Security update for openstack-nova

Announcement ID: SUSE-SU-2017:3080-1
Rating: moderate
References:
Cross-References:
CVSS scores:
  • CVE-2017-16239 ( SUSE ): 4.2 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L
  • CVE-2017-16239 ( NVD ): 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected Products:
  • SUSE Linux Enterprise High Performance Computing 12 SP2
  • SUSE Linux Enterprise Server 12 SP2
  • SUSE OpenStack Cloud 7

An update that solves one vulnerability can now be installed.

Description:

This update for openstack-nova brings the latest version provided by the OpenStack upstream project including the following security fix:

  • CVE-2017-16239: Filter Scheduler bypass through rebuild action (bsc#1066198).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE OpenStack Cloud 7
    zypper in -t patch SUSE-OpenStack-Cloud-7-2017-1911=1

Package List:

  • SUSE OpenStack Cloud 7 (noarch)
    • openstack-nova-cells-14.0.10~dev13-4.11.1
    • openstack-nova-conductor-14.0.10~dev13-4.11.1
    • openstack-nova-consoleauth-14.0.10~dev13-4.11.1
    • openstack-nova-scheduler-14.0.10~dev13-4.11.1
    • openstack-nova-api-14.0.10~dev13-4.11.1
    • openstack-nova-cert-14.0.10~dev13-4.11.1
    • openstack-nova-compute-14.0.10~dev13-4.11.1
    • openstack-nova-placement-api-14.0.10~dev13-4.11.1
    • openstack-nova-vncproxy-14.0.10~dev13-4.11.1
    • openstack-nova-console-14.0.10~dev13-4.11.1
    • openstack-nova-14.0.10~dev13-4.11.1
    • openstack-nova-serialproxy-14.0.10~dev13-4.11.1
    • python-nova-14.0.10~dev13-4.11.1
    • openstack-nova-doc-14.0.10~dev13-4.11.3
    • openstack-nova-novncproxy-14.0.10~dev13-4.11.1

References: