CVE-2020-29565

    OpenStack是美国国家航空航天局（National Aeronautics and Space Administration）和美国Rackspace公司合作研发的一个云平台管理项目。

    OpenStack Horizon 15.3.2,16之前版本存在安全漏洞，该漏洞源于next参数缺乏验证，这将允许某人在Horizon中提供恶意URL，从而导致自动重定向到所提供的恶意URL。以下产品及版本受到影响： 15.3.2之前版本, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x版本。

2.影响的操作系统

    银河麒麟桌面操作系统V4 SP1

    银河麒麟桌面操作系统V4 SP2

    银河麒麟桌面操作系统V4 SP3

    银河麒麟桌面操作系统V4 SP4

    银河麒麟服务器操作系统V4 SP1

    银河麒麟服务器操作系统V4 SP2

    银河麒麟服务器操作系统V4 SP3

    银河麒麟服务器操作系统V4 SP4

    银河麒麟桌面操作系统V10

    银河麒麟桌面操作系统V10 SP1

3.修复版本

    软件包：horizon

    2:9.1.2-0kord5.2（V4、V10）

    3:18.3.2-0kylin0.20.04.4(V10 SP1)

4.受影响的软件包

    ·银河麒麟操作系统V10桌面版、V4

    openstack-dashboard

    openstack-dashboard-ubuntu-theme

    python-django-horizon

    ·银河麒麟桌面操作系统V10 SP1

    openstack-dashboard

    openstack-dashboard-common

    openstack-dashboard-ubuntu-theme

    python3-django-horizon

    python3-django-openstack-auth

5.修复方法

方法一：配置源进行升级安装

    打开软件包源配置文件，根据仓库地址进行修改。

    4.0.2桌面版本:

    http://archive.kylinos.cn/kylin/KYLIN-ALL 4.0.2-desktop main restricted universe multiverse

    4.0.2-sp1桌面版本:

    http://archive.kylinos.cn/kylin/KYLIN-ALL 4.0.2sp1-desktop main restricted universe multiverse

    4.0.2-sp2桌面版本:

    http://archive.kylinos.cn/kylin/KYLIN-ALL 4.0.2sp2-desktop main restricted universe multiverse

    4.0.2-sp3桌面版本:

    http://archive.kylinos.cn/kylin/KYLIN-ALL 4.0.2sp3-desktop main restricted universe multiverse

    4.0.2-sp4桌面版本:

    http://archive.kylinos.cn/kylin/KYLIN-ALL 4.0.2sp4-desktop main restricted universe multiverse

    10.0版本:

    http://archive.kylinos.cn/kylin/KYLIN-ALL 10.0 main restricted universe multiverse

    10SP1版本:

    http://archive.kylinos.cn/kylin/KYLIN-ALL 10.1 main restricted universe multiverse

    配置完成后执行更新命令进行升级

    $sudo apt update

方法二：下载安装包进行升级安装

    通过软件包地址下载软件包，使用软件包升级命令根据受影响的组件包列表 升级相关的组件包。

    $dpkg -i Packagelists

6.软件包下载地址

银河麒麟操作系统V10桌面版、V4

X86_64软件包下载地址

http://archive.kylinos.cn/kylin/KYLIN-ALL/pool/main/h/horizon/openstack-dashboard-ubuntu-theme_9.1.2-0kord5.2_all.deb

http://archive.kylinos.cn/kylin/KYLIN-ALL/pool/main/h/horizon/openstack-dashboard_9.1.2-0kord5.2_all.deb

http://archive.kylinos.cn/kylin/KYLIN-ALL/pool/main/h/horizon/python-django-horizon_9.1.2-0kord5.2_all.deb

arm64软件包下载地址

http://archive.kylinos.cn/kylin/KYLIN-ALL/pool/main/h/horizon/openstack-dashboard-ubuntu-theme_9.1.2-0kord5.2_all.deb

http://archive.kylinos.cn/kylin/KYLIN-ALL/pool/main/h/horizon/openstack-dashboard_9.1.2-0kord5.2_all.deb

http://archive.kylinos.cn/kylin/KYLIN-ALL/pool/main/h/horizon/python-django-horizon_9.1.2-0kord5.2_all.deb

mips64el软件包下载地址

http://archive.kylinos.cn/kylin/KYLIN-ALL/pool/main/h/horizon/openstack-dashboard-ubuntu-theme_9.1.2-0kord5.2_all.deb

http://archive.kylinos.cn/kylin/KYLIN-ALL/pool/main/h/horizon/openstack-dashboard_9.1.2-0kord5.2_all.deb

http://archive.kylinos.cn/kylin/KYLIN-ALL/pool/main/h/horizon/python-django-horizon_9.1.2-0kord5.2_all.deb

银河麒麟操作系统桌面版V10 SP1

X86_64软件包下载地址

http://archive.kylinos.cn/kylin/KYLIN-ALL/pool/main/h/horizon/openstack-dashboard-common_18.3.2-0kylin0.20.04.4_all.deb

http://archive.kylinos.cn/kylin/KYLIN-ALL/pool/main/h/horizon/openstack-dashboard-ubuntu-theme_18.3.2-0kylin0.20.04.4_all.deb

http://archive.kylinos.cn/kylin/KYLIN-ALL/pool/main/h/horizon/openstack-dashboard_18.3.2-0kylin0.20.04.4_all.deb

http://archive.kylinos.cn/kylin/KYLIN-ALL/pool/main/h/horizon/python3-django-horizon_18.3.2-0kylin0.20.04.4_all.deb

http://archive.kylinos.cn/kylin/KYLIN-ALL/pool/main/h/horizon/python3-django-openstack-auth_18.3.2-0kylin0.20.04.4_all.deb

arm64软件包下载地址

http://archive.kylinos.cn/kylin/KYLIN-ALL/pool/main/h/horizon/openstack-dashboard-common_18.3.2-0kylin0.20.04.4_all.deb

http://archive.kylinos.cn/kylin/KYLIN-ALL/pool/main/h/horizon/openstack-dashboard-ubuntu-theme_18.3.2-0kylin0.20.04.4_all.deb

http://archive.kylinos.cn/kylin/KYLIN-ALL/pool/main/h/horizon/openstack-dashboard_18.3.2-0kylin0.20.04.4_all.deb

http://archive.kylinos.cn/kylin/KYLIN-ALL/pool/main/h/horizon/python3-django-horizon_18.3.2-0kylin0.20.04.4_all.deb

http://archive.kylinos.cn/kylin/KYLIN-ALL/pool/main/h/horizon/python3-django-openstack-auth_18.3.2-0kylin0.20.04.4_all.deb

mips64el软件包下载地址

http://archive.kylinos.cn/kylin/KYLIN-ALL/pool/main/h/horizon/openstack-dashboard-common_18.3.2-0kylin0.20.04.4_all.deb

http://archive.kylinos.cn/kylin/KYLIN-ALL/pool/main/h/horizon/openstack-dashboard-ubuntu-theme_18.3.2-0kylin0.20.04.4_all.deb

http://archive.kylinos.cn/kylin/KYLIN-ALL/pool/main/h/horizon/openstack-dashboard_18.3.2-0kylin0.20.04.4_all.deb

http://archive.kylinos.cn/kylin/KYLIN-ALL/pool/main/h/horizon/python3-django-horizon_18.3.2-0kylin0.20.04.4_all.deb

http://archive.kylinos.cn/kylin/KYLIN-ALL/pool/main/h/horizon/python3-django-openstack-auth_18.3.2-0kylin0.20.04.4_all.deb