SUSE-SU-2022:3339-1

    Dashboard / Vulnerabilities / SUSE-SU-2022:3339-1

    SUSE-SU-2022:3339-1

    Published: 22 Sept 2022Last Modified: 4 Feb 2026

    Summary: Security update for ardana-ansible, ardana-cobbler, ardana-tempest, grafana, openstack-heat-templates, openstack-horizon-plugin-gbp-ui, openstack-neutron-gbp, openstack-nova, python-Django1, rabbitmq-server, rubygem-puma

    Details: This update for ardana-ansible, ardana-cobbler, ardana-tempest, grafana, openstack-heat-templates, openstack-horizon-plugin-gbp-ui, openstack-neutron-gbp, openstack-nova, python-Django1, rabbitmq-server, rubygem-puma fixes the following issues: Security fixes included in this update: ardana-ansible: - CVE-2020-1734: Fixed vulnerability where shell was enabled by default in a pipe lookup plugin subprocess (SOC-11662, bnc#1164139). grafana: - CVE-2021-39226: Fixed snapshot authentication bypass (bsc#1191454). rabbitmq-server: - CVE-2019-11287: Fixed DoS via 'X-Reason' HTTP Header in malicious Erlang format string (bsc#1157665). rubygem-puma: - CVE-2022-24790: Fixed HTTP request smuggling (bsc#1197818). python-Django1: - CVE-2022-28346: Fixed vulnerability allowing SQL injection in QuerySet.annotate(),aggregate() and extra() (bsc#1198398). - CVE-2022-34265: Fixed vulnerability allowing SQL injection via Trunc(kind) and Extract(lookup_name) arguments (bsc#1201186). Bugfixes: - Disabled two barbican tests (SOC-8764). Non-security fixes included on this update: Changes in ardana-ansible: - Update to version 9.0+git.1660748476.c118d23: * Mitigate CVE-2020-1734 (SOC-11662) Changes in ardana-cobbler: - Update to version 9.0+git.1660747489.119efcd: * Mitigate CVE-2020-1734 (SOC-11662) Changes in ardana-tempest: - Update to version 9.0+git.1651855288.a2341ad: * Disable two barbican tests (SOC-8764) Changes in grafana: - Add CVE-2021-39226 patch (bsc#1191454, CVE-2021-39226) * snapshot authentication bypass Changes in openstack-heat-templates: - Update to version 0.0.0+git.1654529662.75fa04a7: * doc: Comment out language option Changes in openstack-horizon-plugin-gbp-ui: - Update to version group-based-policy-ui-14.0.1.dev4: * remove legacy servicechain code Changes in openstack-neutron-gbp: - Update to version group-based-policy-14.0.1.dev46: * Remove logs 2014.2.rc1 - Update to version group-based-policy-14.0.1.dev45: * FIP Status active after dissociate - Update to version group-based-policy-14.0.1.dev43: * fixed apic synchronization state for multiple erspan session - Update to version group-based-policy-14.0.1.dev41: * Remove\_legacy\_service\_chain\_code(2) - Update to version group-based-policy-14.0.1.dev39: * data-migrations spelling fixes 2014.2rc1 - Update to version group-based-policy-14.0.1.dev38: * Adding support for address group feature in upstream - Update to version group-based-policy-14.0.1.dev36: * Add support for yoga 2014.2.rc1 - Update to version group-based-policy-14.0.1.dev35: * Removed\_legacy\_service\_chain\_code 2014.2rc1 Changes in openstack-nova: - Update to version nova-18.3.1.dev92: * [stable-only] Drop lower-constraints job Changes in openstack-nova: - Update to version nova-18.3.1.dev92: * [stable-only] Drop lower-constraints job Changes in python-Djanjo1: - Rename Django-1.11.29.tar.gz.asc to Django-1.11.29.tar.gz.checksums.txt to avoid source_validator incorrectly trying to use it as a detached signature file for the sources tarball. - Add CVE-2022-28346 patch (bsc#1198398, CVE-2022-28346) * Potential SQL injection in QuerySet.annotate(),aggregate() and extra() - Add CVE-2022-34265 patch (bsc#1201186, CVE-2022-34265) * SQL injection via Trunc(kind) and Extract(lookup_name) arguments Changes in rabbitmq-server: - add explanation-format patch to fix CVE-2019-11287 (bsc#1157665) Changes in rubygem-puma: - Add CVE-2022-24790 patch (bsc#1197818, CVE-2022-24790).

    References: https://www.suse.com/support/update/announcement/2022/suse-su-20223339-1/, https://bugzilla.suse.com/1157665, https://bugzilla.suse.com/1164139, https://bugzilla.suse.com/1191454, https://bugzilla.suse.com/1197818, https://bugzilla.suse.com/1198398, https://bugzilla.suse.com/1201186, https://www.suse.com/security/cve/CVE-2019-11287, https://www.suse.com/security/cve/CVE-2020-1734, https://www.suse.com/security/cve/CVE-2021-39226, https://www.suse.com/security/cve/CVE-2022-24790, https://www.suse.com/security/cve/CVE-2022-28346, https://www.suse.com/security/cve/CVE-2022-34265

    Affected packages

    Package

    Name: ardana-ansible

    Purl: pkg:rpm/suse/ardana-ansible&distro=SUSE%20OpenStack%20Cloud%209

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -9.0+git.1660748476.c118d23-3.32.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    SUSE-SU-2022:3339-1 | CVE-DB