—–BEGIN PGP SIGNED MESSAGE—–
\nHash: SHA256<\/p>\n
=====================================================================
\nRed Hat Security Advisory<\/p>\n
Synopsis: Moderate: Red Hat OpenStack Platform 16.2 (openstack-tripleo-heat-templates) security update
\nAdvisory ID: RHSA-2022:0995-01
\nProduct: Red Hat OpenStack Platform
\nAdvisory URL: https:\/\/access.redhat.com\/errata\/RHSA-2022:0995
\nIssue date: 2022-03-23
\nCVE Names: CVE-2021-4180
\n=====================================================================<\/p>\n
1. Summary:<\/p>\n
An update for openstack-tripleo-heat-templates is now available for Red Hat
\nOpenStack Platform 16.2 (Train).<\/p>\n
Red Hat Product Security has rated this update as having a security impact
\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
\ngives a detailed severity rating, is available for each vulnerability from
\nthe CVE link(s) in the References section.<\/p>\n
2. Relevant releases\/architectures:<\/p>\n
Red Hat OpenStack Platform 16.2 – noarch<\/p>\n
3. Description:<\/p>\n
Heat templates for TripleO<\/p>\n
Security Fix(es):<\/p>\n
* Data leak of internal URL through keystone_authtoken (CVE-2021-4180)<\/p>\n
For more details about the security issue(s), including the impact, a CVSS
\nscore, acknowledgments, and other related information, refer to the CVE
\npage listed in the References section.<\/p>\n
4. Solution:<\/p>\n
For details on how to apply this update, which includes the changes
\ndescribed in this advisory, refer to:<\/p>\n
https:\/\/access.redhat.com\/articles\/11258<\/p>\n
5. Bugs fixed (https:\/\/bugzilla.redhat.com\/):<\/p>\n
1855678 – Configure Ceph Messenger for encryption OTW
\n1869587 – Octavia and LB issues after OSP13z11 and OSP16.x upgrade
\n1886762 – [RFE] support NFS mount at the conversion directory
\n1921112 – [OSP13->OSP16.2] nova-consoleauth still present in cli after upgrade.
\n1949673 – [RHOSP16.2] [rsyslog] Miss configuration generated in 50_openstack_logs.conf
\n1949675 – [RHOSP16.2] [rsyslog] rsyslog containers does not forward logs to elasticsearch
\n1955562 – Backup and Restore: Backup openstack client integration – openstack backup using bad nfs server address is not erroring out
\n1962304 – cinder volume at DCN unable to read central cephx keyring
\n1965233 – [FFU 13 -> 16.x] xinetd is running after upgrade, blocking swift_rsync container
\n1969411 – [RFE]: allow for the deployment of RHCS dashboard on any composable network
\n1975271 – Minor update does not restart ha resource when it is in failed stated
\n1976055 – Configuration of Memcached TLS requires the user to duplicate configuration entries
\n1978228 – [OSP13->OSP16.2] Leapp upgrade failed with TLSEverywhere
\n1980542 – [16.2] LC_CTYPE: cannot change locale (C.UTF-8) during OC upgrade 13 to 16.2 seems to fail upgrade
\n1983748 – NeutronL3AgentAvailabilityZone does not set specified value for Availability zone of Neutron L3 agent
\n1984555 – [RHOSP16.2] Smart plugin doesn’t work for CAP_SYS_RAWIO capability missing.
\n1984875 – [OSP13->16.2] the leapp persistentnetnamesdisable actor should be removed so that a reboot can be avoided
\n1992506 – [RHOSP16.2] dpdk ovs vhost postcopy requires to start ovs with –mlockall=no
\n1999324 – NovaLiveMigrationPermitAutoConverge should default to true to match NovaLiveMigrationPermitPostCopy
\n1999725 – [RFE] Allow for the deployment of Ganesha on the overcloud “external” network
\n2000582 – ceph ssl radosgw port is closed for tempest (undercloud node)
\n2002346 – [OSP-16.2] [Upgrades][TripleO] Revert of the TSX change in tripleoclient
\n2003176 – [OSP16.2] ovn-dbs pacemaker update_tasks can race with pacemaker update_tasks
\n2005086 – Unable to disable gateway validation on deployment
\n2005680 – Cinder __DEFAULT__ volume type is installed but *tripleo* volume type is the real default
\n2008418 – Stack reconfiguration failed because ha-proxy container crashed during reconfiguration
\n2009422 – Deployment failing due to “Create \/etc\/openstack directory if it does not exist” task
\n2010114 – Openstack ceilometer archival policy is not taking effect
\n2010703 – rhosp-release package is removed during upgrade from all nodes
\n2010940 – ceph-nfs not coming up after the FFU
\n2013913 – Minion should be configured with same default tuning as Undercloud for atleast heat & ironic
\n2014758 – There’s a typo in MySQLInodbBufferPoolSize as it should be MySQLInnodbBufferPoolSize
\n2021575 – [16.2] openstack overcloud upgrade run times out \/ HAProxy container fails to start
\n2022234 – Parameter ‘ValidateGatewaysIcmp:false’ is not working in OSP16.2
\n2022691 – [OSP16.2] qemu logs are not accessible on the host
\n2026290 – Some log files are not collected\/relayed by rsyslog to remote log server
\n2027787 – Undercloud upgrade to 16.2 fails because of missing dependencies of swtpm
\n2030409 – [OSP16.2] Memcached if off for Heat, Keystone and Nova since caching backend is dogpile.cache.null
\n2031110 – Long t-h-t role name causes OVNMacAddressPort tag to exceed the neutron tag length limit
\n2032010 – [OSP16.2.0] neutron-dhcp-agent causes oom issues on controllers
\n2034189 – Validation if NTP\/Chrony is configured during at initial stage of deployment procedure
\n2034730 – Horizon log not collected\/relayed by rsyslog to remote log server
\n2035793 – CVE-2021-4180 openstack-tripleo-heat-templates: data leak of internal URL through keystone_authtoken
\n2037940 – [OVN] Enable ovn-monitor-all to help with OVN scale
\n2038897 – [RHOSP16.2] [DCN] [STF] metrics_qdr containers failed to start with bind address error
\n2046185 – From time to time memcached stops processing requests and brings down OpenStack control plane
\n2046211 – [OSP13->OSP16.2] Leapp actors directory change impacting in the upgrade
\n2050154 – [update] 16.1->16.2 experience a connectivity cut (ping loss) to FIP during update of the controllers.<\/p>\n
6. Package List:<\/p>\n
Red Hat OpenStack Platform 16.2:<\/p>\n
Source:
\nopenstack-tripleo-heat-templates-11.6.1-2.20220116004912.el8ost.src.rpm<\/p>\n
noarch:
\nopenstack-tripleo-heat-templates-11.6.1-2.20220116004912.el8ost.noarch.rpm<\/p>\n
These packages are GPG signed by Red Hat for security. Our key and
\ndetails on how to verify the signature are available from
\nhttps:\/\/access.redhat.com\/security\/team\/key\/<\/p>\n
7. References:<\/p>\n
https:\/\/access.redhat.com\/security\/cve\/CVE-2021-4180
\nhttps:\/\/access.redhat.com\/security\/updates\/classification\/#moderate<\/p>\n
8. Contact:<\/p>\n
The Red Hat security contact is <secalert@redhat.com>. More contact
\ndetails at https:\/\/access.redhat.com\/security\/team\/contact\/<\/p>\n
Copyright 2022 Red Hat, Inc.
\n—–BEGIN PGP SIGNATURE—–
\nVersion: GnuPG v1<\/p>\n
iQIVAwUBYjvmKNzjgjWX9erEAQispxAAihi4ziFGX97tUuSGWQgConiT5Hewws7X
\n84GxTMJ82iW7M7bQBPW6+YaKsKqqt3Yd3+1qCJG2q4A1j8dR\/9Cy9U93AHHqMZe+
\nHOALT\/1JQzrmH\/DZGkuj5buhaHLYxbeBv\/3IlyoaZVPRhu8xZ6wD\/1OnPPTkc0LA
\nHrEc47t5bVTmAqMyTdnBi5+0FxmgabOErSZk2MaWfTiBUpDbZfgO4Nw6Kq0UZyG1
\nq72gOnR6ZPCZG3n+QDIZytifEW9wCpngF8H5lOYe+BLErmBySUGtQubWllBA02Go
\nDXIb4pPmtc7O08CVywTfdxAFTdaE69pk7LhB9\/XRRVeLMkHc7ICKqtJmNXkyYugW
\n6zI\/F950TzTqHlx7cRnEOY44D3sHva3CMy2QQHgz93FPiSdnNktLimP116jJHUfZ
\nR6BAg4nBU8T1scTf0SBTurJeVhmOh9r5zyGRSzdDKA\/iS6qY0u\/RTzaQKLZrM2fl
\nBPKbyZwQPFvGYepjBtSbKEbdXihz+b03N2KDg7XI4RP7z6k\/qHnUAJ9lNIt9t9gI
\nhJmiKyGAzrHKNqkuzXrMRhOnbfgElzMI2epsfUtYSfx3cga6NB4fQafT+YVZotLJ
\n1DkCfWDmwr\/6qVqMNfqLh4KhC1WjwwYKFeqz5VYbNagEhe2Zn7ALIBc+b4xjp+8E
\nUKkhXd7aiwk=
\n=yB4a
\n—–END PGP SIGNATURE—–
\n—
\nRHSA-announce mailing list
\nRHSA-announce@redhat.com
\nhttps:\/\/listman.redhat.com\/mailman\/listinfo\/rhsa-announce<\/p>\n","protected":false},"excerpt":{"rendered":"
—–BEGIN PGP SIGNED MESSAGE—– Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat OpenStack Platform 16.2 (openstack-tripleo-heat-templates) security update Advisory ID: RHSA-2022:0995-01 Product: Red Hat OpenStack Platform Advisory URL: https:\/\/access.redhat.com\/errata\/RHSA-2022:0995 Issue date: 2022-03-23 CVE Names: CVE-2021-4180 ===================================================================== 1. Summary: An update for openstack-tripleo-heat-templates is now available for Red Hat OpenStack Platform 16.2 (Train). …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-22105","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/22105","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=22105"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/22105\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=22105"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=22105"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=22105"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}