RHSA-2018:2331 - Security Advisory

Topic

An update for memcached is now available for Red Hat OpenStack Platform 12.0 (Pike).

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

memcached is a high-performance, distributed memory object caching system, generic in nature, but intended for use in speeding up dynamic web applications by alleviating database load.

Security fix(es):

• memcached: UDP server support allows spoofed traffic amplification DoS (CVE-2018-1000115)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

For more information about the bug fixes and enhancements included with
this update, see the "Technical Notes" section of the Release Notes
linked in the References section.

Solution

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenStack for IBM Power 12 ppc64le
• Red Hat OpenStack 12 x86_64

Fixes

• BZ - 1470033 - OSP11 -> OSP12 upgrade: docker services are missing preupgrade validation tasks in the upgrade tasks
• BZ - 1477663 - OSP11 -> OSP12 upgrade: after undercloud upgrade ironic-inspector logs repeated [Errno 32] Broken pipe errors in /var/log/messages
• BZ - 1488058 - Fix multiple issues related to DPDK derive parameters
• BZ - 1502860 - rhosp-director: difficult to map certain containers to their logs.
• BZ - 1504052 - Exception should be handled when resources are mapped to non-existent paths in the templates
• BZ - 1506038 - openstack-ironic: errors: Only 14 nodes are exposed to Nova of 15 requests.
• BZ - 1508867 - NovaMigrationTarget service is missing at ComputeOvsDpdk.yaml
• BZ - 1511988 - Call destroy-patch-ports from neutron-openvswitch-agent container
• BZ - 1513497 - FQDN hieradata is hardcoded.
• BZ - 1513502 - TLS everywhere fails with keystone admin API in the external network
• BZ - 1518605 - Hard-coded bootstrap node means replacing overcloud-controller-0 is not possible
• BZ - 1518662 - OSP11 -> OSP12 upgrade: pre-upgrade validations are preventing a re-run of the upgrade-non-controller.sh script to upgrade a compute node after a failed attempt
• BZ - 1520453 - OPS Tools | Centralized Logging | nova-conductor.log is not being tailed by fluentd because of mistake in nova-conductor.yaml file.
• BZ - 1527205 - ansible memory utilization
• BZ - 1528632 - stack update operation fails in rabbitmq config generation
• BZ - 1533204 - Upgrade from OSP11->OSP12 fails - ocf-exit-reason:Could not determine galera name from pacemaker node <galera-bundle-0>
• BZ - 1533271 - Running the mistral workflow to rotate Fernet decryption keys in the overcloud Fails
• BZ - 1533511 - gnocchi-upgrade doesnt get triggered from O->P upgrade causing ceilo-upgrade to fail
• BZ - 1534442 - ComputeExtraConfig is not applied. Is really NovaComputeExtraConfig deprecated ?
• BZ - 1537606 - TripleO doesn't install the trunk service plugin when deployed with OVN
• BZ - 1539961 - RabbitMQ user name not set in Neutron transport_url
• BZ - 1547146 - RFE: VNX tripleo support backport to pike
• BZ - 1547539 - [UPDATES] Failed to setup heat-output with custom stack name
• BZ - 1549139 - Stack update is not working when using derived parameters.
• BZ - 1550934 - Openstack 12 - Missing mount in the keystone container
• BZ - 1551182 - CVE-2018-1000115 memcached: UDP server support allows spoofed traffic amplification DoS
• BZ - 1552759 - Deployment fails with HCI enabled and SchedulerHints
• BZ - 1556720 - [OSP12] gnocchi-upgrade fails with InternalError: (1050, u"Table 'archive_policy' already exists")
• BZ - 1557328 - Security hardened image doesn't have enough space for /var partition
• BZ - 1558679 - Introspection of Diskless servers (iSCSI Booted)
• BZ - 1559151 - OSP11 -> OSP12 upgrade: after rebooting controller nodes post upgrade at boot time interfaces set under ovs bridges have no network connectivity
• BZ - 1559920 - gnocchi_api and gnocchi_metricd don't bind host's /var/lib/gnocchi directory
• BZ - 1560937 - [UPDATE] automation fails on controller update, but update actually pass successfully
• BZ - 1562148 - Overcloud deployment RHOS12 failed, 404 Client Error: Not Found for url: u'swift_rings_container': u'overcloud-swift-rings
• BZ - 1570147 - panko events are kept in DB forever, panko-expirer utility inclusion
• BZ - 1571435 - "subscription-manager list" shows Ceph OSD after updating overcloud compute nodes
• BZ - 1571646 - Update HostnameFormatDefault files to match overcloud-compute-%index%
• BZ - 1571744 - [RFE][Deployment] add ability to configure extra CPU flags for named CPU models
• BZ - 1572353 - FedRAMP requires cloud providers to use TLS v1.1 as a minimum
• BZ - 1572667 - don't restart openvswitch if --no-activate is specified (OSP-12)
• BZ - 1573583 - OSP12 Deployment with TLS everywhere fails - Could not evaluate: The certificate * wasn't found in the list.
• BZ - 1573791 - [OSP12] live-migration uses port range from ephemeral port range
• BZ - 1573808 - The inability to enable LbaaS in horizon
• BZ - 1576751 - live migration broken when live_migration_inbound_addr is set and transport = ssh
• BZ - 1579023 - Director deployment of keystone integration with LDAP broken
• BZ - 1582597 - Non-descriptive failure logs during RHOS-12->RHOS-13 upgrade
• BZ - 1582645 - Rebase puppet-ceilometer to f2f2d2b
• BZ - 1583792 - Rebase puppet-cinder to 01d3e0e
• BZ - 1583858 - Rebase puppet-glance to 03bd9b8
• BZ - 1584279 - Rebase puppet-heat to dab3e55
• BZ - 1584374 - Rebase puppet-ironic to fc61157
• BZ - 1584396 - Rebase puppet-ceph to 401605a
• BZ - 1584403 - Rebase puppet-manila to eef0b53
• BZ - 1584404 - Rebase puppet-mistral to 728f96a
• BZ - 1584411 - Rebase puppet-neutron to 7415256
• BZ - 1584416 - Rebase puppet-panko to eefeaff
• BZ - 1584417 - Rebase puppet-keystone to 4de23ac
• BZ - 1584754 - Rebase puppet-trove to efcd4b3
• BZ - 1585189 - OSP12: Overcloud deployment fails when using capital letters in customized stack name ( --stack TEST-STACK34 ).
• BZ - 1585362 - NetApp Cinder back end does not deploy in RHOSP12 (Pike)
• BZ - 1586155 - [mixed versions] compat installation overcloud deployment failed WorkflowTasks_Step2_Execution
• BZ - 1589951 - Incorrect setting in Cinder's db purge cron job
• BZ - 1590030 - Rebase openstack-tripleo-puppet-elements to 7.0.7
• BZ - 1590031 - Rebase os-net-config to 7.3.6
• BZ - 1590033 - Rebase openstack-tripleo-image-elements to 7.0.5
• BZ - 1590368 - [osp12] Deployment fails in step 1 with "not a directory" when mounting "/etc/ssh/ssh_known_hosts" in scale deplyoments
• BZ - 1590586 - Rebase instack-undercloud to 7.4.12
• BZ - 1590607 - Rebase puppet-tripleo to b885b06
• BZ - 1590612 - Rebase python-tripleoclient to 7.3.10
• BZ - 1590613 - Rebase puppet-nova to 40eb56c
• BZ - 1590953 - CinderNetappNfsMountOptions missing from puppet manifest
• BZ - 1591782 - [osp12] os-collect-config service running on the undercloud causes overcloud deployment failures
• BZ - 1592418 - Rebase puppet-aodh to 77b54fc
• BZ - 1592963 - Rebase openstack-tripleo-heat-templates to 90cd669
• BZ - 1592967 - Rebase openstack-tripleo-common to 7.6.13
• BZ - 1596760 - [Deployment] Live migrations failing when domain is incorrect
• BZ - 1597313 - [UPGRADES][12]Failed to host-evacuate-live VM from non-containerized to containerized compute
• BZ - 1597972 - OSP12: With OvS2.9, hugetlbfs group should be used instead workarounds for DPDK
• BZ - 1599410 - [OSP12] Upgrade converge failed: cinder-manage db sync returned 1 instead of one of
• BZ - 1599883 - Deployment fails during Gnocchi db_sync due to timing issue
• BZ - 1600038 - [UPDATE] update fails with error "The Resource Type (OS::TripleO::Services::ManilaBackendGeneric) could not be found"
• BZ - 1601348 - Running "openstack overcloud upgrade run --roles Controller --skip-tags validation" fails
• BZ - 1607143 - [UPDATE] Compute and Controller update exit with error code while executing step 5
• BZ - 1608450 - TLS everywhere deployment fails - missing TLS bits in T-H-T

CVEs

• CVE-2018-1000115

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/12/html/release_notes/