Skip to content
OpenAdvisories
Critical SUSE-RU-2020:2072-1 31 CVEs

Security update for ansible, crowbar-core, crowbar-ha, crowbar-openstack, etcd, flannel, grafana, keepalived, kibana, memcached, monasca-installer, openstack-dashboard-theme-SUSE, openstack-manila, openstack-neutron-fwaas, openstack-nova, openstack-tempest, python-Django, python-Pillow, python-psql2mysql, python-psutil, python-py, python-pysaml2, python-waitress, rabbitmq-server, release-notes-suse-openstack-cloud, zookeeper

Published Jul 29, 2020 · Updated Feb 4, 2026

Ecosystem: SUSE

Summary

This update for ansible, crowbar-core, crowbar-ha, crowbar-openstack, etcd, flannel, grafana, keepalived, kibana, memcached, monasca-installer, openstack-dashboard-theme-SUSE, openstack-manila, openstack-neutron-fwaas, openstack-nova, openstack-tempest, python-Django, python-Pillow, python-psql2mysql, python-psutil, python-py, python-pysaml2, python-waitress, rabbitmq-server, release-notes-suse-openstack-cloud, zookeeper fixes the following issues:

Security fixes included ins this update:

ansible
- CVE-2019-3828: Fixed a path traversal in the fetch module (bsc#1126503).

grafana
- CVE-2020-13379: Fixed an incorrect access control issue which could
lead to information leaks or denial of service (bsc#1172409).
- CVE-2020-12052: Fixed an cross site scripting vulnerability related to
the annotation popup (bsc#1170657).

kibana
- CVE-2020-10743: Fixed a clickjacking vulnerability (bsc#1171909).

memcached (to version 1.5.17)
- CVE-2019-15026: Fixed a stack-based buffer over-read
in conn_to_str()n (bsc#1149110).
- CVE-2019-11596: Fixed a denial of service in the 'lru' command
(bsc#1133817)
- CVE-2018-1000115: Disabled UDP by default to reduce DDoS amplification
attacks (bsc#1083903).

python-Django
- CVE-2020-13254: Fixed a data leakage via malformed memcached keys
(bsc#1172167).
- CVE-2020-13596: Fixed a cross site scripting vulnerability related to
the admin parameters of the ForeignKeyRawIdWidget (bsc#1172166).
- Fixed a regression with the fix for CVE-2019-3498 (bsc#1161349).

python-Pillow
- CVE-2019-16865: Fixed a denial of service with specially crafted
image files (bsc#1153191).
- CVE-2020-5312: Fixed a buffer overflow in the PCX P mode (bsc#1160152).
- CVE-2020-5313: Fixed a buffer overflow related to FLI (bsc#1160153).
- CVE-2019-19911: Fixed a denial of service in FpxImagePlugin.py
(bsc#1160192).

python-pysaml2
- CVE-2020-5390: Fixed an issue with the verification of signatures in
SAML documents (bsc#1160851)
- CVE-2017-1000246: Fixed an issue with weak encryption data, caused by
initialization vector reuse(bsc#1068612).

python-waitress (to version 1.4.3)
- CVE-2019-16785: Fixed HTTP request smuggling through LF vs CRLF
handling (bsc#1161088).
- CVE-2019-16786: Fixed HTTP request smuggling through invalid
Transfer-Encoding (bsc#1161089).
- CVE-2019-16789: Fixed HTTP Request Smuggling through invalid
whitespace characters (bsc#1160790).
- CVE-2019-16792: Fixed HTTP Request Smuggling through Content-Length
header handling (bsc#1161670).

rubygem-activeresource
- CVE-2020-8151: Fixed information disclosure issue through specially
crafted requests (bsc#1171560)

rubygem-json-1_7
- CVE-2020-10663: Fixed Unsafe Object Creation Vulnerability in JSON
(bsc#1167244)

rubygem-puma
- CVE-2020-11077: Fixed HTTP Request Smuggling through proxy (bsc#1172175)
- CVE-2020-11076: Fixed HTTP Request smuggling through invalid
Transfer-Encoding header.
- CVE-2020-5247: Fixed HTTP Response Splitting through newline characters
handling (bsc#1165402)

zookeeper:
- CVE-2019-0201: Fixed an information disclosure related to
getACL() (bsc#1135773).

Non security fixes included in this update:

Changes in ansible:
- Add 0001-Disallow-use-of-remote-home-directories-containing-..patch
(bsc#1126503, CVE-2019-3828)

Changes in crowbar-core:
- Update to version 4.0+git.1580209654.1d112d31f:
* network: start OVS before wickedd (SOC-11067)

Changes in crowbar-ha:
- Update to version 4.0+git.1585316203.d6ad2c8:
* [4.0] add ssl termination on haproxy (bsc#1149535)

Changes in crowbar-openstack:
- Update to version 4.0+git.1589804581.9972163f0:
* [4.0] magnum: fix check for image/flavor (SOC-11251)

- Update to version 4.0+git.1589647351.ccfd9481f:
* [4.0] trove: fix rabbitmq connection URL (SOC-11286)

- Update to version 4.0+git.1589458214.9f765aa08:
* [4.0] Fix create magnum k8s image and flavor (SOC-11251)

- Update to version 4.0+git.1588271860.131fc8cc1:
* run keystone_register on cluster founder only when HA (SOC-11248)
* nova: run keystone_register on cluster founder only (SOC-11243)

- Update to version 4.0+git.1588096523.679da5c50:
* tempest: retry openstack commands (SOC-11238)

- Update to version 4.0+git.1587129016.c009e43c9:
* Disable magnum.tests.functional.api.v1.test_cluster (SOC-11224)

- Update to version 4.0+git.1587035427.abb6e9b4e:
* Fix barbican SSL support (SOC-9298)

- Update to version 4.0+git.1586421486.5601320b7:
* Fix magnum tempest tests (SOC-9298)

- Update to version 4.0+git.1585331022.609482166:
* tempest: update blacklisted tempest test cases (SOC-9801,SOC-11174,SOC-11187)

- Update to version 4.0+git.1585136604.988f3a1da:
* Disabling failing tempest tests on SOC7
* [4.0] ec2-api: run keystone_register on cluster founder only (SOC-11079)

- Update to version 4.0+git.1582582068.c8c2448c0:
* neutron: Place space between CLI arguments

- Update to version 4.0+git.1580894959.1fe5fd282:
* Revert '[4.0] rabbitmq: sync startup definitions.json with recipe' (SOC-11082)

- Update to version 4.0+git.1580469474.967ab8baf:
* rabbitmq: sync startup definitions.json with recipe (SOC-11077)

Changes in etcd:
- Build against go 1.6

- Fix etcd build. We are generating 2 binaries, etcd and etcdctl.
They need to be built separately

- Ensure /var/lib/etcd is controlled by etcd:etcd

- exclude i586. We don't expect this package to be built on i586.

- remove sysconfig.etcd: this file is not being used

- Update to version 3.1.0:
* raft: add node should reset the pendingConf state
* v3rpc: don't close watcher if client closes send
* e2e: add test for v3 watch over grpc gateway
* mvcc: remove unused restore method
* integration: don't expect recv to stop on CloseSend in waitResponse
* Documentation: add grpc gateway watch example
* version: bump up v3.1.0-rc.1+git
* discovery: warn on scheme mismatch
* grpcproxy: fix deadlock on watch broadcasts stop
* etcdmain: add '/metrics' HTTP/1 path to grpc-proxy
* etcd-tester: do not resolve localhost

Fixed packages 31

ReleasePackageFixed in
SUSE · OpenStack Cloud 7 ansible 2.2.3.0-12.2
SUSE · OpenStack Cloud 7 crowbar-core 4.0+git.1580209654.1d112d31f-9.66.5
SUSE · OpenStack Cloud 7 crowbar-ha 4.0+git.1585316203.d6ad2c8-4.52.4
SUSE · OpenStack Cloud 7 crowbar-openstack 4.0+git.1589804581.9972163f0-9.71.4
SUSE · OpenStack Cloud 7 grafana 4.6.5-1.14.1
SUSE · OpenStack Cloud 7 keepalived 2.0.19-1.8.1
SUSE · OpenStack Cloud 7 kibana 4.6.3-5.1
SUSE · OpenStack Cloud 7 memcached 1.5.17-3.6.1
SUSE · OpenStack Cloud 7 monasca-installer 20180608_12.47-12.1
SUSE · OpenStack Cloud 7 openstack-dashboard-theme-SUSE 2016.2-5.12.4
SUSE · OpenStack Cloud 7 openstack-manila 3.0.1~dev30-4.12.2
SUSE · OpenStack Cloud 7 openstack-manila-doc 3.0.1~dev30-4.12.3
SUSE · OpenStack Cloud 7 openstack-neutron-fwaas 9.0.2~dev5-4.9.3
SUSE · OpenStack Cloud 7 openstack-neutron-fwaas-doc 9.0.2~dev5-4.9.4
SUSE · OpenStack Cloud 7 openstack-nova 14.0.11~dev13-4.40.2
SUSE · OpenStack Cloud 7 openstack-nova-doc 14.0.11~dev13-4.40.2
SUSE · OpenStack Cloud 7 openstack-tempest 12.2.1~a0~dev177-4.9.1
SUSE · OpenStack Cloud 7 python-Django 1.8.19-3.23.1
SUSE · OpenStack Cloud 7 python-Pillow 2.8.1-4.12.1
SUSE · OpenStack Cloud 7 python-psql2mysql 0.5.0+git.1589351878.4ef877c-1.12.1
SUSE · OpenStack Cloud 7 python-psutil 1.2.1-21.1
SUSE · OpenStack Cloud 7 python-py 1.8.1-11.12.1
SUSE · OpenStack Cloud 7 python-pysaml2 4.0.2-3.17.1
SUSE · OpenStack Cloud 7 python-waitress 1.4.3-3.3.1
SUSE · OpenStack Cloud 7 rabbitmq-server 3.4.4-3.16.1
SUSE · OpenStack Cloud 7 release-notes-suse-openstack-cloud 7.20180803-3.18.3
SUSE · OpenStack Cloud 7 rubygem-activeresource 4.0.0-3.3.1
SUSE · OpenStack Cloud 7 rubygem-crowbar-client 3.9.2-7.20.1
SUSE · OpenStack Cloud 7 rubygem-json-1_7 1.7.7-3.3.1
SUSE · OpenStack Cloud 7 rubygem-puma 2.16.0-4.6.1
SUSE · OpenStack Cloud 7 zookeeper 3.4.10-6.1

Vulnerabilities 31

  • Critical 9.8
    CVE-2019-19844 Public exploit EPSS 54%

    Django Potential account hijack via password reset form

    Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a pa…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2020-5312

    PCX P mode buffer overflow in Pillow

    libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.

    pillow pillow pillow py3-pillow Debian Ubuntu Alpine PyPI
  • High 7.5
    CVE-2019-16865

    DOS attack in Pillow when processing specially crafted image files

    An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.

    pillow pillow pillow Debian Ubuntu PyPI
  • High 7.5
    CVE-2019-18874

    Double Free in psutil

    psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.

    psutil python-psutil py-psutil py3-psutil Debian Ubuntu Azure Linux Alpine PyPI
  • High 7.5
    CVE-2019-19911

    Uncontrolled Resource Consumption in Pillow

    There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due …

    pillow pillow pillow py3-pillow Debian Ubuntu Alpine PyPI
  • High 7.5
    CVE-2020-10663 Public exploit

    Unsafe object creation in json RubyGem

    The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within…

    ruby2.3 ruby ruby2.5 json Debian Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2020-11076 Public exploit

    HTTP Smuggling via Transfer-Encoding Header in Puma

    In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.

    puma puma puma puma Debian Ubuntu RubyGems
  • High 7.5
    CVE-2020-5390

    Improper Verification of Cryptographic Signature in PySAML2

    PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping (XSW). The signature information and the node/object that is signed can be in diffe…

    pysaml2 python-pysaml2 python-pysaml2 Debian Ubuntu PyPI
  • High 7.5
    CVE-2020-8151

    Information disclosure issue in Active Resource

    There is a possible information disclosure issue in Active Resource <v5.1.1 that could allow an attacker to create specially crafted requests to access data in an unexpected way and possibly leak information.

    rails activeresource Ubuntu RubyGems
  • High 7.1
    CVE-2019-16785

    HTTP Request Smuggling: LF vs CRLF handling in Waitress

    Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding C…

    Pylons Waitress waitress waitress Debian Ubuntu Alpine PyPI
  • High 7.1
    CVE-2019-16786

    HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress

    Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead. According to the HTTP standard Transfer-Encoding sh…

    Pylons Waitress waitress waitress Debian Ubuntu Alpine PyPI
  • High 7.1
    CVE-2019-16789

    HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers

    In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially cra…

    Pylons Waitress waitress waitress Debian Ubuntu Alpine PyPI
  • High 7.1
    CVE-2019-16792

    HTTP Request Smuggling: Content-Length Sent Twice in Waitress

    Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Len…

    Pylons Waitress waitress waitress Debian Ubuntu PyPI
  • High 7.1
    CVE-2020-5313

    Out-of-bounds Read in Pillow

    libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.

    pillow pillow pillow py3-pillow Debian Ubuntu Alpine PyPI
  • Medium 6.8
    CVE-2020-11077

    HTTP Smuggling via Transfer-Encoding Header in Puma

    In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. If the proxy uses persistent connections and the client adds another request in via HTTP pipelini…

    puma puma puma puma Debian Ubuntu RubyGems
  • Medium 6.5
    CVE-2019-3498

    Improper Input Validation in Django

    In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • Medium 6.5
    CVE-2020-5247

    HTTP Response Splitting in Puma

    In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e. `CR`, `LF` or`/r`, `/n`) to end the header and inject malicious content, such as additiona…

    puma puma puma puma Debian RubyGems
  • Medium 6.1
    CVE-2020-13596

    XSS in Django

    An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • Medium 5.9
    CVE-2019-0201

    Access control bypass in Apache ZooKeeper

    An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plainte…

    Apache Software Foundation Apache ZooKeeper zookeeper zookeeper Debian Ubuntu Maven
  • Medium 5.9
    CVE-2020-13254 Public exploit

    Data leakage via cache key collision in Django

    An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage.

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • Medium 5.8
    CVE-2020-13379 Public exploit Scanner template EPSS 100%

    Server Side Request Forgery in Grafana

    The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to…

    github.com/grafana/grafana grafana Alpine Go
  • Medium 5.3
    CVE-2017-1000246

    Pysaml2 improperly initializes encryption vector

    Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data.

    pysaml2 python-pysaml2 python-pysaml2 Debian Ubuntu PyPI
  • Medium 4.2
    CVE-2019-3828

    Ansible Path Traversal vulnerability

    Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.

    Red Hat Ansible ansible ansible Debian Ubuntu Alpine PyPI
  • Unscored —
    CVE-2017-4965

    An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions …

    rabbitmq-server rabbitmq-server Debian Ubuntu
  • Unscored —
    CVE-2017-4967

    An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions …

    rabbitmq-server rabbitmq-server Debian Ubuntu
  • Unscored —
    CVE-2018-1000115 Public exploit EPSS 88%

    Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vul…

    memcached memcached memcached Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-11596

    In memcached before 1.5.14, a NULL pointer dereference was found in the "lru mode" and "lru temp_ttl" commands. This ca…

    memcached memcached Debian Ubuntu
  • Unscored —
    CVE-2019-15026

    memcached 1.5.16, when UNIX sockets are used, has a stack-based buffer over-read in conn_to_str in memcached.c.

    memcached memcached Debian Ubuntu
  • Unscored —
    CVE-2019-15043 Public exploit Scanner template EPSS 63%

    In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run…

    grafana grafana Ubuntu Alpine
  • Unscored —
    CVE-2020-10743

    It was discovered that OpenShift Container Platform's (OCP) distribution of Kibana could open in an iframe, which made …

  • Unscored —
    CVE-2020-12052

    Grafana version < 6.7.3 is vulnerable for annotation popup XSS.

    grafana Ubuntu

References

  • report
    https://bugzilla.suse.com/1037777
  • report
    https://bugzilla.suse.com/1068612
  • report
    https://bugzilla.suse.com/1069468
  • report
    https://bugzilla.suse.com/1070737
  • report
    https://bugzilla.suse.com/1077718
  • report
    https://bugzilla.suse.com/1083903
  • report
    https://bugzilla.suse.com/1111657
  • report
    https://bugzilla.suse.com/1126503
  • report
    https://bugzilla.suse.com/1133817
  • report
    https://bugzilla.suse.com/1135773
  • report
    https://bugzilla.suse.com/1138748
  • report
    https://bugzilla.suse.com/1148383
  • report
    https://bugzilla.suse.com/1149110
  • report
    https://bugzilla.suse.com/1149535
  • report
    https://bugzilla.suse.com/1153191
  • report
    https://bugzilla.suse.com/1156525
  • report
    https://bugzilla.suse.com/1159447
  • report
    https://bugzilla.suse.com/1160152
  • report
    https://bugzilla.suse.com/1160153
  • report
    https://bugzilla.suse.com/1160192
  • report
    https://bugzilla.suse.com/1160790
  • report
    https://bugzilla.suse.com/1160851
  • report
    https://bugzilla.suse.com/1161088
  • report
    https://bugzilla.suse.com/1161089
  • report
    https://bugzilla.suse.com/1161349
  • report
    https://bugzilla.suse.com/1161670
  • report
    https://bugzilla.suse.com/1164316
  • report
    https://bugzilla.suse.com/1165402
  • report
    https://bugzilla.suse.com/1167244
  • report
    https://bugzilla.suse.com/1170657
  • report
    https://bugzilla.suse.com/1171560
  • report
    https://bugzilla.suse.com/1171909
  • report
    https://bugzilla.suse.com/1172166
  • report
    https://bugzilla.suse.com/1172167
  • report
    https://bugzilla.suse.com/1172175
  • report
    https://bugzilla.suse.com/1172176
  • report
    https://bugzilla.suse.com/1172409
  • report
    https://bugzilla.suse.com/948198
  • report
    https://bugzilla.suse.com/981848