Issued:
2018-03-28
Updated:
2018-03-28

RHSA-2018:0602 - Moderate: openstack-tripleo-common and openstack-tripleo-heat-templates update

Synopsis

Moderate: openstack-tripleo-common and openstack-tripleo-heat-templates update

Type/Severity

Security Advisory Moderate

Topic

An update for openstack-tripleo-common and openstack-tripleo-heat-templates is now available for Red Hat OpenStack Platform 12.0 (Pike).

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

openstack-tripleo-common contains the python library for code common to the Red Hat OpenStack Platform director CLI and GUI (codename tripleo).

openstack-tripleo-heat-templates is a collection of OpenStack Orchestration templates and tools (codename heat), which can be used to help deploy OpenStack.

Security Fix(es):

  • openstack-tripleo-heat-templates: Ceph client keyring is world-readable when deployed by director (CVE-2017-12155)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Katuya Kawakami (NEC) for reporting this issue.

Bug Fix(es):

  • All Compute and Controller nodes have bridge-mappings configured and therefore are eligible to schedule routers. However, if you scheduled a router on a Compute node that doesn't have a connection to an external network, connectivity with the external network fails. This fix adds the ability to configure bridge-mappings in TripleO and in the director according to roles so that you can now exclude Compute nodes from router scheduling and maintain external network connectivity. (BZ#1510879)

  • Previously, the CephPools parameter value was incorrectly consumed as a string list instead of as a JSON object. This prevented creating additional Ceph pools during the overcloud deployment, because attempting to pass a JSON object failed. This fix updates the CephPools parameter so that it now accepts any JSON object that describes additional pools to create in the Ceph cluster. Note: The JSON object structure must conform to ceph-ansible conventions. (BZ#1516389)

  • There is currently a known issue with LDAP integration for Red Hat OpenStack Platform. The keystone_domain_confg tag is missing currently from keystone.yaml, preventing Puppet from properly applying the required configuration files. Consequently, LDAP integration with Red Hat OpenStack Platform will not be properly configured. As a workaround, you must manually edit keystone.yaml and add the missing tag. There are two ways to do this:

  1. Edit the file directly: a. Log into the undercloud as the stack user. b. Open the keystone.yaml in the editor of your choice. For example: sudo vi /usr/share/openstack-tripleo-heat-templates/docker/services/keystone.yaml c. Append the missing puppet tag, keystone_domain_confg, to line 94. For example: puppet_tags: keystone_config Changes to: puppet_tags: keystone_config,keystone_domain_confg d. Save and close keystone.yaml. e. Verify you see the missing tag in the keystone.yaml file. The following command should return '1': cat /usr/share/openstack-tripleo-heat-templates/docker/sercies/keystone.yaml | grep 'puppet_tags: keystone_config,keystone_domain_config' | wc -l

  2. Or, use sed to edit the file inline: a. Login to the undercloud as the stack user. b. Run the following command to add the missing puppet tag: sed -i 's/puppet_tags\: keystone_config/puppet_tags\: keystone_config,keystone_domain_config/' /usr/share/openstack-tripleo-heat-templates/docker/services/keystone.yaml c. Verify you see the missing tag in the keystone.yaml file The following command should return '1': cat /usr/share/openstack-tripleo-heat-templates/docker/sercies/keystone.yaml | grep 'puppet_tags: keystone_config,keystone_domain_config' | wc -l (BZ#1519057)

  • It is only possible to deploy Ceph storage servers if their disk devices are homogeneous. (BZ#1520004)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

ProductVersionArch
Red Hat OpenStack12x86_64
Red Hat OpenStack for IBM Power12ppc64le

Updated Packages

  • openstack-tripleo-heat-templates-7.0.9-8.el7ost.noarch.rpm
  • openstack-tripleo-heat-templates-7.0.9-8.el7ost.src.rpm

Fixes

CVEs

References

Additional information