Synopsis

Important: openstack-tripleo-heat-templates security update

Type/Severity

Security Advisory: Important

Topic

An update for openstack-tripleo-heat-templates is now available for Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

openstack-tripleo-heat-templates is a collection of OpenStack Orchestration templates and tools (codename heat), which can be used to help deploy OpenStack.

Security fix(es):

• openstack-tripleo-heat-templates: Default ODL deployment uses hard coded administrative credentials (CVE-2018-10898)
  

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

For more information about the bug fixes and enhancements included with this update, see the "Technical Notes" section of the Release Notes linked in the References section.

Solution

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenStack 13 x86_64
• Red Hat OpenStack for IBM Power 13 ppc64le
• Red Hat OpenStack Director Deployment Tools 13 x86_64
• Red Hat OpenStack Director Deployment Tools for IBM Power LE 13 ppc64le

Fixes

• BZ - 1559055 - [Infra] docker logs opendaylight_api command doesn't show the OpenDaylight controller's log
• BZ - 1559105 - OC update does not set additional RBD Cinder backend on stack update
• BZ - 1586132 - OSP13 minor update: docker/services/pacemaker/ovn-dbs.yaml is missing update_tasks
• BZ - 1586171 - [Update] Update of OpenStack and OpenDaylight fails
• BZ - 1589346 - Minor Update runs common_deploy_steps_tasks.yaml twice
• BZ - 1592424 - UpgradeInitCommonCommand not executed on split stack environments
• BZ - 1592823 - Update logs should have timestamps to make debugging easier
• BZ - 1593757 - Firewall rules for octavia-api are not created on UPDATE
• BZ - 1594328 - [Deployment] Use secure ODL password by default
• BZ - 1594333 - [Deployment] Karaf shell should only be exposed to internal API network
• BZ - 1600360 - CVE-2018-10898 openstack-tripleo-heat-templates: Default ODL deployment uses hard coded administrative credentials

CVEs

• CVE-2018-10898

References

• https://access.redhat.com/security/updates/classification/#important
• https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/13/html/release_notes/

Red Hat OpenStack 13

SRPM
openstack-tripleo-common-8.6.1-23.el7ost.src.rpm	SHA-256: 0d4090967f0782b4e4c25e9518700328f0bf9968906ba45ade59870162c2f949
openstack-tripleo-heat-templates-8.0.2-43.el7ost.src.rpm	SHA-256: 7f0922fc905cb5c0c612486eecdabc7a6e7948e5154f159a1cbaa3f50205a52a
puppet-opendaylight-8.1.2-2.38977efgit.el7ost.src.rpm	SHA-256: e39af2ebe223f0ebd3cc47c1a5a2d78c5c23c2b329e9d637f0b7571798a4c889
python-tripleoclient-9.2.1-13.el7ost.src.rpm	SHA-256: dc0e8739ac77e57566d0f6d9a3aec8b10ccff351143d95018e7544279d1ec444
x86_64
openstack-tripleo-common-8.6.1-23.el7ost.noarch.rpm	SHA-256: 494c3db6c43cfa49efe9192ffb5746202423e5c1e8e0f54c6c79bc82a04dcb7a
openstack-tripleo-common-container-base-8.6.1-23.el7ost.noarch.rpm	SHA-256: 25c01239e5e8813373f5dbd3a958e52ea7d6ed4e974ad2ea73853f86ec86bb1d
openstack-tripleo-common-containers-8.6.1-23.el7ost.noarch.rpm	SHA-256: 1fdbb635120a6f2f8506f06eddb4ee1ede392b533dbebd603da780ec2252a58c
openstack-tripleo-common-devtools-8.6.1-23.el7ost.noarch.rpm	SHA-256: d046d30c10b92d89cceb5fac119566400fd118db25630047d38efa155b46b0a6
openstack-tripleo-heat-templates-8.0.2-43.el7ost.noarch.rpm	SHA-256: 853f017907b80d237b93510297e79f8f8afcabb2ae18bb28f17a4d1844a6cfe4
puppet-opendaylight-8.1.2-2.38977efgit.el7ost.noarch.rpm	SHA-256: a71675f50164047d2d6bbf89a727d11b2aaabf31eb386fa03f77cfc55e3cbfa2
python-tripleoclient-9.2.1-13.el7ost.noarch.rpm	SHA-256: db1545b67e27c9302be53e084d1bfe8114170be5029c331ffdc24634ae330619

Red Hat OpenStack for IBM Power 13

SRPM
openstack-tripleo-common-8.6.1-23.el7ost.src.rpm	SHA-256: 0d4090967f0782b4e4c25e9518700328f0bf9968906ba45ade59870162c2f949
openstack-tripleo-heat-templates-8.0.2-43.el7ost.src.rpm	SHA-256: 7f0922fc905cb5c0c612486eecdabc7a6e7948e5154f159a1cbaa3f50205a52a
puppet-opendaylight-8.1.2-2.38977efgit.el7ost.src.rpm	SHA-256: e39af2ebe223f0ebd3cc47c1a5a2d78c5c23c2b329e9d637f0b7571798a4c889
python-tripleoclient-9.2.1-13.el7ost.src.rpm	SHA-256: dc0e8739ac77e57566d0f6d9a3aec8b10ccff351143d95018e7544279d1ec444
ppc64le
openstack-tripleo-common-8.6.1-23.el7ost.noarch.rpm	SHA-256: 494c3db6c43cfa49efe9192ffb5746202423e5c1e8e0f54c6c79bc82a04dcb7a
openstack-tripleo-common-container-base-8.6.1-23.el7ost.noarch.rpm	SHA-256: 25c01239e5e8813373f5dbd3a958e52ea7d6ed4e974ad2ea73853f86ec86bb1d
openstack-tripleo-common-containers-8.6.1-23.el7ost.noarch.rpm	SHA-256: 1fdbb635120a6f2f8506f06eddb4ee1ede392b533dbebd603da780ec2252a58c
openstack-tripleo-common-devtools-8.6.1-23.el7ost.noarch.rpm	SHA-256: d046d30c10b92d89cceb5fac119566400fd118db25630047d38efa155b46b0a6
openstack-tripleo-heat-templates-8.0.2-43.el7ost.noarch.rpm	SHA-256: 853f017907b80d237b93510297e79f8f8afcabb2ae18bb28f17a4d1844a6cfe4
puppet-opendaylight-8.1.2-2.38977efgit.el7ost.noarch.rpm	SHA-256: a71675f50164047d2d6bbf89a727d11b2aaabf31eb386fa03f77cfc55e3cbfa2
python-tripleoclient-9.2.1-13.el7ost.noarch.rpm	SHA-256: db1545b67e27c9302be53e084d1bfe8114170be5029c331ffdc24634ae330619

Red Hat OpenStack Director Deployment Tools 13

SRPM
puppet-opendaylight-8.1.2-2.38977efgit.el7ost.src.rpm	SHA-256: e39af2ebe223f0ebd3cc47c1a5a2d78c5c23c2b329e9d637f0b7571798a4c889
x86_64
puppet-opendaylight-8.1.2-2.38977efgit.el7ost.noarch.rpm	SHA-256: a71675f50164047d2d6bbf89a727d11b2aaabf31eb386fa03f77cfc55e3cbfa2

Red Hat OpenStack Director Deployment Tools for IBM Power LE 13

SRPM
puppet-opendaylight-8.1.2-2.38977efgit.el7ost.src.rpm	SHA-256: e39af2ebe223f0ebd3cc47c1a5a2d78c5c23c2b329e9d637f0b7571798a4c889
ppc64le
puppet-opendaylight-8.1.2-2.38977efgit.el7ost.noarch.rpm	SHA-256: a71675f50164047d2d6bbf89a727d11b2aaabf31eb386fa03f77cfc55e3cbfa2