9All versions9.0+git.1568150980.027f167-3.10.1
ardana-db SUSE:OpenStack Cloud 9All versions9.0+git.1568382922.6f2cea4-3.10.1
ardana-extensions-nsx SUSE:OpenStack Cloud 9All versions9.0+git.1568830037.2eea267-11.1
ardana-glance SUSE:OpenStack Cloud 9All versions9.0+git.1567000146.4569d10-3.10.1
ardana-input-model SUSE:OpenStack Cloud 9All versions9.0+git.1566409257.eec6360-3.10.1
ardana-installer-ui SUSE:OpenStack Cloud 9All versions9.0+git.1569535129.ca87ef0-3.10.1
ardana-manila SUSE:OpenStack Cloud 9All versions9.0+git.1568835830.10c9689-3.6.1
ardana-monasca SUSE:OpenStack Cloud 9All versions9.0+git.1567695427.5974ab2-3.10.1
ardana-neutron SUSE:OpenStack Cloud 9All versions9.0+git.1568817582.a4813e2-3.10.1
ardana-nova SUSE:OpenStack Cloud 9All versions9.0+git.1567630824.aa6dc2d-3.10.1
ardana-octavia SUSE:OpenStack Cloud 9All versions9.0+git.1568362662.7fba216-3.10.1
ardana-opsconsole-ui SUSE:OpenStack Cloud 9All versions9.0+git.1566593422.813e56c-4.10.1
ardana-osconfig SUSE:OpenStack Cloud 9All versions9.0+git.1567630791.5ca70a6-3.10.1
ardana-service SUSE:OpenStack Cloud 9All versions9.0+git.1569439941.6800991-3.10.1
ardana-tls SUSE:OpenStack Cloud 9All versions9.0+git.1569257240.456c4fc-3.6.1
grafana SUSE:OpenStack Cloud 9All versions6.2.5-3.6.1
novnc SUSE:OpenStack Cloud 9All versions1.1.0-3.3.1
openstack-cinder SUSE:OpenStack Cloud 9All versions13.0.7~dev16-3.10.2
openstack-dashboard SUSE:OpenStack Cloud 9All versions14.0.4~dev11-3.6.2
openstack-designate SUSE:OpenStack Cloud 9All versions7.0.1~dev22-3.10.2
openstack-glance SUSE:OpenStack Cloud 9All versions17.0.1~dev30-3.3.2
openstack-heat SUSE:OpenStack Cloud 9All versions11.0.3~dev23-3.10.2
openstack-horizon-plugin-heat-ui SUSE:OpenStack Cloud 9All versions1.4.1~dev4-4.6.1
openstack-horizon-plugin-monasca-ui SUSE:OpenStack Cloud 9All versions1.14.1~dev9-3.6.1
openstack-ironic SUSE:OpenStack Cloud 9All versions11.1.4~dev15-3.10.2
openstack-ironic-python-agent SUSE:OpenStack Cloud 9All versions3.3.3~dev5-3.10.2
openstack-keystone SUSE:OpenStack Cloud 9All versions14.1.1~dev16-3.10.2
openstack-manila SUSE:OpenStack Cloud 9All versions7.3.1~dev6-4.10.2
openstack-neutron SUSE:OpenStack Cloud 9All versions13.0.5~dev50-3.10.2
openstack-neutron-gbp SUSE:OpenStack Cloud 9All versions5.0.1~dev472-3.10.2
openstack-nova SUSE:OpenStack Cloud 9All versions18.2.3~dev22-3.10.2
openstack-octavia SUSE:OpenStack Cloud 9All versions3.1.2~dev45-3.10.2
openstack-sahara SUSE:OpenStack Cloud 9All versions9.0.2~dev12-3.3.2
openstack-tempest SUSE:OpenStack Cloud 9All versions19.0.0-15.2
openstack-watcher SUSE:OpenStack Cloud 9All versions1.12.1~dev19-4.3.2
python-ardana-configurationprocessor SUSE:OpenStack Cloud 9All versions9.0+git.1568955483.5f039e4-3.11.1
python-cinder-tempest-plugin SUSE:OpenStack Cloud 9All versions0.1.0-11.1
python-urllib3 SUSE:OpenStack Cloud 9All versions1.23-3.9.1

How do I fix SUSE-SU-2019:2562-1?

Apply the vendor's patch.

Is SUSE-SU-2019:2562-1 being exploited?

There is no known exploitation of SUSE-SU-2019:2562-1 in the wild and no public exploit code.

Sources

Is SUSE-SU-2019:2562-1 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free