Stay Secure with the Latest Linux Advisories

security advisorymoderateSUSE

SUSE: 2018:3073-1 Moderate: kubernetes-salt File Access Issue

An update that solves one vulnerability and has two fixes is now available. . SUSE Security Update: Security update for kubernetes-salt, velum ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:3073-1 Rating: moderate References: #1097753 #1098369 #1109320 Cross-References: CVE-2018-3760 Affected Products: SUSE CaaS Platform 3.0 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for rubygem-sprockets to version 3.7.2 and velum fixes the following issues: This security issue was fixed in rubygem-sprockets: - CVE-2018-3760: Specially crafted requests could have been be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production (bsc#1098369) These non-security issues were fixed in velum: - Fix external auth group mapping for group attr name. (bsc#1109320) - Add configmap from pillar data to dex ldap connectors (fate#324601) - Backport of LDAP external auth feature (fate#324601) - Allow the user to upload a certificate via file (bsc#1097753) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE CaaS Platform 3.0: To install this update, use the SUSE CaaS Platform Velum dashboard. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. Package List: - SUSE CaaS Platform 3.0 (noarch): kubernetes-salt-3.0.0+git_r855_633c667-3.12.6 - SUSE CaaS Platform 3.0 (x86_64): sles12-velum-image-3.1.2-3.11.30 References: https://www.suse.com/security/cve/CVE-2018-3760.html https://bugzilla.suse.com/1097753 https://bugzilla.suse.com/1098369 https://bugzilla.suse.com/1109320 _______________________________________________ sle-security-updates mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. http://lists.suse.com/mailman/listinfo/sle-security-updates . SUSE Security Patch resolves several vulnerabilities in salt-kubernetes and velum under advisory ID SUSE-SU-2018:3074-1.. SUSE CaaS Platform, kubernetes-salt security, velum fixes. . LinuxSecurity.com Team

Oct 08, 2018 SuSE