suse-su-2019:3394-1
Vulnerability from csaf_suse
Published
2019-12-30 13:04
Modified
2019-12-30 13:04
Summary
Security update for python-azure-agent
Notes
Title of the patch
Security update for python-azure-agent
Description of the patch
This update for python-azure-agent fixes the following issues:
Update to version 2.2.45 (jsc#ECO-80)
+ Add support for Gen2 VM resource disks
+ Use alternate systemd detection
+ Fix /proc/net/route requirement that causes errors on FreeBSD
+ Add cloud-init auto-detect to prevent multiple provisioning mechanisms
from relying on configuration for coordination
+ Disable cgroups when daemon is setup incorrectly
+ Remove upgrade extension loop for the same goal state
+ Add container id for extension telemetry events
+ Be more exact when detecting IMDS service health
+ Changing add_event to start sending missing fields
Update to version 2.2.44:
+ Remove outdated extension ZIP packages
+ Improved error handling when starting extensions using systemd
+ Reduce provisioning time of some custom images
+ Improve the handling of extension download errors
+ New API for extension authors to handle errors during extension update
+ Fix handling of errors in calls to openssl
+ Improve logic to determine current distro
+ Reduce verbosity of several logging statements
Update to version 2.2.42:
+ Poll for artifact blob, addresses goal state procesing issue
Update to version 2.2.41:
+ Rewriting the mechanism to start the extension using systemd-run for
systems using systemd for managing
+ Refactoring of resource monitoring framework using cgroup for both
systemd and non-systemd approaches [#1530, #1534]
+ Telemetry pipeline for resource monitoring data
Update to version 2.2.40:
+ Fixed tracking of memory/cpu usage
+ Do not prevent extensions from running if setting up cgroups fails
+ Enable systemd-aware deprovisioning on all versions >= 18.04
+ Add systemd support for Debian Jessie, Stretch, and Buster
+ Support for Linux Openwrt
Update to version 2.2.38:
+ CVE-2019-0804: An issue with swapfile handling in the agent creates a data leak situation that exposes system memory data. (bsc#1127838)
+ Add fixes for handling swap file and other nit fixes
Update to 2.2.37:
+ Improves re-try logic to handle errors while downloading extensions
Patchnames
SUSE-2019-3394,SUSE-SLE-Module-Public-Cloud-12-2019-3394
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for python-azure-agent",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for python-azure-agent fixes the following issues:\n\nUpdate to version 2.2.45 (jsc#ECO-80)\n\n+ Add support for Gen2 VM resource disks\n+ Use alternate systemd detection\n+ Fix /proc/net/route requirement that causes errors on FreeBSD\n+ Add cloud-init auto-detect to prevent multiple provisioning mechanisms\n from relying on configuration for coordination\n+ Disable cgroups when daemon is setup incorrectly\n+ Remove upgrade extension loop for the same goal state\n+ Add container id for extension telemetry events\n+ Be more exact when detecting IMDS service health\n+ Changing add_event to start sending missing fields\n\nUpdate to version 2.2.44:\n\n+ Remove outdated extension ZIP packages\n+ Improved error handling when starting extensions using systemd\n+ Reduce provisioning time of some custom images\n+ Improve the handling of extension download errors\n+ New API for extension authors to handle errors during extension update\n+ Fix handling of errors in calls to openssl\n+ Improve logic to determine current distro\n+ Reduce verbosity of several logging statements\n\nUpdate to version 2.2.42:\n\n+ Poll for artifact blob, addresses goal state procesing issue\n\nUpdate to version 2.2.41:\n\n+ Rewriting the mechanism to start the extension using systemd-run for\n systems using systemd for managing\n+ Refactoring of resource monitoring framework using cgroup for both\n systemd and non-systemd approaches [#1530, #1534]\n+ Telemetry pipeline for resource monitoring data\n\nUpdate to version 2.2.40:\n\n+ Fixed tracking of memory/cpu usage\n+ Do not prevent extensions from running if setting up cgroups fails\n+ Enable systemd-aware deprovisioning on all versions \u003e= 18.04\n+ Add systemd support for Debian Jessie, Stretch, and Buster\n+ Support for Linux Openwrt\n\nUpdate to version 2.2.38:\n\n+ CVE-2019-0804: An issue with swapfile handling in the agent creates a data leak situation that exposes system memory data. (bsc#1127838)\n+ Add fixes for handling swap file and other nit fixes\n\nUpdate to 2.2.37:\n\n+ Improves re-try logic to handle errors while downloading extensions\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2019-3394,SUSE-SLE-Module-Public-Cloud-12-2019-3394",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2019_3394-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2019:3394-1",
"url": "https://www.suse.com/support/update/announcement/2019/suse-su-20193394-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2019:3394-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2019-December/006296.html"
},
{
"category": "self",
"summary": "SUSE Bug 1127838",
"url": "https://bugzilla.suse.com/1127838"
},
{
"category": "self",
"summary": "SUSE Bug 1159639",
"url": "https://bugzilla.suse.com/1159639"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-0804 page",
"url": "https://www.suse.com/security/cve/CVE-2019-0804/"
},
{
"category": "self",
"summary": "SUSE Bug ECO-80",
"url": "https://bugzilla.suse.com/ECO-80"
}
],
"title": "Security update for python-azure-agent",
"tracking": {
"current_release_date": "2019-12-30T13:04:45Z",
"generator": {
"date": "2019-12-30T13:04:45Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2019:3394-1",
"initial_release_date": "2019-12-30T13:04:45Z",
"revision_history": [
{
"date": "2019-12-30T13:04:45Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python-azure-agent-2.2.45-34.20.1.noarch",
"product": {
"name": "python-azure-agent-2.2.45-34.20.1.noarch",
"product_id": "python-azure-agent-2.2.45-34.20.1.noarch"
}
},
{
"category": "product_version",
"name": "python-azure-agent-test-2.2.45-34.20.1.noarch",
"product": {
"name": "python-azure-agent-test-2.2.45-34.20.1.noarch",
"product_id": "python-azure-agent-test-2.2.45-34.20.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Public Cloud 12",
"product": {
"name": "SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 12",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-public-cloud:12"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-azure-agent-2.2.45-34.20.1.noarch as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 12:python-azure-agent-2.2.45-34.20.1.noarch"
},
"product_reference": "python-azure-agent-2.2.45-34.20.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 12"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2019-0804",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-0804"
}
],
"notes": [
{
"category": "general",
"text": "An information disclosure vulnerability exists in the way Azure WaLinuxAgent creates swap files on resource disks, aka \u0027Azure Linux Agent Information Disclosure Vulnerability\u0027.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Public Cloud 12:python-azure-agent-2.2.45-34.20.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-0804",
"url": "https://www.suse.com/security/cve/CVE-2019-0804"
},
{
"category": "external",
"summary": "SUSE Bug 1127838 for CVE-2019-0804",
"url": "https://bugzilla.suse.com/1127838"
},
{
"category": "external",
"summary": "SUSE Bug 1152980 for CVE-2019-0804",
"url": "https://bugzilla.suse.com/1152980"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Public Cloud 12:python-azure-agent-2.2.45-34.20.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Module for Public Cloud 12:python-azure-agent-2.2.45-34.20.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-12-30T13:04:45Z",
"details": "moderate"
}
],
"title": "CVE-2019-0804"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…