Security update for crowbar-core, crowbar-openstack, openstack-neutron-fwaas, rubygem-crowbar-client

SUSE Security Update: Security update for crowbar-core, crowbar-openstack, openstack-neutron-fwaas, rubygem-crowbar-client
Announcement ID: SUSE-SU-2020:0311-1
Rating: critical
References: #1117080 #1160048
Cross-References:CVE-2018-17954 CVE-2019-16770
Affected Products:
  • SUSE OpenStack Cloud 7

An update that fixes two vulnerabilities is now available.

Description:

This update for crowbar-core, crowbar-openstack, openstack-neutron-fwaas, rubygem-crowbar-client contains the following fixes:
Security fixes for rubygem-crowbar-client:

  • CVE-2018-17954: Fixed an issue where crowbar was leaking the secret admin passwords to all nodes (bsc#1117080)

Changes in crowbar-core:
  • Update to version 4.0+git.1578392992.fabfd186c: * Avoid nil crash when provisioner attributes are not set (bsc#1160048)

  • Update to version 4.0+git.1578294389.acc7385d5: * Adding CVE-2019-16770 to the ignore list, regarding SOC-10999.

Changes in crowbar-openstack:
  • Update to version 4.0+git.1579171175.d53ab6363: * tempest: tempest run filters as templates (SOC-11052) * Add tempest filters based on services (SOC-9801)

Changes in openstack-neutron-fwaas:
  • Remove the patch that was deleting the tempest entry point and enable tempest tests.

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE OpenStack Cloud 7:
    zypper in -t patch SUSE-OpenStack-Cloud-7-2020-311=1

Package List:

  • SUSE OpenStack Cloud 7 (aarch64 s390x x86_64):
    • crowbar-core-4.0+git.1578392992.fabfd186c-9.63.1
    • crowbar-core-branding-upstream-4.0+git.1578392992.fabfd186c-9.63.1
    • ruby2.1-rubygem-crowbar-client-3.9.1-7.17.1
  • SUSE OpenStack Cloud 7 (noarch):
    • crowbar-openstack-4.0+git.1579171175.d53ab6363-9.68.1
    • openstack-neutron-fwaas-9.0.2~dev5-4.6.1
    • openstack-neutron-fwaas-doc-9.0.2~dev5-4.6.1
    • python-neutron-fwaas-9.0.2~dev5-4.6.1

References: