-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2017.1378
  SUSE Security Update: Security update for several openstack-components
                                1 June 2017

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:          SUSE OpenStack Cloud 7
Publisher:        SUSE
Operating System: SUSE
Impact/Access:    Access Privileged Data -- Existing Account
                  Cross-site Scripting   -- Existing Account
Resolution:       Patch/Upgrade
CVE Names:        CVE-2017-7400 CVE-2017-7214 

- --------------------------BEGIN INCLUDED TEXT--------------------

   SUSE Security Update: Security update for several openstack-components
______________________________________________________________________________

Announcement ID:    SUSE-SU-2017:1443-1
Rating:             important
References:         #1024328 #1030406 #1032322 
Cross-References:   CVE-2017-7214 CVE-2017-7400
Affected Products:
                    SUSE OpenStack Cloud 7
______________________________________________________________________________

   An update that solves two vulnerabilities and has one
   errata is now available.

Description:


   This update for openstack-ceilometer, -cinder, -dashboard, -glance, -heat,
   -keystone, -manila, -magnum and
   -novaopenstack-keystone provides the latest code from OpenStack Newton.

   - nova: Add release note that legacy notification exception contexts
     appearing in ERROR level logs may include sensitive information such as
     account passwords and authorization tokens. (bsc#1030406, CVE-2017-7214)
   - nova: Remove PrivTmp from openstack-nova-compute service. (bsc#1024328)
   - dashboard: Remove dangerous safestring declaration. (bsc#1032322,
     CVE-2017-7400)


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE OpenStack Cloud 7:

      zypper in -t patch SUSE-OpenStack-Cloud-7-2017-882=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE OpenStack Cloud 7 (noarch):

      openstack-ceilometer-7.0.4~a0~dev7-3.1
      openstack-ceilometer-agent-central-7.0.4~a0~dev7-3.1
      openstack-ceilometer-agent-compute-7.0.4~a0~dev7-3.1
      openstack-ceilometer-agent-ipmi-7.0.4~a0~dev7-3.1
      openstack-ceilometer-agent-notification-7.0.4~a0~dev7-3.1
      openstack-ceilometer-api-7.0.4~a0~dev7-3.1
      openstack-ceilometer-collector-7.0.4~a0~dev7-3.1
      openstack-ceilometer-doc-7.0.4~a0~dev7-3.2
      openstack-ceilometer-polling-7.0.4~a0~dev7-3.1
      openstack-cinder-9.1.5~a0~dev1-3.1
      openstack-cinder-api-9.1.5~a0~dev1-3.1
      openstack-cinder-backup-9.1.5~a0~dev1-3.1
      openstack-cinder-doc-9.1.5~a0~dev1-3.1
      openstack-cinder-scheduler-9.1.5~a0~dev1-3.1
      openstack-cinder-volume-9.1.5~a0~dev1-3.1
      openstack-dashboard-10.0.4~a0~dev2-3.1
      openstack-glance-13.0.1~a0~dev6-3.1
      openstack-glance-api-13.0.1~a0~dev6-3.1
      openstack-glance-doc-13.0.1~a0~dev6-3.3
      openstack-glance-glare-13.0.1~a0~dev6-3.1
      openstack-glance-registry-13.0.1~a0~dev6-3.1
      openstack-heat-7.0.4~a0~dev4-4.1
      openstack-heat-api-7.0.4~a0~dev4-4.1
      openstack-heat-api-cfn-7.0.4~a0~dev4-4.1
      openstack-heat-api-cloudwatch-7.0.4~a0~dev4-4.1
      openstack-heat-doc-7.0.4~a0~dev4-4.2
      openstack-heat-engine-7.0.4~a0~dev4-4.1
      openstack-heat-plugin-heat_docker-7.0.4~a0~dev4-4.1
      openstack-heat-test-7.0.4~a0~dev4-4.1
      openstack-keystone-10.0.2~a0~dev2-6.1
      openstack-keystone-doc-10.0.2~a0~dev2-6.2
      openstack-magnum-3.1.2~a0~dev22-13.1
      openstack-magnum-api-3.1.2~a0~dev22-13.1
      openstack-magnum-conductor-3.1.2~a0~dev22-13.1
      openstack-magnum-doc-3.1.2~a0~dev22-13.1
      openstack-manila-3.0.1~a0~dev27-3.1
      openstack-manila-api-3.0.1~a0~dev27-3.1
      openstack-manila-data-3.0.1~a0~dev27-3.1
      openstack-manila-doc-3.0.1~a0~dev27-3.1
      openstack-manila-scheduler-3.0.1~a0~dev27-3.1
      openstack-manila-share-3.0.1~a0~dev27-3.1
      openstack-nova-14.0.6~a0~dev16-3.1
      openstack-nova-api-14.0.6~a0~dev16-3.1
      openstack-nova-cells-14.0.6~a0~dev16-3.1
      openstack-nova-cert-14.0.6~a0~dev16-3.1
      openstack-nova-compute-14.0.6~a0~dev16-3.1
      openstack-nova-conductor-14.0.6~a0~dev16-3.1
      openstack-nova-console-14.0.6~a0~dev16-3.1
      openstack-nova-consoleauth-14.0.6~a0~dev16-3.1
      openstack-nova-doc-14.0.6~a0~dev16-3.3
      openstack-nova-novncproxy-14.0.6~a0~dev16-3.1
      openstack-nova-placement-api-14.0.6~a0~dev16-3.1
      openstack-nova-scheduler-14.0.6~a0~dev16-3.1
      openstack-nova-serialproxy-14.0.6~a0~dev16-3.1
      openstack-nova-vncproxy-14.0.6~a0~dev16-3.1
      python-ceilometer-7.0.4~a0~dev7-3.1
      python-cinder-9.1.5~a0~dev1-3.1
      python-glance-13.0.1~a0~dev6-3.1
      python-heat-7.0.4~a0~dev4-4.1
      python-horizon-10.0.4~a0~dev2-3.1
      python-keystone-10.0.2~a0~dev2-6.1
      python-magnum-3.1.2~a0~dev22-13.1
      python-manila-3.0.1~a0~dev27-3.1
      python-nova-14.0.6~a0~dev16-3.1


References:

   https://www.suse.com/security/cve/CVE-2017-7214.html
   https://www.suse.com/security/cve/CVE-2017-7400.html
   https://bugzilla.suse.com/1024328
   https://bugzilla.suse.com/1030406
   https://bugzilla.suse.com/1032322

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWS9N5Yx+lLeg9Ub1AQjvQw/9GEDFW/zbkS3l4xDwZZBPZOPTgAe1I0nd
MqskJosn5q/JdtOoxW4Yg2s65XWvJvLld+QoVffuCdGdq/KHHWk2hd/ghApYO4Bq
UxskeseXK2htfB0JIq0U13IXNfqty7UCJYykCci53AVZO20BUjvZXhl1u7Ng4K39
dEUdnHR6ruMcHmKy8TOSeTEZIqRe4drXrA7dsd30rj+OKzp00M8Yc5soWbarxsQO
Zvg9JzAqGDhpa/NzL4g9dXSWWszmnCzvGUvBhesE1cH9Jhzyvin7tGzPaM7TfEt9
0rW1AzNPdK4zJyH9oyW0RP6FFwguHjbHKW2wJgA9oYK/rg/aZRorpelVmi1yRtSt
A0BS6Xh82Ra5d/K1eaTRa1KPQ1EEzxV2SiG8CH/QFpRkn4iTIb/Z87ADJFNrSPbP
PPMsurn4LrCr6MoJxcQi4MHmyOOog5+9Cj0cJjEGU5PxbtXugX7V1p0FTprzQWh4
zME94SPgvRjrQEDZTv0ptYJQV2O5nROtfA/uYusBa/OsSCjMOyqhBQm0/mixbopN
oe6l5xwIwB6tW3cnukafS4kXAk6yaZRDALfAYnmNKyGhqBYB3+nrLaTiQiBez9QN
/0D8LxeU+IzSF9zFfLJaIVqhT8daIIFcR5wiDedZVmYMVhwvbTfKp1zVAu3Yi6hL
gWDlUK6l3mc=
=s05E
-----END PGP SIGNATURE-----