Stay Secure with the Latest Linux Advisories

security advisorymoderateupdate

SUSE: 2020:1573-1 Moderate: Metrics Server, Cert Checker, vSphere VCP

An update that solves four vulnerabilities and has 16 fixes is now available. . SUSE Security Update: Add features for Metrics Server, Cert Status Checker, VSphere VCP, and Cilium Envoy ______________________________________________________________________________ Announcement ID: SUSE-SU-2020:1573-1 Rating: moderate References: #1041090 #1047218 #1048688 #1086909 #1094448 #1095603 #1102920 #1121353 #1129568 #1138908 #1144068 #1151876 #1156450 #1159002 #1159003 #1159004 #1159539 #1162651 #1167073 #1169506 Cross-References: CVE-2019-18801 CVE-2019-18802 CVE-2019-18836 CVE-2019-18838 Affected Products: SUSE CaaS Platform 4.0 ______________________________________________________________________________ An update that solves four vulnerabilities and has 16 fixes is now available. Description: Metrics Server * Support monitoring of *CPU* and *memory* of a pod or node. Cert Status Checker * Exposes cluster-wide certificates status and use monitoring stack (Prometheus and Grafana) to receives alerts by Prometheus Alertmanager and monitors certificate status by Grafana dashboard. VSphere VCP * Allow Kubernetes pods to use VMWare vSphere Virtual Machine Disk (VMDK) volumes as persistent storage. Cilium Envoy * Updated Cilium from version 1.5.3 to version 1.6.6 * Provide Envoy-proxy support for Cilium * Envoy and its dependencies packaged for version 1.12.2 * Cilium uses CRD and ConfigMap points on etcd are removed See release notes for installation instructions: https://www.suse.com/releasenotes/x86_64/SUSE-CAASP/4/index.html Following CVE entries are relevant for the casp 4.2.1 update: cilium-proxy: CVE-2019-18801: An untrusted remote client might have been able to send HTTP/2 requests via cilium-proxyx that could have written to theheap outside of the request buffers when the upstream is HTTP/1. (bsc#1159002) CVE-2019-18802: A malformed request header may have caused bypass of route matchers resulting in escalation of privileges or information disclosure (bsc#1159003) CVE-2019-18838: A malformed HTTP request without the Host header may cause abnormal termination ofthe Envoy process (bsc#1159004) CVE-2019-18836: Excessive iteration due to listener filter timeout in envoy could lead to DoS (bsc#1156450) kafka: CVE-2018-1288: authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request. (bsc#1102920) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE CaaS Platform 4.0: To install this update, use the SUSE CaaS Platform Velum dashboard. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. Package List: - SUSE CaaS Platform 4.0 (x86_64): caasp-release-4.2.1-24.23.4 skuba-1.3.5-3.39.1 terraform-provider-vsphere-1.17.3-3.3.4 - SUSE CaaS Platform 4.0 (noarch): skuba-update-1.3.5-3.39.1 References: https://www.suse.com/security/cve/CVE-2019-18801.html https://www.suse.com/security/cve/CVE-2019-18802.html https://www.suse.com/security/cve/CVE-2019-18836.html https://www.suse.com/security/cve/CVE-2019-18838.html https://bugzilla.suse.com/1041090 https://bugzilla.suse.com/1047218 https://bugzilla.suse.com/1048688 https://bugzilla.suse.com/1086909 https://bugzilla.suse.com/1094448 https://bugzilla.suse.com/1095603 https://bugzilla.suse.com/1102920 https://bugzilla.suse.com/1121353 https://bugzilla.suse.com/1129568 https://bugzilla.suse.com/1138908 https://bugzilla.suse.com/1144068 https://bugzilla.suse.com/1151876 https://bugzilla.suse.com/1156450 https://bugzilla.suse.com/1159002 https://bugzilla.suse.com/1159003 https://bugzilla.suse.com/1159004 https://bugzilla.suse.com/1159539 https://bugzilla.suse.com/1162651 https://bugzilla.suse.com/1167073 https://bugzilla.suse.com/1169506 _______________________________________________ sle-security-updates mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. http://lists.suse.com/mailman/listinfo/sle-security-updates . SUSE Security Patch introduces enhancements for Performance Monitor, Certificate Validator, and additional tools, tackling moderate vulnerabilities.. Metrics Server, Cert Status Checker, vSphere, Cilium, SUSE Update. . LinuxSecurity.com Team

Jun 09, 2020 SuSE