SUSE-SU-2018:3073-1: moderate: Security update for kubernetes-salt, velum

[sle-updates at lists.suse.com]

   SUSE Security Update: Security update for kubernetes-salt, velum
______________________________________________________________________________

Announcement ID:    SUSE-SU-2018:3073-1
Rating:             moderate
References:         #1097753 #1098369 #1109320 
Cross-References:   CVE-2018-3760
Affected Products:
                    SUSE CaaS Platform 3.0
______________________________________________________________________________

   An update that solves one vulnerability and has two fixes
   is now available.

Description:


   This update for rubygem-sprockets to version 3.7.2 and velum fixes the
   following issues:

   This security issue was fixed in rubygem-sprockets:

   - CVE-2018-3760: Specially crafted requests could have been be used to
     access files that exists on the filesystem that is outside an
     application's root directory, when the Sprockets server is used in
     production (bsc#1098369)

   These non-security issues were fixed in velum:

   - Fix external auth group mapping for group attr name. (bsc#1109320)
   - Add configmap from pillar data to dex ldap connectors (fate#324601)
   - Backport of LDAP external auth feature (fate#324601)
   - Allow the user to upload a certificate via file (bsc#1097753)


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE CaaS Platform 3.0:

      To install this update, use the SUSE CaaS Platform Velum dashboard.
      It will inform you if it detects new updates and let you then trigger
      updating of the complete cluster in a controlled way.



Package List:

   - SUSE CaaS Platform 3.0 (noarch):

      kubernetes-salt-3.0.0+git_r855_633c667-3.12.6

   - SUSE CaaS Platform 3.0 (x86_64):

      sles12-velum-image-3.1.2-3.11.30


References:

   https://www.suse.com/security/cve/CVE-2018-3760.html
   https://bugzilla.suse.com/1097753
   https://bugzilla.suse.com/1098369
   https://bugzilla.suse.com/1109320