Skip to content

Commit f41c5fe

Browse files
berndfingerberndfinger
authored
Merge pull request #563 from sap-linuxlab/hotfix-cve-2023-5764
Hotfix CVE 2023 5764
2 parents 5b92075 + fea8934 commit f41c5fe

File tree

8 files changed

+169
-26
lines changed

8 files changed

+169
-26
lines changed

‎CHANGELOG.rst‎

Lines changed: 29 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -5,33 +5,42 @@ community.sap_install Release Notes
55
.. contents:: Topics
66

77

8+
v1.3.3
9+
======
10+
11+
Release Summary
12+
---------------
13+
14+
| Release Date: 2023-12-22
15+
| collection: Make the preconfigure and sap_hana_install roles compatible with CVE-2023-5764
16+
817
v1.3.2
918
======
1019

1120
Release Summary
1221
---------------
1322

1423
| Release Date: 2023-09-29
15-
sap_general_preconfigure: Update to latest SAP documentation for RHEL 9 package libxcrypt-compat
16-
sap_general_preconfigure: Bug fix for directory creation and SELinux Labels
17-
sap_ha_pacemaker_cluster: Bug fix for AWS EC2 Virtual Servers
18-
sap_ha_pacemaker_cluster: Bug fix for Google Cloud Compute Engine VM netmask lock on Virtual IP
19-
sap_ha_pacemaker_cluster: Feature add for improved SAP NetWeaver HA compatibility
20-
sap_ha_pacemaker_cluster: Feature add for ENSA1 compatibility
21-
sap_ha_pacemaker_cluster: Feature add for SAP HA Interface Cluster Connector after cluster init
22-
sap_ha_pacemaker_cluster: Feature add for IBM PowerVM hypervisor
23-
sap_ha_pacemaker_cluster: Feature add for multiple network interfaces with Virtual IP
24-
sap_hana_install: Bug fix for SELinux disable when SLES4SAP
25-
sap_install_media_detect: Feature add for NFS compatibility
26-
sap_install_media_detect: Feature add for idempotency
27-
sap_install_media_detect: Feature add for new file detection after code restructure
28-
sap_install_media_detect: Bug fix for setting SAP Maintenance Planner Stack XML path
29-
sap_storage_setup: Feature add for Multipathing detection
30-
sap_storage_setup: Bug fix for NFS throttle from customer test on MS Azure
31-
sap_storage_setup: Bug fix for packages on SLES and Google Cloud
32-
sap_swpm: Bug fix for RDBMS var name
33-
sap_swpm: Bug fix for SAP HANA Client hdbuserstore connection
34-
sap_swpm: Bug fix for SAP Maintenance Planner Stack XML path
24+
| sap_general_preconfigure: Update to latest SAP documentation for RHEL 9 package libxcrypt-compat
25+
| sap_general_preconfigure: Bug fix for directory creation and SELinux Labels
26+
| sap_ha_pacemaker_cluster: Bug fix for AWS EC2 Virtual Servers
27+
| sap_ha_pacemaker_cluster: Bug fix for Google Cloud Compute Engine VM netmask lock on Virtual IP
28+
| sap_ha_pacemaker_cluster: Feature add for improved SAP NetWeaver HA compatibility
29+
| sap_ha_pacemaker_cluster: Feature add for ENSA1 compatibility
30+
| sap_ha_pacemaker_cluster: Feature add for SAP HA Interface Cluster Connector after cluster init
31+
| sap_ha_pacemaker_cluster: Feature add for IBM PowerVM hypervisor
32+
| sap_ha_pacemaker_cluster: Feature add for multiple network interfaces with Virtual IP
33+
| sap_hana_install: Bug fix for SELinux disable when SLES4SAP
34+
| sap_install_media_detect: Feature add for NFS compatibility
35+
| sap_install_media_detect: Feature add for idempotency
36+
| sap_install_media_detect: Feature add for new file detection after code restructure
37+
| sap_install_media_detect: Bug fix for setting SAP Maintenance Planner Stack XML path
38+
| sap_storage_setup: Feature add for Multipathing detection
39+
| sap_storage_setup: Bug fix for NFS throttle from customer test on MS Azure
40+
| sap_storage_setup: Bug fix for packages on SLES and Google Cloud
41+
| sap_swpm: Bug fix for RDBMS var name
42+
| sap_swpm: Bug fix for SAP HANA Client hdbuserstore connection
43+
| sap_swpm: Bug fix for SAP Maintenance Planner Stack XML path
3544
3645
v1.3.1
3746
======

‎README.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,27 @@ This Ansible Collection executes various SAP Software installations for differen
3030
- Install Linux Pacemaker, configure Pacemaker Fencing Agents and Pacemaker Resource Agents
3131
- Set HA/DR with distributed SAP System installations (i.e. ERS)
3232

33+
### Note
34+
35+
Starting with `ansible-core` versions 2.16.1, 2.15.8, and 2.14.12, templating operations inside the `that` statement of `assert` tasks
36+
are no longer allowed.
37+
38+
A typical error message is:
39+
```
40+
fatal: [host01]: FAILED! =>
41+
msg: 'The conditional check ''13 <= 128'' failed. The error was: Conditional is marked as unsafe, and cannot be evaluated.'
42+
```
43+
44+
This version of the collection ensures the compatibility with the above mentioned versions of `ansible-core` for the following roles:
45+
- sap_general_preconfigure
46+
- sap_netweaver_preconfigure
47+
- sap_hana_preconfigure
48+
- sap_hana_install
49+
50+
When running the preconfigure roles with the above mentioned versions of `ansible-core` and with the parameters
51+
`sap_general_preconfigure_assert`, `sap_netweaver_preconfigure_assert`, or `sap_hana_preconfigure_assert`, the roles will abort
52+
in the first `assert` task which contains a templating operation.
53+
3354
## Contents
3455

3556
An Ansible Playbook can call either an Ansible Role, or the individual Ansible Modules:

‎changelogs/changelog.yaml‎

Lines changed: 109 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,4 +17,112 @@ releases:
1717
| Add SAP HANA Two-Node Scale-Up Cluster Installation
1818
1919
'
20-
release_date: '2022-07-06'
20+
release_date: '2022-06-30'
21+
1.2.0:
22+
changes:
23+
release_summary: '| Release Date: 2022-12-20
24+
25+
| Consolidate sap_ha_install_pacemaker, sap_ha_prepare_pacemaker, and sap_ha_set_hana into new sap_ha_pacemaker_cluster role
26+
| Use the ha_cluster Linux System Role and its enhanced features in the new role sap_ha_pacemaker_cluster
27+
| Improve SID and instance checking in role sap_hana_install
28+
| Enable modifying SELinux file labels for SAP directories
29+
| Upgrade SAP SWPM handling for compatibility with more scenarios when generating inifile.params
30+
| Add Ansible Role for basic Oracle DB installations for SAP
31+
| Various minor enhancements
32+
| Various fixes
33+
34+
'
35+
release_date: '2022-12-20'
36+
1.2.1:
37+
changes:
38+
release_summary: '| Release Date: 2023-01-26
39+
40+
| A few minor fixes
41+
42+
'
43+
release_date: '2023-01-26'
44+
1.2.2:
45+
changes:
46+
release_summary: '| Release Date: 2023-02-01
47+
48+
| Fix for sap_hana_preconfigure on SLES when tuned is not installed
49+
50+
'
51+
release_date: '2023-02-01'
52+
1.2.3:
53+
changes:
54+
release_summary: '| Release Date: 2023-04-25
55+
56+
| sap_hana_preconfigure: Some modifications for HANA on RHEL 9
57+
| sap_ha_pacemaker_cluster: Compatibility for custom stonith resource definitions containing more than one element
58+
| sap_hana_preconfigure: Be more flexible with IBM service and productivity tools
59+
60+
'
61+
release_date: '2023-04-25'
62+
1.3.0:
63+
changes:
64+
release_summary: '| Release Date: 2023-07-21
65+
66+
| sap_general_preconfigure: Updates for new IBM Power packages with RHEL
67+
| sap_hana_preconfigure: Updates for new IBM Power packages with RHEL
68+
| sap_hana_install: Default Log Mode to normal and not Overwrite
69+
| sap_ha_pacemaker_cluster: Detection of and compatibility for additional Infrastructure Platforms
70+
| sap_ha_pacemaker_cluster: SAP NetWeaver compatibility added
71+
| sap_install_media_detect: Restructure and add execution controls
72+
| sap_storage_setup: Overhaul/Rewrite with breaking changes
73+
| sap_storage_setup: SAP NetWeaver and NFS compatibility added
74+
| sap_swpm: Minor alterations from High Availability test scenarios
75+
| collection: Sample Playbooks updated
76+
77+
'
78+
release_date: '2023-07-21'
79+
1.3.1:
80+
changes:
81+
release_summary: '| Release Date: 2023-08-14
82+
83+
| sap_ha_pacemaker_cluster: Improved AWS constructs based on feedback
84+
| sap_ha_pacemaker_cluster: Improved no STONITH resource definition handling
85+
| sap_hana_install: Bug fix for arg spec on deprecated vars
86+
| sap_hostagent: Bug fix for media handling
87+
| sap_install_media_detect: Improved handling based on feedback
88+
| sap_storage_setup: Bug fix for existing storage devices
89+
| sap_swpm: Make full log output optional and replace with sapcontrol log final status
90+
| collection: Bug fix for sample Ansible Playbooks
91+
92+
'
93+
release_date: '2023-08-14'
94+
1.3.2:
95+
changes:
96+
release_summary: '| Release Date: 2023-09-29
97+
98+
| sap_general_preconfigure: Update to latest SAP documentation for RHEL 9 package libxcrypt-compat
99+
| sap_general_preconfigure: Bug fix for directory creation and SELinux Labels
100+
| sap_ha_pacemaker_cluster: Bug fix for AWS EC2 Virtual Servers
101+
| sap_ha_pacemaker_cluster: Bug fix for Google Cloud Compute Engine VM netmask lock on Virtual IP
102+
| sap_ha_pacemaker_cluster: Feature add for improved SAP NetWeaver HA compatibility
103+
| sap_ha_pacemaker_cluster: Feature add for ENSA1 compatibility
104+
| sap_ha_pacemaker_cluster: Feature add for SAP HA Interface Cluster Connector after cluster init
105+
| sap_ha_pacemaker_cluster: Feature add for IBM PowerVM hypervisor
106+
| sap_ha_pacemaker_cluster: Feature add for multiple network interfaces with Virtual IP
107+
| sap_hana_install: Bug fix for SELinux disable when SLES4SAP
108+
| sap_install_media_detect: Feature add for NFS compatibility
109+
| sap_install_media_detect: Feature add for idempotency
110+
| sap_install_media_detect: Feature add for new file detection after code restructure
111+
| sap_install_media_detect: Bug fix for setting SAP Maintenance Planner Stack XML path
112+
| sap_storage_setup: Feature add for Multipathing detection
113+
| sap_storage_setup: Bug fix for NFS throttle from customer test on MS Azure
114+
| sap_storage_setup: Bug fix for packages on SLES and Google Cloud
115+
| sap_swpm: Bug fix for RDBMS var name
116+
| sap_swpm: Bug fix for SAP HANA Client hdbuserstore connection
117+
| sap_swpm: Bug fix for SAP Maintenance Planner Stack XML path
118+
119+
'
120+
release_date: '2023-09-29'
121+
1.3.3:
122+
changes:
123+
release_summary: '| Release Date: 2023-12-22
124+
125+
| collection: Make the preconfigure and sap_hana_install roles compatible with CVE-2023-5764
126+
127+
'
128+
release_date: '2023-12-22'

‎galaxy.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ namespace: community
1010
name: sap_install
1111

1212
# The version of the collection. Must be compatible with semantic versioning
13-
version: 1.3.2
13+
version: 1.3.3
1414

1515
# The path to the Markdown (.md) readme file. This path is relative to the root of the collection
1616
readme: README.md

‎roles/sap_general_preconfigure/tasks/RedHat/generic/configure-hostname.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,5 +50,5 @@
5050

5151
- name: "Ensure that the length of the hostname is not longer than 'sap_general_preconfigure_max_hostname_length'"
5252
ansible.builtin.assert:
53-
that: "{{ sap_hostname | length | int }} <= {{ sap_general_preconfigure_max_hostname_length | int }}"
53+
that: (sap_hostname | length | int) <= (sap_general_preconfigure_max_hostname_length | int)
5454
msg: "The length of the hostname is {{ sap_hostname | length | int }} but must be less or equal to {{ sap_general_preconfigure_max_hostname_length }} (variable 'sap_general_preconfigure_max_hostname_length')!"

‎roles/sap_hana_install/tasks/hana_addhosts.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@
4040

4141
- name: SAP HANA Add Hosts - Assert that the additional hosts are not shown in hdblcm --list_systems
4242
ansible.builtin.assert:
43-
that: "'{{ line_item }}' not in __sap_hana_install_register_hdblcm_list_systems.stdout"
43+
that: line_item not in __sap_hana_install_register_hdblcm_list_systems.stdout
4444
fail_msg:
4545
- "FAIL: Host '{{ line_item }}' is already part of system '{{ sap_hana_install_sid }}'"
4646
- "Because of this, the addhost operation will not be performed."

‎roles/sap_hana_install/tasks/hana_exists.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -140,9 +140,14 @@
140140
changed_when: no
141141
failed_when: no
142142

143+
- name: SAP HANA Checks - Define new variable for the assertion
144+
ansible.builtin.set_fact:
145+
__sap_hana_install_existing_sapsys_gid: "{{ __sap_hana_install_register_getent_group_sapsys.stdout.split(':')[2] }}"
146+
when: __sap_hana_install_register_getent_group_sapsys.rc == 0
147+
143148
- name: SAP HANA Checks - In case there is a group 'sapsys', assert that its group ID is identical to 'sap_hana_install_groupid'
144149
ansible.builtin.assert:
145-
that: "{{ __sap_hana_install_register_getent_group_sapsys.stdout.split(':')[2] }} == {{ sap_hana_install_groupid }}"
150+
that: (__sap_hana_install_existing_sapsys_gid | int) == (sap_hana_install_groupid | int)
146151
success_msg: "PASS: The group ID of 'sapsys' is identical to the value of variable
147152
sap_hana_install_groupid, which is '{{ sap_hana_install_groupid }}'"
148153
fail_msg: "FAIL: Group 'sapsys' exists but with a different group ID than '{{ sap_hana_install_groupid }}'

‎roles/sap_hana_preconfigure/tasks/RedHat/installation.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
- name: Ensure that the system is running a RHEL release which is supported for SAP HANA
88
ansible.builtin.assert:
9-
that: ansible_distribution_version in "{{ sap_hana_preconfigure_supported_rhel_minor_releases }}"
9+
that: ansible_distribution_version in sap_hana_preconfigure_supported_rhel_minor_releases
1010
fail_msg: "The RHEL release {{ ansible_distribution_version }} is not supported for SAP HANA!"
1111
success_msg: "The RHEL release {{ ansible_distribution_version }} is supported for SAP HANA."
1212
ignore_errors: "{{ not sap_hana_preconfigure_min_rhel_release_check }}"

0 commit comments

Comments
 (0)