Security update for kubernetes-salt, velum

Announcement ID: SUSE-SU-2018:3073-1
Rating: moderate
References:
Cross-References:
CVSS scores:
  • CVE-2018-3760 ( SUSE ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  • CVE-2018-3760 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products:
  • SUSE CaaS Platform 3.0

An update that solves one vulnerability and has two security fixes can now be installed.

Description:

This update for rubygem-sprockets to version 3.7.2 and velum fixes the following issues:

This security issue was fixed in rubygem-sprockets:

  • CVE-2018-3760: Specially crafted requests could have been be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production (bsc#1098369)

These non-security issues were fixed in velum:

  • Fix external auth group mapping for group attr name. (bsc#1109320)
  • Add configmap from pillar data to dex ldap connectors (fate#324601)
  • Backport of LDAP external auth feature (fate#324601)
  • Allow the user to upload a certificate via file (bsc#1097753)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE CaaS Platform 3.0
    To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way.

Package List:

  • SUSE CaaS Platform 3.0 (noarch)
    • kubernetes-salt-3.0.0+git_r855_633c667-3.12.6
  • SUSE CaaS Platform 3.0 (x86_64)
    • sles12-velum-image-3.1.2-3.11.30

References: