# SUSE-SU-2019:2562-1: This update for ansible1, ardana-ansible, ardana-cluster, ardana-db, ardana-extensions-nsx, ardana-glance, ardana-input-model, ardana-instal

> Security update for SUSE OpenStack Cloud components addressing IPv6 handling and other issues.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not stated
- **Attackable:** Not stated
- **Victim action needed:** Not stated
- **Fix available:** Yes
- **Published:** 4 Oct 2019

## What is SUSE-SU-2019:2562-1?

SUSE-SU-2019:2562-1 is a vulnerability in ansible1, published on 4 Oct 2019. 

### Official description

This update for ansible1, ardana-ansible, ardana-cluster, ardana-db, ardana-extensions-nsx, ardana-glance, ardana-input-model, ardana-installer-ui, ardana-manila, ardana-monasca, ardana-neutron, ardana-nova, ardana-octavia, ardana-opsconsole-ui, ardana-osconfig, ardana-service, ardana-tls, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, grafana, novnc, openstack-cinder, openstack-dashboard, openstack-designate, openstack-glance, openstack-heat, openstack-horizon-plugin-heat-ui, openstack-horizon-plugin-monasca-ui, openstack-ironic, openstack-ironic-python-agent, openstack-keystone, openstack-manila, openstack-neutron, openstack-neutron-gbp, openstack-nova, openstack-octavia, openstack-sahara, openstack-tempest, openstack-watcher, python-ardana-configurationprocessor, python-cinder-tempest-plugin, python-urllib3, rubygem-easy_diff contains the following fixes:

- 0004-add_ipv6_support_to_synchronize_action_plugin.patch
  fixes: bsc#1145967 

  IPv6 addreses need to be wrapped when used in scp command
  in the form scp user@[ipv6address]:port 
  SOC-10117

- Update to version 9.0+git.1568385829.54601ac:
  * Enable Cloud9 parallelised upgrade workflow (SOC-10484)

- Update to version 9.0+git.1568379640.07c5144:
  * Enable DB upgrade in ardana-update.yml (SOC-10094)

- Update to version 9.0+git.1567617871.4426809:
  * Ensure tls-upgrade.yml called by ardana-update.yml (SOC-9942)

- Update to version 9.0+git.1566486136.e2f6b0f:
  * Add deprecations cleanup support (SOC-10275)

- Update to version 9.0+git.1568150980.027f167:
  * Enable auth_openidc Apache2 module (SOC-10509)

- Update to version 9.0+git.1568382922.6f2cea4:
  * Use galera-upgrade.yml for update/upgrade workflow (SOC-10521)

- Update to version 9.0+git.1568830037.2eea267:
  * Add missing DHCP options for NSX-T (SOC-5838)

- Update to version 9.0+git.1568307751.d68a198:
  * Add NSX-T QoS service definition (SOC-10479)

- Update to version 9.0+git.1567606893.85b4d54:
  * Add NSX-T LBaaS service definition (SOC-9900)

- Update to version 9.0+git.1567416354.e45fd54:
  * Add missing policies for NSX-T (SOC-5831)

- Update to version 9.0+git.1567196895.2e056b5:
  * Add NSX-T VPNaaS service definition (SOC-9935)
  * Add NSX-T FWaaS service definition (SOC-9935)

- Update to version 9.0+git.1567196861.0ca4cc9:
  * Add the NSX-T DNS service definition (SOC-9912)

- Update to version 9.0+git.1567196262.39a7dd0:
  * Improvements over initial NSX-T support (SOC-5831)

- Update to version 9.0+git.1566918834.1b7a49a:
  * Update policy json templates for vmware-nsx (SOC-10254)

- Update to version 9.0+git.1567000146.4569d10:
  * Cloud 8to9 upgrade enhancements for glance (SOC-10043)

- Update to version 9.0+git.1566409257.eec6360:
  * Add neutron-fwaas.json when neutron-l3-agent is deployed (SOC-10280)

- Update to version 9.0+git.1569535129.ca87ef0:
  * Add support for running in Docker container (SOC-8524) (#350)

- Update to version 9.0+git.1567797529.273abf2:
  * Use IPv6 validator on baremetal (SOC-10251)

- Update to version 9.0+git.1568835830.10c9689:
  * Ensure Manila services don't auto start on reboot (SOC-10641)

- Update to version 9.0+git.1567695427.5974ab2:
  * Stop existing mon-api services during upgrade (SOC-10470)

- Update to version 9.0+git.1568817582.a4813e2:
  * Fix neutron-ovsvapp-agent status (SOC-10637)

- Update to version 9.0+git.1567606982.697a2bf:
  * Let SDNs configure LB service provider (SOC-9900)

- Update to version 9.0+git.1567606981.c612be8:
  * API extension paths separated by colon (SOC-10447)

- Update to version 9.0+git.1567000278.309171b:
  * Neutron 8to9 upgrade workflow (SOC-10080)

- Update to version 9.0+git.1566503987.df6961f:
  * Add policy.d/neutron-fwaas.json.j2 (SOC-10280)

- Update to version 9.0+git.1567630824.aa6dc2d:
  * api_db sync needed before db_expand.yml (SOC-10023)

- Update to version 9.0+git.1567125466.9b151d6:
  * Enable tls channel for vnc on compute VM (SOC-9942)

- Update to version 9.0+git.1566826931.741980f:
  * Install libosinfo package (SOC-10295)

- Update to version 9.0+git.1568362662.7fba216:
  * Make octavia heartbeat frequency options configurable (SOC-9285)

- Update to version 9.0+git.1566374458.f58d2bb:
  * Include SES variables when configuring image (SOC-9285)

- Update to version 9.0+git.1566593422.813e56c:
  * Update ip address validator (SOC-9679)

- Update to version 9.0+git.1567630791.5ca70a6:
  * Revert Ansible 2.x compatibility change (SOC-10452)

- Update to version 9.0+git.1567553292.5991a87:
  * Configured openvswitch logrotate user based on system settings (SOC-10282)

- Update to version 9.0+git.1569439941.6800991:
  * Re-enable streaming of playbook logs (SOC-10720)

- Update to version 9.0+git.1569257240.456c4fc:
  * Add condition to avoid case with no compute (SOC-10692)

- Update to version 9.0+git.1568075665.a627f71:
  * Fix missing key error for c9 update (SOC-10476)

- Update to version 9.0+git.1567640139.61bbe4e:
  * Add support for redhat compute (SOC-9942)

- Update to version 9.0+git.1567530252.4b0dc66:
  * Generate vnc server cert on compute host (SOC-9942)

- Update to version 6.0+git.1569587091.3f083d63c:
  * barclamp_lib: Sync timeout with other barclamps (SOC-10513, SOC-10011)
  * Revert 'batch: Use easy_merge for merging (SOC-10505)'
  * batch: Use easy_merge for merging (SOC-10505)

- Update to version 6.0+git.1569357869.75e2690cc:
  * Update input group to be more specific (SOC-10644)

- Update to version 6.0+git.1569231374.0fa522d5d:
  * Revert 'batch: Use easy_merge for merging (SOC-10505)'

- Update to version 6.0+git.1568968829.f21efcf5e:
  * batch: Use easy_merge for merging (SOC-10505)

- Update to version 6.0+git.1568744770.09e7a1fe1:
  * upgrade: Fix pie chart colors on dashboard (SOC-10619)

- Update to version 6.0+git.1568201547.4dfc6ffec:
  * gems: Update easy_diff to 1.0.0 (SOC-10505)

- Update to version 6.0+git.1567846948.0f169d133:
  * upgrade: Reload nova services early (SOC-10273)
  * upgrade: Update release name (trivial)
  * upgrade: Upgrade compute services early (SOC-10273)

- Update to version 6.0+git.1567731275.6019e8f62:
  * IPV6:Expose methods in chef NetworkHelper to crowbar_framework (SOC-6397)

- Update to version 6.0+git.1567694723.1a9df112d:
  * Allow designate rndc for all nodes (SOC-10339)

- Update to version 6.0+git.1567599465.9b1ea2814:
  * upgrade: dump Monasca, Grafana databases (SOC-9772)

- Update to version 6.0+git.1567195728.44b7cf1d0:
  * Public ips for dns nodes when designate integration is in use (SOC-9635)

- Update to version 6.0+git.1567161357.ba5de8885:
  * network: Check existing upper layers before bond setup  (bsc#1120657)
  * network: never plug two interface into the same ovs bridge (bsc#1120657)
  * network: Avoid plugging the same interface to two ovs bridges (bsc#1120657)
  * nic library: some helper for identifying base interface (bsc#1120657)
  * network: Rework the vlan port replugging code (bsc#1120657)
  * network: DRY out 'kill_nic_files' (noref)
  * network: override sysctl netfilter param(SOC-6229)

- Update to version 6.0+git.1567094352.24e2a710d:
  * upgrade: Re-run upgrade on non-compute nodes (SOC-10072)

- Update to version 6.0+git.1566808212.3e1e65b69:
  * allow user to ask for FQDN as public hostname (SOC-9616)

- Update to version 6.0+git.1567673476.1342c3d:
  * Fix typo in error message

- Update to version 6.0+git.1569805311.a94583476:
  * Designate: Add dns_domain_ports config (SOC-10740)

- Update to version 6.0+git.1569429613.2b29fd9d6:
  * horizon: add back horizon service reload (SOC-10191)
  * helper:move config_for_role_exists from horizon to crowbar-openstack(SOC-10191)
  * tempest: don't rely on service catalogue (SOC-10633)

- Update to version 6.0+git.1569343076.e8ca90fd9:
  * enable LDAP chase_referrals configuration (SOC-7364)

- Update to version 6.0+git.1569255523.d14bb0d9d:
  * nova: Don't autoselect nodes for Xen (continued) (bsc#1147144)

- Update to version 6.0+git.1569053948.d0e638900:
  * Ad

## Which versions are affected by SUSE-SU-2019:2562-1?


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `ansible1` | SUSE:OpenStack Cloud 9 | All versions | 1.9.6-9.3.1 |
| `ardana-ansible` | SUSE:OpenStack Cloud 9 | All versions | 9.0+git.1568385829.54601ac-3.10.1 |
| `ardana-cluster` | SUSE:OpenStack Cloud 9 | All versions | 9.0+git.1568150980.027f167-3.10.1 |
| `ardana-db` | SUSE:OpenStack Cloud 9 | All versions | 9.0+git.1568382922.6f2cea4-3.10.1 |
| `ardana-extensions-nsx` | SUSE:OpenStack Cloud 9 | All versions | 9.0+git.1568830037.2eea267-11.1 |
| `ardana-glance` | SUSE:OpenStack Cloud 9 | All versions | 9.0+git.1567000146.4569d10-3.10.1 |
| `ardana-input-model` | SUSE:OpenStack Cloud 9 | All versions | 9.0+git.1566409257.eec6360-3.10.1 |
| `ardana-installer-ui` | SUSE:OpenStack Cloud 9 | All versions | 9.0+git.1569535129.ca87ef0-3.10.1 |
| `ardana-manila` | SUSE:OpenStack Cloud 9 | All versions | 9.0+git.1568835830.10c9689-3.6.1 |
| `ardana-monasca` | SUSE:OpenStack Cloud 9 | All versions | 9.0+git.1567695427.5974ab2-3.10.1 |
| `ardana-neutron` | SUSE:OpenStack Cloud 9 | All versions | 9.0+git.1568817582.a4813e2-3.10.1 |
| `ardana-nova` | SUSE:OpenStack Cloud 9 | All versions | 9.0+git.1567630824.aa6dc2d-3.10.1 |
| `ardana-octavia` | SUSE:OpenStack Cloud 9 | All versions | 9.0+git.1568362662.7fba216-3.10.1 |
| `ardana-opsconsole-ui` | SUSE:OpenStack Cloud 9 | All versions | 9.0+git.1566593422.813e56c-4.10.1 |
| `ardana-osconfig` | SUSE:OpenStack Cloud 9 | All versions | 9.0+git.1567630791.5ca70a6-3.10.1 |
| `ardana-service` | SUSE:OpenStack Cloud 9 | All versions | 9.0+git.1569439941.6800991-3.10.1 |
| `ardana-tls` | SUSE:OpenStack Cloud 9 | All versions | 9.0+git.1569257240.456c4fc-3.6.1 |
| `grafana` | SUSE:OpenStack Cloud 9 | All versions | 6.2.5-3.6.1 |
| `novnc` | SUSE:OpenStack Cloud 9 | All versions | 1.1.0-3.3.1 |
| `openstack-cinder` | SUSE:OpenStack Cloud 9 | All versions | 13.0.7~dev16-3.10.2 |
| `openstack-dashboard` | SUSE:OpenStack Cloud 9 | All versions | 14.0.4~dev11-3.6.2 |
| `openstack-designate` | SUSE:OpenStack Cloud 9 | All versions | 7.0.1~dev22-3.10.2 |
| `openstack-glance` | SUSE:OpenStack Cloud 9 | All versions | 17.0.1~dev30-3.3.2 |
| `openstack-heat` | SUSE:OpenStack Cloud 9 | All versions | 11.0.3~dev23-3.10.2 |
| `openstack-horizon-plugin-heat-ui` | SUSE:OpenStack Cloud 9 | All versions | 1.4.1~dev4-4.6.1 |
| `openstack-horizon-plugin-monasca-ui` | SUSE:OpenStack Cloud 9 | All versions | 1.14.1~dev9-3.6.1 |
| `openstack-ironic` | SUSE:OpenStack Cloud 9 | All versions | 11.1.4~dev15-3.10.2 |
| `openstack-ironic-python-agent` | SUSE:OpenStack Cloud 9 | All versions | 3.3.3~dev5-3.10.2 |
| `openstack-keystone` | SUSE:OpenStack Cloud 9 | All versions | 14.1.1~dev16-3.10.2 |
| `openstack-manila` | SUSE:OpenStack Cloud 9 | All versions | 7.3.1~dev6-4.10.2 |
| `openstack-neutron` | SUSE:OpenStack Cloud 9 | All versions | 13.0.5~dev50-3.10.2 |
| `openstack-neutron-gbp` | SUSE:OpenStack Cloud 9 | All versions | 5.0.1~dev472-3.10.2 |
| `openstack-nova` | SUSE:OpenStack Cloud 9 | All versions | 18.2.3~dev22-3.10.2 |
| `openstack-octavia` | SUSE:OpenStack Cloud 9 | All versions | 3.1.2~dev45-3.10.2 |
| `openstack-sahara` | SUSE:OpenStack Cloud 9 | All versions | 9.0.2~dev12-3.3.2 |
| `openstack-tempest` | SUSE:OpenStack Cloud 9 | All versions | 19.0.0-15.2 |
| `openstack-watcher` | SUSE:OpenStack Cloud 9 | All versions | 1.12.1~dev19-4.3.2 |
| `python-ardana-configurationprocessor` | SUSE:OpenStack Cloud 9 | All versions | 9.0+git.1568955483.5f039e4-3.11.1 |
| `python-cinder-tempest-plugin` | SUSE:OpenStack Cloud 9 | All versions | 0.1.0-11.1 |
| `python-urllib3` | SUSE:OpenStack Cloud 9 | All versions | 1.23-3.9.1 |

## How do I fix SUSE-SU-2019:2562-1?

Apply the vendor's patch.

## Is SUSE-SU-2019:2562-1 being exploited?

There is no known exploitation of SUSE-SU-2019:2562-1 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for SUSE-SU-2019:2562-1 and fix it if it is affected.

What it is: SUSE-SU-2019:2562-1 is a vulnerability in ansible1, published on 4 Oct 2019. 
Exploitation: There is no known exploitation of SUSE-SU-2019:2562-1 in the wild and no public exploit code.

Affected product: ansible1. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/SUSE-SU-2019-2562-1/ (Markdown: https://insights.sbomify.com/SUSE-SU-2019-2562-1/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/SUSE-SU-2019:2562-1

---
From sbomify Insights: https://insights.sbomify.com/SUSE-SU-2019-2562-1/
Summaries are generated and may contain mistakes; the official description above is the record.