SUSE-SU-2018:3073-1: moderate: Security update for kubernetes-salt, velum

sle-updates at sle-updates at
Mon Oct 8 10:08:04 MDT 2018

   SUSE Security Update: Security update for kubernetes-salt, velum

Announcement ID:    SUSE-SU-2018:3073-1
Rating:             moderate
References:         #1097753 #1098369 #1109320 
Cross-References:   CVE-2018-3760
Affected Products:
                    SUSE CaaS Platform 3.0

   An update that solves one vulnerability and has two fixes
   is now available.


   This update for rubygem-sprockets to version 3.7.2 and velum fixes the
   following issues:

   This security issue was fixed in rubygem-sprockets:

   - CVE-2018-3760: Specially crafted requests could have been be used to
     access files that exists on the filesystem that is outside an
     application's root directory, when the Sprockets server is used in
     production (bsc#1098369)

   These non-security issues were fixed in velum:

   - Fix external auth group mapping for group attr name. (bsc#1109320)
   - Add configmap from pillar data to dex ldap connectors (fate#324601)
   - Backport of LDAP external auth feature (fate#324601)
   - Allow the user to upload a certificate via file (bsc#1097753)

Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE CaaS Platform 3.0:

      To install this update, use the SUSE CaaS Platform Velum dashboard.
      It will inform you if it detects new updates and let you then trigger
      updating of the complete cluster in a controlled way.

Package List:

   - SUSE CaaS Platform 3.0 (noarch):


   - SUSE CaaS Platform 3.0 (x86_64):



More information about the sle-updates mailing list