Security update for several openstack-components SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:1966-1 Final 1 1 2016-08-05T09:25:13Z current 2016-08-05T09:25:13Z 2016-08-05T09:25:13Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for several openstack-components This update provides the latest code from OpenStack Liberty for openstack-designate, -ironic, -neutron-vpnaas, -nova-docker, -sahara, -tempest and -trove. Additionally the following security issue has been fixed: openstack-ironic: - Mask password on agent lookup according to policy (bsc#984802, CVE-2016-4985) For a detailed description of all changes, please refer to the changelog. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-OpenStack-Cloud-6-2016-1160 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20161966-1/ Link for SUSE-SU-2016:1966-1 https://lists.suse.com/pipermail/sle-security-updates/2016-August/002179.html E-Mail link for SUSE-SU-2016:1966-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/984802 SUSE Bug 984802 https://bugzilla.suse.com/988729 SUSE Bug 988729 https://www.suse.com/security/cve/CVE-2016-4985/ SUSE CVE CVE-2016-4985 page SUSE OpenStack Cloud 6 openstack-designate-1.0.3~a0~dev10-6.1 openstack-designate-agent-1.0.3~a0~dev10-6.1 openstack-designate-api-1.0.3~a0~dev10-6.1 openstack-designate-central-1.0.3~a0~dev10-6.1 openstack-designate-doc-1.0.3~a0~dev10-6.2 openstack-designate-sink-1.0.3~a0~dev10-6.1 openstack-ironic-4.2.5-6.1 openstack-ironic-api-4.2.5-6.1 openstack-ironic-conductor-4.2.5-6.1 openstack-ironic-doc-4.2.5-6.2 openstack-neutron-vpn-agent-7.0.5~a0~dev3-6.1 openstack-neutron-vpnaas-7.0.5~a0~dev3-6.1 openstack-neutron-vpnaas-doc-7.0.5~a0~dev3-6.1 openstack-nova-docker-0.0.1~a0~dev238-4.1 openstack-sahara-3.0.3~a0~dev1-6.1 openstack-sahara-api-3.0.3~a0~dev1-6.1 openstack-sahara-doc-3.0.3~a0~dev1-6.1 openstack-sahara-engine-3.0.3~a0~dev1-6.1 openstack-tempest-7.0.0-9.1 openstack-tempest-test-7.0.0-9.1 openstack-trove-4.0.1~a0~dev19-8.1 openstack-trove-api-4.0.1~a0~dev19-8.1 openstack-trove-conductor-4.0.1~a0~dev19-8.1 openstack-trove-doc-4.0.1~a0~dev19-8.1 openstack-trove-guestagent-4.0.1~a0~dev19-8.1 openstack-trove-taskmanager-4.0.1~a0~dev19-8.1 python-designate-1.0.3~a0~dev10-6.1 python-ironic-4.2.5-6.1 python-neutron-vpnaas-7.0.5~a0~dev3-6.1 python-sahara-3.0.3~a0~dev1-6.1 python-tempest-7.0.0-9.1 python-trove-4.0.1~a0~dev19-8.1 openstack-designate-1.0.3~a0~dev10-6.1 as a component of SUSE OpenStack Cloud 6 openstack-designate-agent-1.0.3~a0~dev10-6.1 as a component of SUSE OpenStack Cloud 6 openstack-designate-api-1.0.3~a0~dev10-6.1 as a component of SUSE OpenStack Cloud 6 openstack-designate-central-1.0.3~a0~dev10-6.1 as a component of SUSE OpenStack Cloud 6 openstack-designate-doc-1.0.3~a0~dev10-6.2 as a component of SUSE OpenStack Cloud 6 openstack-designate-sink-1.0.3~a0~dev10-6.1 as a component of SUSE OpenStack Cloud 6 openstack-ironic-4.2.5-6.1 as a component of SUSE OpenStack Cloud 6 openstack-ironic-api-4.2.5-6.1 as a component of SUSE OpenStack Cloud 6 openstack-ironic-conductor-4.2.5-6.1 as a component of SUSE OpenStack Cloud 6 openstack-ironic-doc-4.2.5-6.2 as a component of SUSE OpenStack Cloud 6 openstack-neutron-vpn-agent-7.0.5~a0~dev3-6.1 as a component of SUSE OpenStack Cloud 6 openstack-neutron-vpnaas-7.0.5~a0~dev3-6.1 as a component of SUSE OpenStack Cloud 6 openstack-neutron-vpnaas-doc-7.0.5~a0~dev3-6.1 as a component of SUSE OpenStack Cloud 6 openstack-nova-docker-0.0.1~a0~dev238-4.1 as a component of SUSE OpenStack Cloud 6 openstack-sahara-3.0.3~a0~dev1-6.1 as a component of SUSE OpenStack Cloud 6 openstack-sahara-api-3.0.3~a0~dev1-6.1 as a component of SUSE OpenStack Cloud 6 openstack-sahara-doc-3.0.3~a0~dev1-6.1 as a component of SUSE OpenStack Cloud 6 openstack-sahara-engine-3.0.3~a0~dev1-6.1 as a component of SUSE OpenStack Cloud 6 openstack-tempest-7.0.0-9.1 as a component of SUSE OpenStack Cloud 6 openstack-tempest-test-7.0.0-9.1 as a component of SUSE OpenStack Cloud 6 openstack-trove-4.0.1~a0~dev19-8.1 as a component of SUSE OpenStack Cloud 6 openstack-trove-api-4.0.1~a0~dev19-8.1 as a component of SUSE OpenStack Cloud 6 openstack-trove-conductor-4.0.1~a0~dev19-8.1 as a component of SUSE OpenStack Cloud 6 openstack-trove-doc-4.0.1~a0~dev19-8.1 as a component of SUSE OpenStack Cloud 6 openstack-trove-guestagent-4.0.1~a0~dev19-8.1 as a component of SUSE OpenStack Cloud 6 openstack-trove-taskmanager-4.0.1~a0~dev19-8.1 as a component of SUSE OpenStack Cloud 6 python-designate-1.0.3~a0~dev10-6.1 as a component of SUSE OpenStack Cloud 6 python-ironic-4.2.5-6.1 as a component of SUSE OpenStack Cloud 6 python-neutron-vpnaas-7.0.5~a0~dev3-6.1 as a component of SUSE OpenStack Cloud 6 python-sahara-3.0.3~a0~dev1-6.1 as a component of SUSE OpenStack Cloud 6 python-tempest-7.0.0-9.1 as a component of SUSE OpenStack Cloud 6 python-trove-4.0.1~a0~dev19-8.1 as a component of SUSE OpenStack Cloud 6 The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the v1/drivers/$DRIVER_NAME/vendor_passthru resource. CVE-2016-4985 SUSE OpenStack Cloud 6:openstack-designate-1.0.3~a0~dev10-6.1 SUSE OpenStack Cloud 6:openstack-designate-agent-1.0.3~a0~dev10-6.1 SUSE OpenStack Cloud 6:openstack-designate-api-1.0.3~a0~dev10-6.1 SUSE OpenStack Cloud 6:openstack-designate-central-1.0.3~a0~dev10-6.1 SUSE OpenStack Cloud 6:openstack-designate-doc-1.0.3~a0~dev10-6.2 SUSE OpenStack Cloud 6:openstack-designate-sink-1.0.3~a0~dev10-6.1 SUSE OpenStack Cloud 6:openstack-ironic-4.2.5-6.1 SUSE OpenStack Cloud 6:openstack-ironic-api-4.2.5-6.1 SUSE OpenStack Cloud 6:openstack-ironic-conductor-4.2.5-6.1 SUSE OpenStack Cloud 6:openstack-ironic-doc-4.2.5-6.2 SUSE OpenStack Cloud 6:openstack-neutron-vpn-agent-7.0.5~a0~dev3-6.1 SUSE OpenStack Cloud 6:openstack-neutron-vpnaas-7.0.5~a0~dev3-6.1 SUSE OpenStack Cloud 6:openstack-neutron-vpnaas-doc-7.0.5~a0~dev3-6.1 SUSE OpenStack Cloud 6:openstack-nova-docker-0.0.1~a0~dev238-4.1 SUSE OpenStack Cloud 6:openstack-sahara-3.0.3~a0~dev1-6.1 SUSE OpenStack Cloud 6:openstack-sahara-api-3.0.3~a0~dev1-6.1 SUSE OpenStack Cloud 6:openstack-sahara-doc-3.0.3~a0~dev1-6.1 SUSE OpenStack Cloud 6:openstack-sahara-engine-3.0.3~a0~dev1-6.1 SUSE OpenStack Cloud 6:openstack-tempest-7.0.0-9.1 SUSE OpenStack Cloud 6:openstack-tempest-test-7.0.0-9.1 SUSE OpenStack Cloud 6:openstack-trove-4.0.1~a0~dev19-8.1 SUSE OpenStack Cloud 6:openstack-trove-api-4.0.1~a0~dev19-8.1 SUSE OpenStack Cloud 6:openstack-trove-conductor-4.0.1~a0~dev19-8.1 SUSE OpenStack Cloud 6:openstack-trove-doc-4.0.1~a0~dev19-8.1 SUSE OpenStack Cloud 6:openstack-trove-guestagent-4.0.1~a0~dev19-8.1 SUSE OpenStack Cloud 6:openstack-trove-taskmanager-4.0.1~a0~dev19-8.1 SUSE OpenStack Cloud 6:python-designate-1.0.3~a0~dev10-6.1 SUSE OpenStack Cloud 6:python-ironic-4.2.5-6.1 SUSE OpenStack Cloud 6:python-neutron-vpnaas-7.0.5~a0~dev3-6.1 SUSE OpenStack Cloud 6:python-sahara-3.0.3~a0~dev1-6.1 SUSE OpenStack Cloud 6:python-tempest-7.0.0-9.1 SUSE OpenStack Cloud 6:python-trove-4.0.1~a0~dev19-8.1 low 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20161966-1/ https://www.suse.com/security/cve/CVE-2016-4985.html CVE-2016-4985 https://bugzilla.suse.com/984802 SUSE Bug 984802