SUSE-SU-2021:0200-1

Опубликовано: 22 янв. 2021

Источник: suse-cvrf

Описание

Security update for hawk2

This update for hawk2 fixes the following issues:

hawk2 was updated to version 2.4.0+git.1611141202.2fe6369e.

Security issue fixed:

Fixed another possible code execution vulnerability in the controller code (bsc#1179998).

Список пакетов

Image SLES15-SAP-Azure

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SAP-Azure-BYOS

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SAP-Azure-LI-BYOS-Production

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SAP-Azure-VLI-BYOS-Production

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SAP-EC2-HVM

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SAP-EC2-HVM-BYOS

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SAP-GCE

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SAP-GCE-BYOS

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SAP-OCI-BYOS

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP1-SAP-Azure

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP1-SAP-Azure-BYOS

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP1-SAP-Azure-LI-BYOS-Production

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP1-SAP-EC2-HVM

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP1-SAP-EC2-HVM-BYOS

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP1-SAP-GCE

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP1-SAP-GCE-BYOS

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP1-SAP-OCI-BYOS

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP2-SAP-Azure

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP2-SAP-Azure-LI-BYOS-Production

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP2-SAP-BYOS-Azure

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP2-SAP-BYOS-EC2-HVM

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP2-SAP-BYOS-GCE

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP2-SAP-EC2-HVM

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP2-SAP-GCE

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP3-SAP-Azure-LI-BYOS-Production

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP3-SAP-BYOS-Azure

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP3-SAP-BYOS-EC2-HVM

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP3-SAP-BYOS-GCE

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP4-SAP-Azure-LI-BYOS

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP4-SAP-Azure-LI-BYOS-Production

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP4-SAP-Azure-VLI-BYOS

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP4-SAP-BYOS

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP4-SAP-BYOS-Azure

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP4-SAP-BYOS-EC2

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP4-SAP-BYOS-GCE

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP4-SAP-Hardened

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP4-SAP-Hardened-Azure

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP4-SAP-Hardened-BYOS

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP4-SAP-Hardened-BYOS-Azure

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP4-SAP-Hardened-BYOS-EC2

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP4-SAP-Hardened-BYOS-GCE

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP4-SAP-Hardened-EC2

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP4-SAP-Hardened-GCE

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP5-SAP-Azure-3P

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP5-SAP-Azure-LI-BYOS

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP5-SAP-Azure-LI-BYOS-Production

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP5-SAP-Azure-VLI-BYOS

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP5-SAP-BYOS-Azure

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP5-SAP-BYOS-EC2

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP5-SAP-BYOS-GCE

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP5-SAP-Hardened-Azure

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP5-SAP-Hardened-BYOS-Azure

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP5-SAP-Hardened-BYOS-EC2

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP5-SAP-Hardened-BYOS-GCE

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP5-SAP-Hardened-EC2

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP5-SAP-Hardened-GCE

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP6-SAP-Azure-3P

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP6-SAP-Azure-LI-BYOS

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP6-SAP-Azure-LI-BYOS-Production

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP6-SAP-Azure-VLI-BYOS

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP6-SAP-Azure-VLI-BYOS-Production

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP6-SAP-BYOS

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP6-SAP-BYOS-Azure

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP6-SAP-BYOS-EC2

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP6-SAP-BYOS-GCE

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP6-SAP-Hardened

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP6-SAP-Hardened-Azure

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP6-SAP-Hardened-BYOS

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP6-SAP-Hardened-BYOS-Azure

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP6-SAP-Hardened-BYOS-EC2

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP6-SAP-Hardened-BYOS-GCE

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP6-SAP-Hardened-EC2

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP6-SAP-Hardened-GCE

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP7-SAP-Azure

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP7-SAP-Azure-3P

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP7-SAP-Azure-LI-BYOS-Production

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP7-SAP-Azure-VLI-BYOS-Production

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP7-SAP-BYOS-Azure

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP7-SAP-BYOS-EC2

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP7-SAP-BYOS-GCE

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP7-SAP-EC2

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP7-SAP-GCE

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP7-SAP-Hardened-Azure

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP7-SAP-Hardened-BYOS-Azure

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP7-SAP-Hardened-BYOS-EC2

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP7-SAP-Hardened-BYOS-GCE

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SP7-SAP-Hardened-GCE

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

SUSE Linux Enterprise High Availability Extension 15

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

SUSE Linux Enterprise High Availability Extension 15 SP1

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

SUSE Linux Enterprise High Availability Extension 15 SP2

hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Ссылки

https://www.suse.com/support/update/announcement/2021/suse-su-20210200-1/
Link for SUSE-SU-2021:0200-1
https://lists.suse.com/pipermail/sle-security-updates/2021-January/008242.html
E-Mail link for SUSE-SU-2021:0200-1
https://www.suse.com/support/security/rating/
SUSE Security Ratings
https://bugzilla.suse.com/1179998
SUSE Bug 1179998
https://www.suse.com/security/cve/CVE-2020-35458/
SUSE CVE CVE-2020-35458 page

Описание

An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code injection issue via the hawk_remember_me_id parameter in the login_from_cookie cookie. The user logout routine could be used by unauthenticated remote attackers to execute code as hauser.

Затронутые продукты

Image SLES15-SAP-Azure-BYOS:hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SAP-Azure-LI-BYOS-Production:hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SAP-Azure-VLI-BYOS-Production:hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Image SLES15-SAP-Azure:hawk2-2.4.0+git.1611141202.2fe6369e-3.21.1

Ссылки

https://www.suse.com/security/cve/CVE-2020-35458.html
CVE-2020-35458
https://bugzilla.suse.com/1179998
SUSE Bug 1179998