Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2019-0804 (GCVE-0-2019-0804)
Vulnerability from cvelistv5 – Published: 2019-04-09 02:32 – Updated: 2024-08-04 17:58
VLAI
EPSS
Summary
An information disclosure vulnerability exists in the way Azure WaLinuxAgent creates swap files on resource disks, aka 'Azure Linux Agent Information Disclosure Vulnerability'.
Severity
No CVSS data available.
CWE
- Information Disclosure
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://portal.msrc.microsoft.com/en-US/security-… | x_refsource_CONFIRM |
| https://access.redhat.com/errata/RHSA-2019:1527 | vendor-advisoryx_refsource_REDHAT |
| http://lists.opensuse.org/opensuse-security-annou… | vendor-advisoryx_refsource_SUSE |
Date Public
2019-03-12 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T17:58:59.566Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0804"
},
{
"name": "RHSA-2019:1527",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:1527"
},
{
"name": "openSUSE-SU-2020:0261",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00037.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Azure",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "multiple"
}
]
}
],
"datePublic": "2019-03-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "An information disclosure vulnerability exists in the way Azure WaLinuxAgent creates swap files on resource disks, aka \u0027Azure Linux Agent Information Disclosure Vulnerability\u0027."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Information Disclosure",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-03-01T00:06:05.000Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0804"
},
{
"name": "RHSA-2019:1527",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2019:1527"
},
{
"name": "openSUSE-SU-2020:0261",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00037.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secure@microsoft.com",
"ID": "CVE-2019-0804",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Azure",
"version": {
"version_data": [
{
"version_value": "multiple"
}
]
}
}
]
},
"vendor_name": "Microsoft"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An information disclosure vulnerability exists in the way Azure WaLinuxAgent creates swap files on resource disks, aka \u0027Azure Linux Agent Information Disclosure Vulnerability\u0027."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Information Disclosure"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0804",
"refsource": "CONFIRM",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0804"
},
{
"name": "RHSA-2019:1527",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:1527"
},
{
"name": "openSUSE-SU-2020:0261",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00037.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2019-0804",
"datePublished": "2019-04-09T02:32:46.000Z",
"dateReserved": "2018-11-26T00:00:00.000Z",
"dateUpdated": "2024-08-04T17:58:59.566Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2019-0804",
"date": "2026-05-29",
"epss": "0.03688",
"percentile": "0.88132"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:walinuxagent:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.2.38\", \"matchCriteriaId\": \"685B4D91-B775-4004-8A40-4239687F7B88\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"An information disclosure vulnerability exists in the way Azure WaLinuxAgent creates swap files on resource disks, aka \u0027Azure Linux Agent Information Disclosure Vulnerability\u0027.\"}, {\"lang\": \"es\", \"value\": \"Se presenta una vulnerabilidad de divulgaci\\u00f3n de informaci\\u00f3n en la manera en que Azure WaLinuxAgent crea archivos de intercambio en discos de recursos, tambi\\u00e9n se conoce como \\\"Azure Linux Agent Information Disclosure Vulnerability\\\".\"}]",
"id": "CVE-2019-0804",
"lastModified": "2024-11-21T04:17:18.673",
"metrics": "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:S/C:P/I:N/A:N\", \"baseScore\": 4.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.0, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2019-04-09T03:29:00.843",
"references": "[{\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00037.html\", \"source\": \"secure@microsoft.com\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2019:1527\", \"source\": \"secure@microsoft.com\"}, {\"url\": \"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0804\", \"source\": \"secure@microsoft.com\", \"tags\": [\"Mitigation\", \"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00037.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2019:1527\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0804\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mitigation\", \"Patch\", \"Vendor Advisory\"]}]",
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-732\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2019-0804\",\"sourceIdentifier\":\"secure@microsoft.com\",\"published\":\"2019-04-09T03:29:00.843\",\"lastModified\":\"2024-11-21T04:17:18.673\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An information disclosure vulnerability exists in the way Azure WaLinuxAgent creates swap files on resource disks, aka \u0027Azure Linux Agent Information Disclosure Vulnerability\u0027.\"},{\"lang\":\"es\",\"value\":\"Se presenta una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n en la manera en que Azure WaLinuxAgent crea archivos de intercambio en discos de recursos, tambi\u00e9n se conoce como \\\"Azure Linux Agent Information Disclosure Vulnerability\\\".\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:N/A:N\",\"baseScore\":4.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-732\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:walinuxagent:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.2.38\",\"matchCriteriaId\":\"685B4D91-B775-4004-8A40-4239687F7B88\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00037.html\",\"source\":\"secure@microsoft.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:1527\",\"source\":\"secure@microsoft.com\"},{\"url\":\"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0804\",\"source\":\"secure@microsoft.com\",\"tags\":[\"Mitigation\",\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00037.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:1527\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0804\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mitigation\",\"Patch\",\"Vendor Advisory\"]}]}}"
}
}
RHSA-2019:1527
Vulnerability from csaf_redhat - Published: 2019-06-18 17:20 - Updated: 2025-11-21 18:08Summary
Red Hat Security Advisory: WALinuxAgent security update
Severity
Moderate
Notes
Topic: An update for WALinuxAgent is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The Windows Azure Linux Agent supports provisioning and running Linux virtual machines in the Microsoft Windows Azure cloud.
Security Fix(es):
* WALinuxAgent: swapfile created with weak permissions (CVE-2019-0804)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
An information disclosure vulnerability exists in the way Azure WaLinuxAgent creates swap files on resource disks, aka 'Azure Linux Agent Information Disclosure Vulnerability'.
5.0 (Medium)
Affected products
Threats
Impact
Moderate
References
9 references
Acknowledgments
Destinatech Limited
Francis McBratney
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for WALinuxAgent is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The Windows Azure Linux Agent supports provisioning and running Linux virtual machines in the Microsoft Windows Azure cloud.\n\nSecurity Fix(es):\n\n* WALinuxAgent: swapfile created with weak permissions (CVE-2019-0804)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2019:1527",
"url": "https://access.redhat.com/errata/RHSA-2019:1527"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1684181",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1684181"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1527.json"
}
],
"title": "Red Hat Security Advisory: WALinuxAgent security update",
"tracking": {
"current_release_date": "2025-11-21T18:08:49+00:00",
"generator": {
"date": "2025-11-21T18:08:49+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2019:1527",
"initial_release_date": "2019-06-18T17:20:12+00:00",
"revision_history": [
{
"date": "2019-06-18T17:20:12+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-06-18T17:20:12+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-21T18:08:49+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.0.0.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "WALinuxAgent-0:2.2.32-1.el8_0.1.src",
"product": {
"name": "WALinuxAgent-0:2.2.32-1.el8_0.1.src",
"product_id": "WALinuxAgent-0:2.2.32-1.el8_0.1.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/WALinuxAgent@2.2.32-1.el8_0.1?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "WALinuxAgent-0:2.2.32-1.el8_0.1.noarch",
"product": {
"name": "WALinuxAgent-0:2.2.32-1.el8_0.1.noarch",
"product_id": "WALinuxAgent-0:2.2.32-1.el8_0.1.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/WALinuxAgent@2.2.32-1.el8_0.1?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "WALinuxAgent-0:2.2.32-1.el8_0.1.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.0.0.Z:WALinuxAgent-0:2.2.32-1.el8_0.1.noarch"
},
"product_reference": "WALinuxAgent-0:2.2.32-1.el8_0.1.noarch",
"relates_to_product_reference": "AppStream-8.0.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "WALinuxAgent-0:2.2.32-1.el8_0.1.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.0.0.Z:WALinuxAgent-0:2.2.32-1.el8_0.1.src"
},
"product_reference": "WALinuxAgent-0:2.2.32-1.el8_0.1.src",
"relates_to_product_reference": "AppStream-8.0.0.Z"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Francis McBratney"
],
"organization": "Destinatech Limited"
}
],
"cve": "CVE-2019-0804",
"cwe": {
"id": "CWE-732",
"name": "Incorrect Permission Assignment for Critical Resource"
},
"discovery_date": "2019-02-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1684181"
}
],
"notes": [
{
"category": "description",
"text": "An information disclosure vulnerability exists in the way Azure WaLinuxAgent creates swap files on resource disks, aka \u0027Azure Linux Agent Information Disclosure Vulnerability\u0027.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "WALinuxAgent: swapfile created with weak permissions",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.0.0.Z:WALinuxAgent-0:2.2.32-1.el8_0.1.noarch",
"AppStream-8.0.0.Z:WALinuxAgent-0:2.2.32-1.el8_0.1.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-0804"
},
{
"category": "external",
"summary": "RHBZ#1684181",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1684181"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-0804",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-0804"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0804",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0804"
},
{
"category": "external",
"summary": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0804",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0804"
}
],
"release_date": "2019-03-12T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2019-06-18T17:20:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.0.0.Z:WALinuxAgent-0:2.2.32-1.el8_0.1.noarch",
"AppStream-8.0.0.Z:WALinuxAgent-0:2.2.32-1.el8_0.1.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2019:1527"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"AppStream-8.0.0.Z:WALinuxAgent-0:2.2.32-1.el8_0.1.noarch",
"AppStream-8.0.0.Z:WALinuxAgent-0:2.2.32-1.el8_0.1.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "WALinuxAgent: swapfile created with weak permissions"
}
]
}
RHSA-2019_1527
Vulnerability from csaf_redhat - Published: 2019-06-18 17:20 - Updated: 2024-11-22 13:20Summary
Red Hat Security Advisory: WALinuxAgent security update
Severity
Moderate
Notes
Topic: An update for WALinuxAgent is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The Windows Azure Linux Agent supports provisioning and running Linux virtual machines in the Microsoft Windows Azure cloud.
Security Fix(es):
* WALinuxAgent: swapfile created with weak permissions (CVE-2019-0804)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
An information disclosure vulnerability exists in the way Azure WaLinuxAgent creates swap files on resource disks, aka 'Azure Linux Agent Information Disclosure Vulnerability'.
5.0 (Medium)
Affected products
Threats
Impact
Moderate
References
9 references
Acknowledgments
Destinatech Limited
Francis McBratney
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for WALinuxAgent is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The Windows Azure Linux Agent supports provisioning and running Linux virtual machines in the Microsoft Windows Azure cloud.\n\nSecurity Fix(es):\n\n* WALinuxAgent: swapfile created with weak permissions (CVE-2019-0804)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2019:1527",
"url": "https://access.redhat.com/errata/RHSA-2019:1527"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1684181",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1684181"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1527.json"
}
],
"title": "Red Hat Security Advisory: WALinuxAgent security update",
"tracking": {
"current_release_date": "2024-11-22T13:20:25+00:00",
"generator": {
"date": "2024-11-22T13:20:25+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2019:1527",
"initial_release_date": "2019-06-18T17:20:12+00:00",
"revision_history": [
{
"date": "2019-06-18T17:20:12+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-06-18T17:20:12+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T13:20:25+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.0.0.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "WALinuxAgent-0:2.2.32-1.el8_0.1.src",
"product": {
"name": "WALinuxAgent-0:2.2.32-1.el8_0.1.src",
"product_id": "WALinuxAgent-0:2.2.32-1.el8_0.1.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/WALinuxAgent@2.2.32-1.el8_0.1?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "WALinuxAgent-0:2.2.32-1.el8_0.1.noarch",
"product": {
"name": "WALinuxAgent-0:2.2.32-1.el8_0.1.noarch",
"product_id": "WALinuxAgent-0:2.2.32-1.el8_0.1.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/WALinuxAgent@2.2.32-1.el8_0.1?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "WALinuxAgent-0:2.2.32-1.el8_0.1.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.0.0.Z:WALinuxAgent-0:2.2.32-1.el8_0.1.noarch"
},
"product_reference": "WALinuxAgent-0:2.2.32-1.el8_0.1.noarch",
"relates_to_product_reference": "AppStream-8.0.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "WALinuxAgent-0:2.2.32-1.el8_0.1.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.0.0.Z:WALinuxAgent-0:2.2.32-1.el8_0.1.src"
},
"product_reference": "WALinuxAgent-0:2.2.32-1.el8_0.1.src",
"relates_to_product_reference": "AppStream-8.0.0.Z"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Francis McBratney"
],
"organization": "Destinatech Limited"
}
],
"cve": "CVE-2019-0804",
"cwe": {
"id": "CWE-732",
"name": "Incorrect Permission Assignment for Critical Resource"
},
"discovery_date": "2019-02-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1684181"
}
],
"notes": [
{
"category": "description",
"text": "An information disclosure vulnerability exists in the way Azure WaLinuxAgent creates swap files on resource disks, aka \u0027Azure Linux Agent Information Disclosure Vulnerability\u0027.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "WALinuxAgent: swapfile created with weak permissions",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.0.0.Z:WALinuxAgent-0:2.2.32-1.el8_0.1.noarch",
"AppStream-8.0.0.Z:WALinuxAgent-0:2.2.32-1.el8_0.1.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-0804"
},
{
"category": "external",
"summary": "RHBZ#1684181",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1684181"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-0804",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-0804"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0804",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0804"
},
{
"category": "external",
"summary": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0804",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0804"
}
],
"release_date": "2019-03-12T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2019-06-18T17:20:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.0.0.Z:WALinuxAgent-0:2.2.32-1.el8_0.1.noarch",
"AppStream-8.0.0.Z:WALinuxAgent-0:2.2.32-1.el8_0.1.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2019:1527"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"AppStream-8.0.0.Z:WALinuxAgent-0:2.2.32-1.el8_0.1.noarch",
"AppStream-8.0.0.Z:WALinuxAgent-0:2.2.32-1.el8_0.1.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "WALinuxAgent: swapfile created with weak permissions"
}
]
}
SUSE-SU-2019:0603-1
Vulnerability from csaf_suse - Published: 2019-03-13 09:08 - Updated: 2019-03-13 09:08Summary
Security update for python-azure-agent
Severity
Important
Notes
Title of the patch: Security update for python-azure-agent
Description of the patch: This update for python-azure-agent fixes the following issues:
- CVE-2019-0804: An issue with swapfile handling in the agent created a data leak situation that exposes system memory data. (bsc#1127838)
Patchnames: SUSE-2019-603,SUSE-SLE-Module-Development-Tools-OBS-15-2019-603,SUSE-SLE-Module-Public-Cloud-15-2019-603
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.5 (Medium)
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15:python-azure-agent-2.2.36-7.6.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
References
9 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for python-azure-agent",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for python-azure-agent fixes the following issues:\n\n- CVE-2019-0804: An issue with swapfile handling in the agent created a data leak situation that exposes system memory data. (bsc#1127838)\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2019-603,SUSE-SLE-Module-Development-Tools-OBS-15-2019-603,SUSE-SLE-Module-Public-Cloud-15-2019-603",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2019_0603-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2019:0603-1",
"url": "https://www.suse.com/support/update/announcement/2019/suse-su-20190603-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2019:0603-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2019-March/005191.html"
},
{
"category": "self",
"summary": "SUSE Bug 1127838",
"url": "https://bugzilla.suse.com/1127838"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-0804 page",
"url": "https://www.suse.com/security/cve/CVE-2019-0804/"
}
],
"title": "Security update for python-azure-agent",
"tracking": {
"current_release_date": "2019-03-13T09:08:38Z",
"generator": {
"date": "2019-03-13T09:08:38Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2019:0603-1",
"initial_release_date": "2019-03-13T09:08:38Z",
"revision_history": [
{
"date": "2019-03-13T09:08:38Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python-azure-agent-2.2.36-7.6.1.noarch",
"product": {
"name": "python-azure-agent-2.2.36-7.6.1.noarch",
"product_id": "python-azure-agent-2.2.36-7.6.1.noarch"
}
},
{
"category": "product_version",
"name": "python-azure-agent-test-2.2.36-7.6.1.noarch",
"product": {
"name": "python-azure-agent-test-2.2.36-7.6.1.noarch",
"product_id": "python-azure-agent-test-2.2.36-7.6.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Public Cloud 15",
"product": {
"name": "SUSE Linux Enterprise Module for Public Cloud 15",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-public-cloud:15"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-azure-agent-2.2.36-7.6.1.noarch as component of SUSE Linux Enterprise Module for Public Cloud 15",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15:python-azure-agent-2.2.36-7.6.1.noarch"
},
"product_reference": "python-azure-agent-2.2.36-7.6.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2019-0804",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-0804"
}
],
"notes": [
{
"category": "general",
"text": "An information disclosure vulnerability exists in the way Azure WaLinuxAgent creates swap files on resource disks, aka \u0027Azure Linux Agent Information Disclosure Vulnerability\u0027.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Public Cloud 15:python-azure-agent-2.2.36-7.6.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-0804",
"url": "https://www.suse.com/security/cve/CVE-2019-0804"
},
{
"category": "external",
"summary": "SUSE Bug 1127838 for CVE-2019-0804",
"url": "https://bugzilla.suse.com/1127838"
},
{
"category": "external",
"summary": "SUSE Bug 1152980 for CVE-2019-0804",
"url": "https://bugzilla.suse.com/1152980"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Public Cloud 15:python-azure-agent-2.2.36-7.6.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Module for Public Cloud 15:python-azure-agent-2.2.36-7.6.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-03-13T09:08:38Z",
"details": "moderate"
}
],
"title": "CVE-2019-0804"
}
]
}
SUSE-SU-2019:3393-1
Vulnerability from csaf_suse - Published: 2019-12-30 13:04 - Updated: 2019-12-30 13:04Summary
Security update for python-azure-agent
Severity
Moderate
Notes
Title of the patch: Security update for python-azure-agent
Description of the patch: This update for python-azure-agent fixes the following issues:
Update to version 2.2.45 (jsc#ECO-80 bsc#1159639)
+ Add support for Gen2 VM resource disks
+ Use alternate systemd detection
+ Fix /proc/net/route requirement that causes errors on FreeBSD
+ Add cloud-init auto-detect to prevent multiple provisioning mechanisms
from relying on configuration for coordination
+ Disable cgroups when daemon is setup incorrectly
+ Remove upgrade extension loop for the same goal state
+ Add container id for extension telemetry events
+ Be more exact when detecting IMDS service health
+ Changing add_event to start sending missing fields
Update to version 2.2.44:
+ Remove outdated extension ZIP packages
+ Improved error handling when starting extensions using systemd
+ Reduce provisioning time of some custom images
+ Improve the handling of extension download errors
+ New API for extension authors to handle errors during extension update
+ Fix handling of errors in calls to openssl
+ Improve logic to determine current distro
+ Reduce verbosity of several logging statements
Update to version 2.2.42:
+ Poll for artifact blob, addresses goal state procesing issue
Update to version 2.2.41:
+ Rewriting the mechanism to start the extension using systemd-run for
systems using systemd for managing
+ Refactoring of resource monitoring framework using cgroup for both
systemd and non-systemd approaches [#1530, #1534]
+ Telemetry pipeline for resource monitoring data
Update to version 2.2.40:
+ Fixed tracking of memory/cpu usage
+ Do not prevent extensions from running if setting up cgroups fails
+ Enable systemd-aware deprovisioning on all versions >= 18.04
+ Add systemd support for Debian Jessie, Stretch, and Buster
+ Support for Linux Openwrt
Update to version 2.2.38:
+ CVE-2019-0804: WALinuxAgent could be made to expose sensitive information. (bsc#1127838)
+ Add fixes for handling swap file and other nit fixes
Update to version 2.2.37:
+ Improves re-try logic to handle errors while downloading extensions
Patchnames: SUSE-2019-3393,SUSE-SLE-Module-Development-Tools-OBS-15-2019-3393,SUSE-SLE-Module-Public-Cloud-15-2019-3393
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.5 (Medium)
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15:python-azure-agent-2.2.45-7.9.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
References
11 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for python-azure-agent",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for python-azure-agent fixes the following issues:\n\nUpdate to version 2.2.45 (jsc#ECO-80 bsc#1159639)\n\n+ Add support for Gen2 VM resource disks\n+ Use alternate systemd detection\n+ Fix /proc/net/route requirement that causes errors on FreeBSD\n+ Add cloud-init auto-detect to prevent multiple provisioning mechanisms\n from relying on configuration for coordination\n+ Disable cgroups when daemon is setup incorrectly\n+ Remove upgrade extension loop for the same goal state\n+ Add container id for extension telemetry events\n+ Be more exact when detecting IMDS service health\n+ Changing add_event to start sending missing fields\n\nUpdate to version 2.2.44:\n\n+ Remove outdated extension ZIP packages\n+ Improved error handling when starting extensions using systemd\n+ Reduce provisioning time of some custom images\n+ Improve the handling of extension download errors\n+ New API for extension authors to handle errors during extension update\n+ Fix handling of errors in calls to openssl\n+ Improve logic to determine current distro\n+ Reduce verbosity of several logging statements\n\nUpdate to version 2.2.42:\n\n+ Poll for artifact blob, addresses goal state procesing issue\n\nUpdate to version 2.2.41:\n\n+ Rewriting the mechanism to start the extension using systemd-run for\n systems using systemd for managing\n+ Refactoring of resource monitoring framework using cgroup for both\n systemd and non-systemd approaches [#1530, #1534]\n+ Telemetry pipeline for resource monitoring data\n\nUpdate to version 2.2.40:\n\n+ Fixed tracking of memory/cpu usage\n+ Do not prevent extensions from running if setting up cgroups fails\n+ Enable systemd-aware deprovisioning on all versions \u003e= 18.04\n+ Add systemd support for Debian Jessie, Stretch, and Buster\n+ Support for Linux Openwrt\n\nUpdate to version 2.2.38:\n\n+ CVE-2019-0804: WALinuxAgent could be made to expose sensitive information. (bsc#1127838)\n+ Add fixes for handling swap file and other nit fixes\n\nUpdate to version 2.2.37:\n\n+ Improves re-try logic to handle errors while downloading extensions\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2019-3393,SUSE-SLE-Module-Development-Tools-OBS-15-2019-3393,SUSE-SLE-Module-Public-Cloud-15-2019-3393",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2019_3393-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2019:3393-1",
"url": "https://www.suse.com/support/update/announcement/2019/suse-su-20193393-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2019:3393-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2019-December/006295.html"
},
{
"category": "self",
"summary": "SUSE Bug 1127838",
"url": "https://bugzilla.suse.com/1127838"
},
{
"category": "self",
"summary": "SUSE Bug 1159639",
"url": "https://bugzilla.suse.com/1159639"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-0804 page",
"url": "https://www.suse.com/security/cve/CVE-2019-0804/"
},
{
"category": "self",
"summary": "SUSE Bug ECO-80",
"url": "https://bugzilla.suse.com/ECO-80"
}
],
"title": "Security update for python-azure-agent",
"tracking": {
"current_release_date": "2019-12-30T13:04:35Z",
"generator": {
"date": "2019-12-30T13:04:35Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2019:3393-1",
"initial_release_date": "2019-12-30T13:04:35Z",
"revision_history": [
{
"date": "2019-12-30T13:04:35Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python-azure-agent-2.2.45-7.9.1.noarch",
"product": {
"name": "python-azure-agent-2.2.45-7.9.1.noarch",
"product_id": "python-azure-agent-2.2.45-7.9.1.noarch"
}
},
{
"category": "product_version",
"name": "python-azure-agent-test-2.2.45-7.9.1.noarch",
"product": {
"name": "python-azure-agent-test-2.2.45-7.9.1.noarch",
"product_id": "python-azure-agent-test-2.2.45-7.9.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Public Cloud 15",
"product": {
"name": "SUSE Linux Enterprise Module for Public Cloud 15",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-public-cloud:15"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-azure-agent-2.2.45-7.9.1.noarch as component of SUSE Linux Enterprise Module for Public Cloud 15",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15:python-azure-agent-2.2.45-7.9.1.noarch"
},
"product_reference": "python-azure-agent-2.2.45-7.9.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2019-0804",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-0804"
}
],
"notes": [
{
"category": "general",
"text": "An information disclosure vulnerability exists in the way Azure WaLinuxAgent creates swap files on resource disks, aka \u0027Azure Linux Agent Information Disclosure Vulnerability\u0027.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Public Cloud 15:python-azure-agent-2.2.45-7.9.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-0804",
"url": "https://www.suse.com/security/cve/CVE-2019-0804"
},
{
"category": "external",
"summary": "SUSE Bug 1127838 for CVE-2019-0804",
"url": "https://bugzilla.suse.com/1127838"
},
{
"category": "external",
"summary": "SUSE Bug 1152980 for CVE-2019-0804",
"url": "https://bugzilla.suse.com/1152980"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Public Cloud 15:python-azure-agent-2.2.45-7.9.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Module for Public Cloud 15:python-azure-agent-2.2.45-7.9.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-12-30T13:04:35Z",
"details": "moderate"
}
],
"title": "CVE-2019-0804"
}
]
}
SUSE-SU-2019:3394-1
Vulnerability from csaf_suse - Published: 2019-12-30 13:04 - Updated: 2019-12-30 13:04Summary
Security update for python-azure-agent
Severity
Moderate
Notes
Title of the patch: Security update for python-azure-agent
Description of the patch: This update for python-azure-agent fixes the following issues:
Update to version 2.2.45 (jsc#ECO-80)
+ Add support for Gen2 VM resource disks
+ Use alternate systemd detection
+ Fix /proc/net/route requirement that causes errors on FreeBSD
+ Add cloud-init auto-detect to prevent multiple provisioning mechanisms
from relying on configuration for coordination
+ Disable cgroups when daemon is setup incorrectly
+ Remove upgrade extension loop for the same goal state
+ Add container id for extension telemetry events
+ Be more exact when detecting IMDS service health
+ Changing add_event to start sending missing fields
Update to version 2.2.44:
+ Remove outdated extension ZIP packages
+ Improved error handling when starting extensions using systemd
+ Reduce provisioning time of some custom images
+ Improve the handling of extension download errors
+ New API for extension authors to handle errors during extension update
+ Fix handling of errors in calls to openssl
+ Improve logic to determine current distro
+ Reduce verbosity of several logging statements
Update to version 2.2.42:
+ Poll for artifact blob, addresses goal state procesing issue
Update to version 2.2.41:
+ Rewriting the mechanism to start the extension using systemd-run for
systems using systemd for managing
+ Refactoring of resource monitoring framework using cgroup for both
systemd and non-systemd approaches [#1530, #1534]
+ Telemetry pipeline for resource monitoring data
Update to version 2.2.40:
+ Fixed tracking of memory/cpu usage
+ Do not prevent extensions from running if setting up cgroups fails
+ Enable systemd-aware deprovisioning on all versions >= 18.04
+ Add systemd support for Debian Jessie, Stretch, and Buster
+ Support for Linux Openwrt
Update to version 2.2.38:
+ CVE-2019-0804: An issue with swapfile handling in the agent creates a data leak situation that exposes system memory data. (bsc#1127838)
+ Add fixes for handling swap file and other nit fixes
Update to 2.2.37:
+ Improves re-try logic to handle errors while downloading extensions
Patchnames: SUSE-2019-3394,SUSE-SLE-Module-Public-Cloud-12-2019-3394
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.5 (Medium)
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 12:python-azure-agent-2.2.45-34.20.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
References
11 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for python-azure-agent",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for python-azure-agent fixes the following issues:\n\nUpdate to version 2.2.45 (jsc#ECO-80)\n\n+ Add support for Gen2 VM resource disks\n+ Use alternate systemd detection\n+ Fix /proc/net/route requirement that causes errors on FreeBSD\n+ Add cloud-init auto-detect to prevent multiple provisioning mechanisms\n from relying on configuration for coordination\n+ Disable cgroups when daemon is setup incorrectly\n+ Remove upgrade extension loop for the same goal state\n+ Add container id for extension telemetry events\n+ Be more exact when detecting IMDS service health\n+ Changing add_event to start sending missing fields\n\nUpdate to version 2.2.44:\n\n+ Remove outdated extension ZIP packages\n+ Improved error handling when starting extensions using systemd\n+ Reduce provisioning time of some custom images\n+ Improve the handling of extension download errors\n+ New API for extension authors to handle errors during extension update\n+ Fix handling of errors in calls to openssl\n+ Improve logic to determine current distro\n+ Reduce verbosity of several logging statements\n\nUpdate to version 2.2.42:\n\n+ Poll for artifact blob, addresses goal state procesing issue\n\nUpdate to version 2.2.41:\n\n+ Rewriting the mechanism to start the extension using systemd-run for\n systems using systemd for managing\n+ Refactoring of resource monitoring framework using cgroup for both\n systemd and non-systemd approaches [#1530, #1534]\n+ Telemetry pipeline for resource monitoring data\n\nUpdate to version 2.2.40:\n\n+ Fixed tracking of memory/cpu usage\n+ Do not prevent extensions from running if setting up cgroups fails\n+ Enable systemd-aware deprovisioning on all versions \u003e= 18.04\n+ Add systemd support for Debian Jessie, Stretch, and Buster\n+ Support for Linux Openwrt\n\nUpdate to version 2.2.38:\n\n+ CVE-2019-0804: An issue with swapfile handling in the agent creates a data leak situation that exposes system memory data. (bsc#1127838)\n+ Add fixes for handling swap file and other nit fixes\n\nUpdate to 2.2.37:\n\n+ Improves re-try logic to handle errors while downloading extensions\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2019-3394,SUSE-SLE-Module-Public-Cloud-12-2019-3394",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2019_3394-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2019:3394-1",
"url": "https://www.suse.com/support/update/announcement/2019/suse-su-20193394-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2019:3394-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2019-December/006296.html"
},
{
"category": "self",
"summary": "SUSE Bug 1127838",
"url": "https://bugzilla.suse.com/1127838"
},
{
"category": "self",
"summary": "SUSE Bug 1159639",
"url": "https://bugzilla.suse.com/1159639"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-0804 page",
"url": "https://www.suse.com/security/cve/CVE-2019-0804/"
},
{
"category": "self",
"summary": "SUSE Bug ECO-80",
"url": "https://bugzilla.suse.com/ECO-80"
}
],
"title": "Security update for python-azure-agent",
"tracking": {
"current_release_date": "2019-12-30T13:04:45Z",
"generator": {
"date": "2019-12-30T13:04:45Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2019:3394-1",
"initial_release_date": "2019-12-30T13:04:45Z",
"revision_history": [
{
"date": "2019-12-30T13:04:45Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python-azure-agent-2.2.45-34.20.1.noarch",
"product": {
"name": "python-azure-agent-2.2.45-34.20.1.noarch",
"product_id": "python-azure-agent-2.2.45-34.20.1.noarch"
}
},
{
"category": "product_version",
"name": "python-azure-agent-test-2.2.45-34.20.1.noarch",
"product": {
"name": "python-azure-agent-test-2.2.45-34.20.1.noarch",
"product_id": "python-azure-agent-test-2.2.45-34.20.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Public Cloud 12",
"product": {
"name": "SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 12",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-public-cloud:12"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-azure-agent-2.2.45-34.20.1.noarch as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 12:python-azure-agent-2.2.45-34.20.1.noarch"
},
"product_reference": "python-azure-agent-2.2.45-34.20.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 12"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2019-0804",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-0804"
}
],
"notes": [
{
"category": "general",
"text": "An information disclosure vulnerability exists in the way Azure WaLinuxAgent creates swap files on resource disks, aka \u0027Azure Linux Agent Information Disclosure Vulnerability\u0027.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Public Cloud 12:python-azure-agent-2.2.45-34.20.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-0804",
"url": "https://www.suse.com/security/cve/CVE-2019-0804"
},
{
"category": "external",
"summary": "SUSE Bug 1127838 for CVE-2019-0804",
"url": "https://bugzilla.suse.com/1127838"
},
{
"category": "external",
"summary": "SUSE Bug 1152980 for CVE-2019-0804",
"url": "https://bugzilla.suse.com/1152980"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Public Cloud 12:python-azure-agent-2.2.45-34.20.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Module for Public Cloud 12:python-azure-agent-2.2.45-34.20.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-12-30T13:04:45Z",
"details": "moderate"
}
],
"title": "CVE-2019-0804"
}
]
}
SUSE-SU-2020:0440-1
Vulnerability from csaf_suse - Published: 2020-02-24 14:31 - Updated: 2020-02-24 14:31Summary
Security update for python-azure-agent
Severity
Moderate
Notes
Title of the patch: Security update for python-azure-agent
Description of the patch: This update for python-azure-agent fixes the following issues:
python-azure-agent was updated to version 2.2.45 (jsc#ECO-80)
+ Add support for Gen2 VM resource disks
+ Use alternate systemd detection
+ Fix /proc/net/route requirement that causes errors on FreeBSD
+ Add cloud-init auto-detect to prevent multiple provisioning mechanisms
from relying on configuration for coordination
+ Disable cgroups when daemon is setup incorrectly
+ Remove upgrade extension loop for the same goal state
+ Add container id for extension telemetry events
+ Be more exact when detecting IMDS service health
+ Changing add_event to start sending missing fields
From 2.2.44 update:
+ Remove outdated extension ZIP packages
+ Improved error handling when starting extensions using systemd
+ Reduce provisioning time of some custom images
+ Improve the handling of extension download errors
+ New API for extension authors to handle errors during extension update
+ Fix handling of errors in calls to openssl
+ Improve logic to determine current distro
+ Reduce verbosity of several logging statements
From 2.2.42 update:
+ Poll for artifact blob, addresses goal state procesing issue
From 2.2.41 update:
+ Rewriting the mechanism to start the extension using systemd-run for
systems using systemd for managing
+ Refactoring of resource monitoring framework using cgroup for both
systemd and non-systemd approaches [#1530, #1534]
+ Telemetry pipeline for resource monitoring data
From 2.2.40 update:
+ Fixed tracking of memory/cpu usage
+ Do not prevent extensions from running if setting up cgroups fails
+ Enable systemd-aware deprovisioning on all versions >= 18.04
+ Add systemd support for Debian Jessie, Stretch, and Buster
+ Support for Linux Openwrt
From 2.2.38 update:
Security issue fixed:
+ CVE-2019-0804: An issue with swapfile handling in the agent creates
a data leak situation that exposes system memory data. (bsc#1127838)
+ Add fixes for handling swap file and other nit fixes
From 2.2.37 update:
+ Improves re-try logic to handle errors while downloading extensions
Patchnames: SUSE-2020-440,SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2020-440,SUSE-SLE-Module-Public-Cloud-15-SP1-2020-440
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.5 (Medium)
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP1:python-azure-agent-2.2.45-3.3.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
References
9 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for python-azure-agent",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for python-azure-agent fixes the following issues:\n\npython-azure-agent was updated to version 2.2.45 (jsc#ECO-80)\n\n+ Add support for Gen2 VM resource disks\n+ Use alternate systemd detection\n+ Fix /proc/net/route requirement that causes errors on FreeBSD\n+ Add cloud-init auto-detect to prevent multiple provisioning mechanisms\n from relying on configuration for coordination\n+ Disable cgroups when daemon is setup incorrectly\n+ Remove upgrade extension loop for the same goal state\n+ Add container id for extension telemetry events\n+ Be more exact when detecting IMDS service health\n+ Changing add_event to start sending missing fields\n\nFrom 2.2.44 update:\n\n+ Remove outdated extension ZIP packages\n+ Improved error handling when starting extensions using systemd\n+ Reduce provisioning time of some custom images\n+ Improve the handling of extension download errors\n+ New API for extension authors to handle errors during extension update\n+ Fix handling of errors in calls to openssl\n+ Improve logic to determine current distro\n+ Reduce verbosity of several logging statements\n\nFrom 2.2.42 update:\n\n+ Poll for artifact blob, addresses goal state procesing issue\n\nFrom 2.2.41 update:\n\n+ Rewriting the mechanism to start the extension using systemd-run for\n systems using systemd for managing\n+ Refactoring of resource monitoring framework using cgroup for both\n systemd and non-systemd approaches [#1530, #1534]\n+ Telemetry pipeline for resource monitoring data\n\nFrom 2.2.40 update:\n\n+ Fixed tracking of memory/cpu usage\n+ Do not prevent extensions from running if setting up cgroups fails\n+ Enable systemd-aware deprovisioning on all versions \u003e= 18.04\n+ Add systemd support for Debian Jessie, Stretch, and Buster\n+ Support for Linux Openwrt\n\nFrom 2.2.38 update:\n\nSecurity issue fixed:\n+ CVE-2019-0804: An issue with swapfile handling in the agent creates\n a data leak situation that exposes system memory data. (bsc#1127838)\n+ Add fixes for handling swap file and other nit fixes\n\nFrom 2.2.37 update:\n+ Improves re-try logic to handle errors while downloading extensions\n\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2020-440,SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2020-440,SUSE-SLE-Module-Public-Cloud-15-SP1-2020-440",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2020_0440-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2020:0440-1",
"url": "https://www.suse.com/support/update/announcement/2020/suse-su-20200440-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2020:0440-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2020-February/006516.html"
},
{
"category": "self",
"summary": "SUSE Bug 1127838",
"url": "https://bugzilla.suse.com/1127838"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-0804 page",
"url": "https://www.suse.com/security/cve/CVE-2019-0804/"
}
],
"title": "Security update for python-azure-agent",
"tracking": {
"current_release_date": "2020-02-24T14:31:48Z",
"generator": {
"date": "2020-02-24T14:31:48Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2020:0440-1",
"initial_release_date": "2020-02-24T14:31:48Z",
"revision_history": [
{
"date": "2020-02-24T14:31:48Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python-azure-agent-2.2.45-3.3.1.noarch",
"product": {
"name": "python-azure-agent-2.2.45-3.3.1.noarch",
"product_id": "python-azure-agent-2.2.45-3.3.1.noarch"
}
},
{
"category": "product_version",
"name": "python-azure-agent-test-2.2.45-3.3.1.noarch",
"product": {
"name": "python-azure-agent-test-2.2.45-3.3.1.noarch",
"product_id": "python-azure-agent-test-2.2.45-3.3.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Public Cloud 15 SP1",
"product": {
"name": "SUSE Linux Enterprise Module for Public Cloud 15 SP1",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-public-cloud:15:sp1"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-azure-agent-2.2.45-3.3.1.noarch as component of SUSE Linux Enterprise Module for Public Cloud 15 SP1",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP1:python-azure-agent-2.2.45-3.3.1.noarch"
},
"product_reference": "python-azure-agent-2.2.45-3.3.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2019-0804",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-0804"
}
],
"notes": [
{
"category": "general",
"text": "An information disclosure vulnerability exists in the way Azure WaLinuxAgent creates swap files on resource disks, aka \u0027Azure Linux Agent Information Disclosure Vulnerability\u0027.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Public Cloud 15 SP1:python-azure-agent-2.2.45-3.3.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-0804",
"url": "https://www.suse.com/security/cve/CVE-2019-0804"
},
{
"category": "external",
"summary": "SUSE Bug 1127838 for CVE-2019-0804",
"url": "https://bugzilla.suse.com/1127838"
},
{
"category": "external",
"summary": "SUSE Bug 1152980 for CVE-2019-0804",
"url": "https://bugzilla.suse.com/1152980"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Public Cloud 15 SP1:python-azure-agent-2.2.45-3.3.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Module for Public Cloud 15 SP1:python-azure-agent-2.2.45-3.3.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-02-24T14:31:48Z",
"details": "moderate"
}
],
"title": "CVE-2019-0804"
}
]
}
SUSE-SU-2020:14454-1
Vulnerability from csaf_suse - Published: 2020-08-18 07:52 - Updated: 2020-08-18 07:52Summary
Security update for python-azure-agent
Severity
Moderate
Notes
Title of the patch: Security update for python-azure-agent
Description of the patch: This update for python-azure-agent fixes the following issues:
+ Properly set the dhcp configuration to push the hostname to the DHCP
server (bsc#1173866)
+ Do not bring the interface down to push the hostname, just use ifup
+ Set the hostname using hostnamectl to ensure setting is properly applied
(bsc#1167601, bsc#1167602)
Update to version 2.2.45 (jsc#ECO-80)
+ Add support for Gen2 VM resource disks
+ Use alternate systemd detection
+ Fix /proc/net/route requirement that causes errors on FreeBSD
+ Add cloud-init auto-detect to prevent multiple provisioning mechanisms
from relying on configuration for coordination
+ Disable cgroups when daemon is setup incorrectly
+ Remove upgrade extension loop for the same goal state
+ Add container id for extension telemetry events
+ Be more exact when detecting IMDS service health
+ Changing add_event to start sending missing fields
Patchnames: pubclsp3-python-azure-agent-14454
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.5 (Medium)
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 11-PUBCLOUD:python-azure-agent-2.2.45-28.8.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
References
20 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for python-azure-agent",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for python-azure-agent fixes the following issues:\n\n+ Properly set the dhcp configuration to push the hostname to the DHCP\n server (bsc#1173866)\n+ Do not bring the interface down to push the hostname, just use ifup\n+ Set the hostname using hostnamectl to ensure setting is properly applied\n (bsc#1167601, bsc#1167602)\n\nUpdate to version 2.2.45 (jsc#ECO-80)\n\n+ Add support for Gen2 VM resource disks\n+ Use alternate systemd detection\n+ Fix /proc/net/route requirement that causes errors on FreeBSD\n+ Add cloud-init auto-detect to prevent multiple provisioning mechanisms\n from relying on configuration for coordination\n+ Disable cgroups when daemon is setup incorrectly\n+ Remove upgrade extension loop for the same goal state\n+ Add container id for extension telemetry events\n+ Be more exact when detecting IMDS service health\n+ Changing add_event to start sending missing fields\n\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "pubclsp3-python-azure-agent-14454",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2020_14454-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2020:14454-1",
"url": "https://www.suse.com/support/update/announcement/2020/suse-su-202014454-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2020:14454-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2020-August/007274.html"
},
{
"category": "self",
"summary": "SUSE Bug 1061584",
"url": "https://bugzilla.suse.com/1061584"
},
{
"category": "self",
"summary": "SUSE Bug 1074865",
"url": "https://bugzilla.suse.com/1074865"
},
{
"category": "self",
"summary": "SUSE Bug 1087764",
"url": "https://bugzilla.suse.com/1087764"
},
{
"category": "self",
"summary": "SUSE Bug 1092831",
"url": "https://bugzilla.suse.com/1092831"
},
{
"category": "self",
"summary": "SUSE Bug 1094420",
"url": "https://bugzilla.suse.com/1094420"
},
{
"category": "self",
"summary": "SUSE Bug 1119542",
"url": "https://bugzilla.suse.com/1119542"
},
{
"category": "self",
"summary": "SUSE Bug 1127838",
"url": "https://bugzilla.suse.com/1127838"
},
{
"category": "self",
"summary": "SUSE Bug 1167601",
"url": "https://bugzilla.suse.com/1167601"
},
{
"category": "self",
"summary": "SUSE Bug 1167602",
"url": "https://bugzilla.suse.com/1167602"
},
{
"category": "self",
"summary": "SUSE Bug 1173866",
"url": "https://bugzilla.suse.com/1173866"
},
{
"category": "self",
"summary": "SUSE Bug 1175130",
"url": "https://bugzilla.suse.com/1175130"
},
{
"category": "self",
"summary": "SUSE Bug 997614",
"url": "https://bugzilla.suse.com/997614"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-0804 page",
"url": "https://www.suse.com/security/cve/CVE-2019-0804/"
}
],
"title": "Security update for python-azure-agent",
"tracking": {
"current_release_date": "2020-08-18T07:52:06Z",
"generator": {
"date": "2020-08-18T07:52:06Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2020:14454-1",
"initial_release_date": "2020-08-18T07:52:06Z",
"revision_history": [
{
"date": "2020-08-18T07:52:06Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python-azure-agent-2.2.45-28.8.1.x86_64",
"product": {
"name": "python-azure-agent-2.2.45-28.8.1.x86_64",
"product_id": "python-azure-agent-2.2.45-28.8.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 11-PUBCLOUD",
"product": {
"name": "SUSE Linux Enterprise Server 11-PUBCLOUD",
"product_id": "SUSE Linux Enterprise Server 11-PUBCLOUD"
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-azure-agent-2.2.45-28.8.1.x86_64 as component of SUSE Linux Enterprise Server 11-PUBCLOUD",
"product_id": "SUSE Linux Enterprise Server 11-PUBCLOUD:python-azure-agent-2.2.45-28.8.1.x86_64"
},
"product_reference": "python-azure-agent-2.2.45-28.8.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11-PUBCLOUD"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2019-0804",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-0804"
}
],
"notes": [
{
"category": "general",
"text": "An information disclosure vulnerability exists in the way Azure WaLinuxAgent creates swap files on resource disks, aka \u0027Azure Linux Agent Information Disclosure Vulnerability\u0027.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11-PUBCLOUD:python-azure-agent-2.2.45-28.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-0804",
"url": "https://www.suse.com/security/cve/CVE-2019-0804"
},
{
"category": "external",
"summary": "SUSE Bug 1127838 for CVE-2019-0804",
"url": "https://bugzilla.suse.com/1127838"
},
{
"category": "external",
"summary": "SUSE Bug 1152980 for CVE-2019-0804",
"url": "https://bugzilla.suse.com/1152980"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11-PUBCLOUD:python-azure-agent-2.2.45-28.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 11-PUBCLOUD:python-azure-agent-2.2.45-28.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-08-18T07:52:06Z",
"details": "moderate"
}
],
"title": "CVE-2019-0804"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…