Security update for ansible1, ardana-ansible, ardana-cobbler, ardana-glance, ardana-input-model, ardana-logging, ardana-manila, ardana-monasca, ardana-mq, ardana-neutron, ardana-octavia, ardana-tempest, crowbar-core, crowbar-openstack, grafana, kibana, openstack-barbican, openstack-ceilometer, openstack-cinder, openstack-dashboard, openstack-designate, openstack-heat-templates, openstack-ironic, openstack-keystone, openstack-magnum, openstack-manila, openstack-monasca-agent, openstack-neutron, o

Summary

Fixed packages 95

Vulnerabilities 24

• Critical 9.8
  CVE-2019-19844 Public exploit EPSS 54%

  Django Potential account hijack via password reset form

  Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a pa…

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Dec 18, 2019
• Critical 9.8
  CVE-2020-5311

  Buffer Copy without Checking Size of Input in Pillow

  libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.

  pillow pillow pillow py3-pillow Debian Ubuntu Alpine PyPI
  Jan 3, 2020
• Critical 9.8
  CVE-2020-5312

  PCX P mode buffer overflow in Pillow

  libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.

  pillow pillow pillow py3-pillow Debian Ubuntu Alpine PyPI
  Jan 3, 2020
• Critical 9.8
  CVE-2020-7471 Public exploit EPSS 66%

  SQL injection in Django

  Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter).…

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Feb 3, 2020
• High 8.8
  CVE-2020-9402 EPSS 24%

  SQL injection in Django

  Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on O…

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Mar 5, 2020
• High 8.1
  CVE-2020-11538

  Out-of-bounds read in Pillow

  In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.

  pillow pillow pillow pillow-python2 Debian Ubuntu PyPI
  Jun 25, 2020
• High 7.5
  CVE-2019-16865

  DOS attack in Pillow when processing specially crafted image files

  An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.

  pillow pillow pillow Debian Ubuntu PyPI
  Oct 4, 2019
• High 7.5
  CVE-2019-19911

  Uncontrolled Resource Consumption in Pillow

  There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due …

  pillow pillow pillow py3-pillow Debian Ubuntu Alpine PyPI
  Jan 5, 2020
• High 7.5
  CVE-2020-8184

  Rack allows Percent-encoded cookies to overwrite existing prefixed cookie names

  A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix.

  rack ruby-rack ruby-rack Debian Ubuntu RubyGems
  Jun 19, 2020
• High 7.1
  CVE-2019-16785

  HTTP Request Smuggling: LF vs CRLF handling in Waitress

  Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding C…

  Pylons Waitress waitress waitress Debian Ubuntu Alpine PyPI
  Dec 20, 2019
• High 7.1
  CVE-2019-16786

  HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress

  Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead. According to the HTTP standard Transfer-Encoding sh…

  Pylons Waitress waitress waitress Debian Ubuntu Alpine PyPI
  Dec 20, 2019
• High 7.1
  CVE-2019-16789

  HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers

  In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially cra…

  Pylons Waitress waitress waitress Debian Ubuntu Alpine PyPI
  Dec 26, 2019
• High 7.1
  CVE-2019-16792

  HTTP Request Smuggling: Content-Length Sent Twice in Waitress

  Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Len…

  Pylons Waitress waitress waitress Debian Ubuntu PyPI
  Jan 22, 2020
• High 7.1
  CVE-2020-5313

  Out-of-bounds Read in Pillow

  libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.

  pillow pillow pillow py3-pillow Debian Ubuntu Alpine PyPI
  Jan 3, 2020
• Medium 6.5
  CVE-2020-10755

  Openstack cinder Improper handling of ScaleIO backend credentials

  An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0. When using ope…

  Red Hat openstack-cinder cinder cinder Debian Ubuntu PyPI
  Jun 10, 2020
• Medium 6.1
  CVE-2020-13596

  XSS in Django

  An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Jun 3, 2020
• Medium 5.9
  CVE-2020-13254 Public exploit

  Data leakage via cache key collision in Django

  An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage.

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Jun 3, 2020
• Medium 5.8
  CVE-2020-13379 Public exploit Scanner template EPSS 100%

  Server Side Request Forgery in Grafana

  The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to…

  github.com/grafana/grafana grafana Alpine Go
  Jun 3, 2020
• Medium 5.5
  CVE-2020-10177

  Out-of-bounds reads in Pillow

  Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.

  pillow pillow pillow pillow-python2 Debian Ubuntu PyPI
  Jun 25, 2020
• Medium 5.5
  CVE-2020-10378

  Out-of-bounds read in Pillow

  In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer.

  pillow pillow pillow pillow-python2 Debian Ubuntu PyPI
  Jun 25, 2020
• Medium 5.5
  CVE-2020-10994

  Out-of-bounds reads in Pillow

  In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file.

  pillow pillow pillow pillow-python2 Debian Ubuntu PyPI
  Jun 25, 2020
• Medium 4.2
  CVE-2019-3828

  Ansible Path Traversal vulnerability

  Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.

  Red Hat Ansible ansible ansible Debian Ubuntu Alpine PyPI
  Mar 27, 2019
• Unscored —
  CVE-2020-10743

  It was discovered that OpenShift Container Platform's (OCP) distribution of Kibana could open in an iframe, which made …

  Jun 2, 2021
• Unscored —
  CVE-2020-12052

  Grafana version < 6.7.3 is vulnerable for annotation popup XSS.

  grafana Ubuntu
  Apr 27, 2020

References

• report
  https://bugzilla.suse.com/1019111
• report
  https://bugzilla.suse.com/1107190
• report
  https://bugzilla.suse.com/1126503
• report
  https://bugzilla.suse.com/1136928
• report
  https://bugzilla.suse.com/1153191
• report
  https://bugzilla.suse.com/1159046
• report
  https://bugzilla.suse.com/1159447
• report
  https://bugzilla.suse.com/1160151
• report
  https://bugzilla.suse.com/1160152
• report
  https://bugzilla.suse.com/1160153
• report
  https://bugzilla.suse.com/1160192
• report
  https://bugzilla.suse.com/1160790
• report
  https://bugzilla.suse.com/1161088
• report
  https://bugzilla.suse.com/1161089
• report
  https://bugzilla.suse.com/1161670
• report
  https://bugzilla.suse.com/1161919
• report
  https://bugzilla.suse.com/1163446
• report
  https://bugzilla.suse.com/1165022
• report
  https://bugzilla.suse.com/1170657
• report
  https://bugzilla.suse.com/1171070
• report
  https://bugzilla.suse.com/1171071
• report
  https://bugzilla.suse.com/1171072
• report
  https://bugzilla.suse.com/1171273
• report
  https://bugzilla.suse.com/1171594
• report
  https://bugzilla.suse.com/1171909
• report
  https://bugzilla.suse.com/1172166
• report
  https://bugzilla.suse.com/1172167
• report
  https://bugzilla.suse.com/1172409
• report
  https://bugzilla.suse.com/1172522
• report
  https://bugzilla.suse.com/1173413
• report
  https://bugzilla.suse.com/1173416
• report
  https://bugzilla.suse.com/1173418
• report
  https://bugzilla.suse.com/1173420
• report
  https://bugzilla.suse.com/1174006
• web
  https://www.suse.com/security/cve/CVE-2019-16785
• web
  https://www.suse.com/security/cve/CVE-2019-16786
• web
  https://www.suse.com/security/cve/CVE-2019-16789
• web
  https://www.suse.com/security/cve/CVE-2019-16792
• web
  https://www.suse.com/security/cve/CVE-2019-16865