SUSE-SU-2020:0311-1: critical: Security update for crowbar-core, crowbar-openstack, openstack-neutron-fwaas, rubygem-crowbar-client

[sle-updates at lists.suse.com]

   SUSE Security Update: Security update for crowbar-core, crowbar-openstack, openstack-neutron-fwaas, rubygem-crowbar-client
______________________________________________________________________________

Announcement ID:    SUSE-SU-2020:0311-1
Rating:             critical
References:         #1117080 #1160048 
Cross-References:   CVE-2018-17954 CVE-2019-16770
Affected Products:
                    SUSE OpenStack Cloud 7
______________________________________________________________________________

   An update that fixes two vulnerabilities is now available.

Description:

   This update for crowbar-core, crowbar-openstack, openstack-neutron-fwaas,
   rubygem-crowbar-client  contains the following fixes:

   Security fixes for rubygem-crowbar-client:

   - CVE-2018-17954: Fixed an issue where crowbar was leaking the secret
     admin passwords to all nodes (bsc#1117080)

   Changes in crowbar-core:
   - Update to version 4.0+git.1578392992.fabfd186c:
     * Avoid nil crash when provisioner attributes are not set (bsc#1160048)

   - Update to version 4.0+git.1578294389.acc7385d5:
     * Adding CVE-2019-16770 to the ignore list, regarding SOC-10999.

   Changes in crowbar-openstack:
   - Update to version 4.0+git.1579171175.d53ab6363:
     * tempest: tempest run filters as templates (SOC-11052)
     * Add tempest filters based on services (SOC-9801)

   Changes in openstack-neutron-fwaas:
   - Remove the patch that was deleting the tempest entry point and enable
     tempest tests.


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE OpenStack Cloud 7:

      zypper in -t patch SUSE-OpenStack-Cloud-7-2020-311=1



Package List:

   - SUSE OpenStack Cloud 7 (aarch64 s390x x86_64):

      crowbar-core-4.0+git.1578392992.fabfd186c-9.63.1
      crowbar-core-branding-upstream-4.0+git.1578392992.fabfd186c-9.63.1
      ruby2.1-rubygem-crowbar-client-3.9.1-7.17.1

   - SUSE OpenStack Cloud 7 (noarch):

      crowbar-openstack-4.0+git.1579171175.d53ab6363-9.68.1
      openstack-neutron-fwaas-9.0.2~dev5-4.6.1
      openstack-neutron-fwaas-doc-9.0.2~dev5-4.6.1
      python-neutron-fwaas-9.0.2~dev5-4.6.1


References:

   https://www.suse.com/security/cve/CVE-2018-17954.html
   https://www.suse.com/security/cve/CVE-2019-16770.html
   https://bugzilla.suse.com/1117080
   https://bugzilla.suse.com/1160048