RHSA-2018:2214 - Security Advisory

Topic

An update for openstack-tripleo-heat-templates is now available for Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

openstack-tripleo-heat-templates is a collection of OpenStack Orchestration templates and tools (codename heat), which can be used to help deploy OpenStack.

Security fix(es):

• openstack-tripleo-heat-templates: Default ODL deployment uses hard coded administrative credentials (CVE-2018-10898)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

For more information about the bug fixes and enhancements included with this update, see the "Technical Notes" section of the Release Notes linked in the References section.

Solution

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenStack for IBM Power 13 ppc64le
• Red Hat OpenStack 13 x86_64
• Red Hat OpenStack Director Deployment Tools 13 x86_64
• Red Hat OpenStack Director Deployment Tools for IBM Power LE 13 ppc64le

Fixes

• BZ - 1559055 - [Infra] docker logs opendaylight_api command doesn't show the OpenDaylight controller's log
• BZ - 1559105 - OC update does not set additional RBD Cinder backend on stack update
• BZ - 1586132 - OSP13 minor update: docker/services/pacemaker/ovn-dbs.yaml is missing update_tasks
• BZ - 1586171 - [Update] Update of OpenStack and OpenDaylight fails
• BZ - 1589346 - Minor Update runs common_deploy_steps_tasks.yaml twice
• BZ - 1592424 - UpgradeInitCommonCommand not executed on split stack environments
• BZ - 1592823 - Update logs should have timestamps to make debugging easier
• BZ - 1593757 - Firewall rules for octavia-api are not created on UPDATE
• BZ - 1594328 - [Deployment] Use secure ODL password by default
• BZ - 1594333 - [Deployment] Karaf shell should only be exposed to internal API network
• BZ - 1600360 - CVE-2018-10898 openstack-tripleo-heat-templates: Default ODL deployment uses hard coded administrative credentials

CVEs

• CVE-2018-10898

References

• https://access.redhat.com/security/updates/classification/#important
• https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/13/html/release_notes/