March 2013 - OpenStack-announce - lists.openstack.org

OpenStack Community Weekly Newsletter (Mar 8-22)
by Stefano Maffulli 29 Mar '13

29 Mar '13

Highlights of the week Kwapi: an energy efficiency architecture <http://xlcloud.org/bin/view/Blog/Kwapi+an+energy+efficiency+architecture?la…> XLcloud HPC project focuses on providing high performance HPC services, while improving energy efficiency. Kwapi makes a smart use of data collected by Ceilometer interfaced with wattmeters in order to introduce power consumption statistics in OpenStack Nova scheduling strategies. Kwapi is stored on StackForge <https://github.com/stackforge/kwapi> and a blueprint is available here <http://www.xlcloud.org/bin/view/XLcloudProjectManagement/EEA>. Logging and debugging in OpenStack <http://vmartinezdelacruz.com/logging-and-debugging-in-openstack/> The importance of debugging is much more noticeable on large projects like OpenStack, which require both developers and common users contribute and report when something is not going well. In #openstack-101 Victoria Martínez de la Cruz <http://vmartinezdelacruz.com/> met many people wanting to start contributing to OpenStack, but a lot of them didn't know how to provide the right information to see where the problem was when they were facing a blocker. A must read for anybody starting (and a handy bookmark to provide to people stuck somewhere). Announcing Climate, the OpenStack capacity leasing project <http://julien.danjou.info/blog/2013/openstack-climate-capacity-leasing> A capacity leasing service is something really needed by service providers, especially in the context of cloud platforms dedicated to HPC style workload. Instead of building something really specific, the decision has been made to build a new standalone OpenStack components aiming to provide this kind of functionnality to OpenStack. In the spirit of others OpenStack components, it will be extensible to fullfil a large panel of needs around this problematic. Participate in the first OpenStack User Survey! <http://www.openstack.org/blog/2013/03/participate-in-the-first-openstack-us…> If you are an OpenStack user or have customers with OpenStack deployments, please take 10 minutes to respond to our first User Survey or pass it along to your network. Our community has grown at an amazing rate in 2.5 years, and it's time to better define our user base and requirements, so we can respond and advocate accordingly. TAKE THE SURVEY <http://awe.sm/r0NkC> *The Cost Of Client Side Image Downloads On the CPU* <https://tropicaldevel.wordpress.com/2013/03/26/the-cost-of/> John Bresnahan <https://tropicaldevel.wordpress.com/> discusses the importance of managing the resource consumption of large file transfers. The NIC (and the network in general) is always thought of as a consumable resource involved in a data transfer. To a lesser extent the disk bandwidth is considered, and on occasion the system bus is as well. However, the effects on the CPU tend to be underestimated. John experimented a bit and charted his results. Welcome to the renovated OpenStack Technical Committee <https://wiki.openstack.org/wiki/Governance/TechnicalCommittee> The "Spring 2013? election round is now over, and the following 15 people will be members of the OpenStack Technical Committee <https://wiki.openstack.org/wiki/Governance/TechnicalCommittee> for the next 6 months: * Russell Bryant (russellb), Nova PTL * Thierry Carrez (ttx), Directly-elected * Steven Dake (sdake), Heat PTL * Julien Danjou (jd__), Ceilometer PTL * John Dickinson (notmyname), Swift PTL * Anne Gentle (annegentle), Directly-elected * John Griffith (jgriffith), Cinder PTL * Gabriel Hurley (gabrielhurley), Horizon PTL * Vish Ishaya (vishy), Directly-elected * Dolph Mathews (dolphm), Keystone PTL * Mark McClain (markmcclain), Quantum PTL * Mark McLoughlin (markmc), Oslo PTL * Mikal Still (mikal), Directly-elected * Monty Taylor (mordred), Directly-elected * Mark Washenberger (markwash), Glance PTL Tips and Tricks * By Christian Berendt <http://www.cberendt.de/>: Build images using VeeWee <http://www.cberendt.de/2013/03/build-images-using-veewee/?utm_source=rss&ut…> * By Sandro Mathys <http://red-fedora.blogspot.com/search/label/OpenStack>: Unused base images in OpenStack Nova <http://red-fedora.blogspot.com/2013/03/unused-base-images-in-openstack-nova…> * By Christian Berendt <http://www.cberendt.de/>: Usage of nested virtualization inside instances <http://www.cberendt.de/2013/03/usage-of-nested-virtualization-inside-instan…> * By Kashyap Chamarthy <http://kashyapc.wordpress.com/>: Debugging nova --- a small illustration with pdb <http://kashyapc.wordpress.com/2013/03/27/debugging-nova-a-small-illustratio…> * By John Dickinson <http://programmerthoughts.com/>: OpenStack Swift on Raspberry Pi <http://programmerthoughts.com/openstack/swift-on-pi> Upcoming Events * Vietnam OpenStack Meeting <https://www.facebook.com/events/467317409990701/> Mar 30, 2013 -- Ho Chi Minh City, Vietnam Details <https://www.facebook.com/events/467317409990701/> * 1st OpenStack User Group Nordics meetup <http://www.meetup.com/OpenStack-User-Group-Nordics/events/95258382/> Apr 03, 2013 -- Kista, Sweden Details <http://www.meetup.com/OpenStack-User-Group-Nordics/events/95258382/> * OpenStack Technology Deep Dive <http://www.meetup.com/meetup-group-NjZdcegA/events/108724942/> Apr 04, 2013 -- Chicago, IL Details <http://www.meetup.com/meetup-group-NjZdcegA/events/108724942/> * OpenStack Summit April 2013 <http://www.openstack.org/summit/portland-2013/> Apr 15 -- 18, 2013 -- Portland, OR Details <http://www.openstack.org/summit/portland-2013/> * Beers / Summit Debrief / Internally Promoting OpenStack <http://www.meetup.com/meetup-group-NjZdcegA/events/108730682/> Apr 24, 2013 -- Chicago, IL Details <http://www.meetup.com/meetup-group-NjZdcegA/events/108730682/> * OpenStack meeting in Cologne <http://www.meetup.com/OpenStack-DACH/events/108876542/> May 04, 2013 -- Cologne, Germany Details <http://www.meetup.com/OpenStack-DACH/events/108876542/> * OpenStack DACH Day <http://www.prweb.com/releases/2013/3/prweb10526716.htm> May 24, 2013 -- Berlin Fairgrounds Details <http://www.prweb.com/releases/2013/3/prweb10526716.htm> * OpenStack Israel <http://www.meetup.com/IGTCloud/events/99146542/> May 27, 2013 -- Tel-Aviv, Israel Details <http://www.meetup.com/IGTCloud/events/99146542/> * OpenStack CEE Day <http://www.openstack.org/> May 29, 2013 -- Budapest Details <http://www.openstack.org/> * Building an OpenStack Cloud <http://www.meetup.com/meetup-group-NjZdcegA/events/108731562/> May 30, 2013 -- Chicago, IL Details <http://www.meetup.com/meetup-group-NjZdcegA/events/108731562/> * OpenStack meeting in Munich <http://www.meetup.com/openstack-de/events/109700562/> Jun 11, 2013 -- Munich, Germany Details <http://www.meetup.com/openstack-de/events/109700562/> * GigaOM Structure <http://event.gigaom.com/structure/> Jun 19 -- 20, 2013 -- San Francisco, CA Details <http://event.gigaom.com/structure/> * OSCON 2013 <http://www.oscon.com/oscon2013> Jul 22 -- 26, 2013 -- Portland, OR Details <http://www.oscon.com/oscon2013> Reports from past events * Report: March month OpenStack meetup,Bangalore, India <http://www.openstack.org/blog/2013/03/report-march-month-openstack-meetupba…> * OpenStack hits World Hosting Days 2013 in Germany! <http://www.openstack.org/blog/2013/03/openstack-hits-world-hosting-days-201…> * Taiwan OpenStack User Group Meeting March 27 <http://www.pagedise.com/po_list.php?url_code=504C7PZ5RA6FO#.UVPmvhd6jrw> Other News * Puppet modules for Ceph finally landed! <http://www.enovance.com/fr/blog/5478/puppet-modules-for-ceph-finally-landed> * State of the Q -- ZeroMQ in OpenStack Grizzly <http://engineering.cloudscaling.com/2013/03/grizzly-0mq-messaging-update/> * Recruiting -- Translation Coordinator <https://lists.launchpad.net/openstack/msg22306.html> * Documentation -- Push for Grizzly <https://lists.launchpad.net/openstack/msg22306.html> * OpenStack Project Meeting: Summary <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-03-26-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-03-26-21.…> Got questions? Ask OpenStack <https://ask.openstack.org/> is the go-to destination for OpenStack users. /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

Technical Committee members (Havana development cycle)
by Thierry Carrez 29 Mar '13

29 Mar '13

The "Spring 2013" election round is now over, and the following 15 people will be members of the OpenStack Technical Committee for the next 6 months: * Russell Bryant (russellb), Nova PTL * Thierry Carrez (ttx), Directly-elected * Steven Dake (sdake), Heat PTL * Julien Danjou (jd__), Ceilometer PTL * John Dickinson (notmyname), Swift PTL * Anne Gentle (annegentle), Directly-elected * John Griffith (jgriffith), Cinder PTL * Gabriel Hurley (gabrielhurley), Horizon PTL * Vish Ishaya (vishy), Directly-elected * Dolph Mathews (dolphm), Keystone PTL * Mark McClain (markmcclain), Quantum PTL * Mark McLoughlin (markmc), Oslo PTL * Mikal Still (mikal), Directly-elected * Monty Taylor (mordred), Directly-elected * Mark Washenberger (markwash), Glance PTL More information about the Technical Committee at: https://wiki.openstack.org/wiki/Governance/TechnicalCommittee -- Thierry Carrez (ttx) Chair, OpenStack Technical Committee

1 0

OpenStack Community Weekly Newsletter (Mar 8-22)
by Stefano Maffulli 22 Mar '13

22 Mar '13

Highlights of the week Participate in the first OpenStack User Survey! <http://www.openstack.org/blog/2013/03/participate-in-the-first-openstack-us…> If you are an OpenStack user or have customers with OpenStack deployments, please take 10 minutes to respond to our first User Survey or pass it along to your network. Our community has grown at an amazing rate in 2.5 years, and it's time to better define our user base and requirements, so we can respond and advocate accordingly. TAKE THE SURVEY <http://awe.sm/r0NkC> A new agent management approach for Quantum in OpenStack Grizzly <http://www.mirantis.com/blog/a-new-agent-management-approach-in-quantum-for…> In Folsom, Quantum didn't have facilities to schedule its agents between cluster nodes, but the Grizzly release brings the support of a new component management approach, which addresses this issue. Havana Project Technical Leads Welcome to the new PTLs for OpenStack's future release, Havana: * Nova: Russell Bryant * Ceilometer: Julien Danjou * Keystone: Dolph Matthews * Cinder: John Griffith * Glance: Mark Washenberger * Heat: Steven Dake * Horizon: Gabriel Hurley * Oslo: Mark McLoughlin * Quantum: Marck McClain * Swift: John Dickenson They were elected democratically by their peer developers according to the rules of the OpenStack community to lead the next release cycle. Congratulations. The new PTLs will join three more people whose election is still ongoing, to form the OpenStack Technical Committee. *Moving to open development: OpenStack / Crowbar / Chef on SUSE* <http://jaegerandi.blogspot.com/2013/03/moving-to-open-development-openstack…> Crowbar was originally developed by Dell engineers, and is now a fully-fledged Open Source project involving close collaboration with SUSE and others. There are weekly public meetings <https://github.com/crowbar/crowbar/wiki/Meetings>, a public mailing list <https://lists.us.dell.com/mailman/listinfo/crowbar>, a |#crowbar| IRC channel <https://github.com/crowbar/crowbar/wiki/IRC-channel>, public Trello boards <https://github.com/crowbar/crowbar/wiki/Development> and so on. As an indication of the project's independent nature, the authoritative location for the git repositories has changed from https://github.com/dellcloudedge to https://github.com/crowbar, and a new homepage <http://crowbar.github.com/>is currently under construction. OpenStack Miniconf at PyCon Australia 2013 <http://aptira.wufoo.com/forms/pyconau2013-openstack-miniconf-call-for-prese…> PyCon Australia 2013 will be hosting two one-day miniconfs on *Friday 5 July* before the main conference proceedings kick off on Saturday 6 July. Miniconfs are events that focus on a specific community that relies heavily on Python, and allows practitioners in those communities to explore those topics in a much deeper way than the main PyCon conference can allow. The Call For Presenters for the OpenStack Miniconf is open now and closes on 15 April, 2013. To submit a presentation, visit the OpenStack Miniconf CFP site at http://aptira.wufoo.com/forms/pyconau2013-openstack-miniconf-call-for-prese… Tips and Tricks * By Anita Kuno <http://anteaya.info/>: Reviewing an OpenStack Patch <http://anteaya.info/blog/2013/03/21/reviewing-an-openstack-patch/> * By Adam Young <http://adam.younglogic.com/>: Trusts and Role Based Access Control for Open Stack <http://adam.younglogic.com/2013/03/trusts-rbac/> * By Mate Lakat <http://blogs.citrix.com/>: Virtual Hypervisor: how to deploy XenServer inside a XenServer <http://blogs.citrix.com/2013/03/18/virtual-hypervisor/> * By Sébastien Han <http://sebastien-han.fr/>: Grizzly availability zones <http://sebastien-han.fr/blog/2013/03/18/grizzly-availability-zones/> * By Yun Mao <http://cloudystuffhappens.blogspot.com/search/label/openstack>: /How to use the ZooKeeper driver for ServiceGroup in OpenStack Nova <http://cloudystuffhappens.blogspot.com/2013/03/zookeeper-and-openstack-nova…>/ * By Kashyap Chamarthy <http://kashyapc.wordpress.com/>: OpenStack --- nova image-create, under the hood <http://kashyapc.wordpress.com/2013/03/11/openstack-nova-image-create-under-…> Security Advisories * OSSA 2013-007] Backend credentials leak in Glance v1 API (CVE-2013-1840) <http://lists.openstack.org/pipermail/openstack-announce/2013-March/000085.h…> * OSSA 2013-008] Nova DoS by allocating all Fixed IPs (CVE-2013-1838) <http://lists.openstack.org/pipermail/openstack-announce/2013-March/000086.h…> * [OSSA 2013-009] Keystone PKI tokens online validation bypasses revocation check (CVE-2013-1865) <http://lists.openstack.org/pipermail/openstack-announce/2013-March/000087.h…> Upcoming Events * OpenStack Hungary Meeting <http://www.meetup.com/OpenStack-Hungary-Meetup-Group/events/109973362/> Mar 25, 2013 -- Budapest, Hungary Details <http://www.meetup.com/OpenStack-Hungary-Meetup-Group/events/109973362/> * Vietnam OpenStack Meeting <https://www.facebook.com/events/467317409990701/> Mar 30, 2013 -- Ho Chi Minh City, Vietnam Details <https://www.facebook.com/events/467317409990701/> * 1st OpenStack User Group Nordics meetup <http://www.meetup.com/OpenStack-User-Group-Nordics/events/95258382/> Apr 03, 2013 -- Kista, Sweden Details <http://www.meetup.com/OpenStack-User-Group-Nordics/events/95258382/> * OpenStack Summit April 2013 <http://www.openstack.org/summit/portland-2013/> Apr 15 -- 18, 2013 -- Portland, OR Details <http://www.openstack.org/summit/portland-2013/> * OpenStack meeting in Cologne <http://www.meetup.com/OpenStack-DACH/events/108876542/> May 04, 2013 -- Cologne, Germany Details <http://www.meetup.com/OpenStack-DACH/events/108876542/> * OpenStack DACH Day <http://www.prweb.com/releases/2013/3/prweb10526716.htm> May 24, 2013 -- Berlin Fairgrounds Details <http://www.prweb.com/releases/2013/3/prweb10526716.htm> * OpenStack Israel <http://www.meetup.com/IGTCloud/events/99146542/> May 27, 2013 -- Tel-Aviv, Israel Details <http://www.meetup.com/IGTCloud/events/99146542/> * OpenStack CEE Day <http://www.openstack.org/> May 29, 2013 -- Budapest Details <http://www.openstack.org/> * OpenStack meeting in Munich <http://www.meetup.com/openstack-de/events/109700562/> Jun 11, 2013 -- Munich, Germany Details <http://www.meetup.com/openstack-de/events/109700562/> * GigaOM Structure <http://event.gigaom.com/structure/> Jun 19 -- 20, 2013 -- San Francisco, CA Details <http://event.gigaom.com/structure/> * OSCON 2013 <http://www.oscon.com/oscon2013> Jul 22 -- 26, 2013 -- Portland, OR Details <http://www.oscon.com/oscon2013> Reports from past events * Event Report: OpenStack workshop Bangalore, India <http://www.openstack.org/blog/2013/03/event-report-openstack-workshop-banga…> * OpenStack and Friends at SCALE 11x <http://www.openstack.org/blog/2013/03/openstack-and-friends-at-scale-11x/> Other News * Amanda Enterprise 3.3 brings advanced backup management features <http://www.zmanda.com/blogs/?p=1053> * Report from the Chairman of the Board, Alan Clark: A Pretty Good Place to Be <http://www.openstack.org/blog/2013/03/a-pretty-good-place-to-be/> * openSUSE 12.3 is out, with OpenStack love <http://www.vuntz.net/journal/post/2013/03/13/openSUSE-12.3-is-out%2C-with-O…> * Chef 11: Interview with Lucas Welch, Director of Communications at Opscode <http://rafstack.tumblr.com/post/45181547441> * OpenStack Project Meeting: Summary <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-03-19-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-03-19-21.…> Welcome New Contributors Celebrating the first patches submitted this week by: * Christopher Yeoh, IBM * Scott Devoid, ANL * Greg Ball, Rackspace * Andy Hill * Roman Podolyaka, Mirantis * afazekas, Redhat * Senhua Huang, Cisco * Ilya Kharin, Mirantis * Ryan O'Hara, Redhat * Michael Kerrin, HP * Allan Feid /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

[OSSA 2013-009] Keystone PKI tokens online validation bypasses revocation check (CVE-2013-1865)
by Thierry Carrez 20 Mar '13

20 Mar '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 OpenStack Security Advisory: 2013-009 CVE: CVE-2013-1865 Date: March 20, 2013 Title: Keystone PKI tokens online validation bypasses revocation check Reporter: Guang Yee (HP) Products: Keystone Affects: Folsom Description: Guang Yee from HP reported a vulnerability in the revocation check for Keystone PKI tokens. Those tokens are supposed to be validated locally using cryptographic checks, but the user also has the option of asking the server to validate them. In that case, the online verification of PKI tokens would bypass the revocation check, potentially affirming revocated tokens are still valid. Only Folsom setups making use of online verification of PKI tokens are affected. Folsom fix: https://review.openstack.org/#/c/24906/ References: https://bugs.launchpad.net/keystone/folsom/+bug/1129713 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2013-1865 - -- Thierry Carrez (ttx) OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iQIcBAEBCAAGBQJRSdTdAAoJEFB6+JAlsQQj9sUQAL0y9zV5xWHDhAFpfaUGobq6 n5TVeEEf3kb1CIYuVhX6vHuPl2CtoekMSX7MOLehiwmbxGw3B4G7DONZrWuxmzOT J9B9kwMew3K5lE3X4oYH3cHjkTC+ZsnlUBzNiJIXEAkBFaGLmCwbt2eCREBcKvU8 glaPKncO226Y85wMV+Sbe12qDX/82o6TydkcJglhdGF3AYI4813yGb/U41rkKUnq zlsg4Zaea4IFUe23fc9EchRDcgR1N+yfZf04+CKRymhvOcYzSLZDNxJpYN+jwzLy UcB3Jqak8FR0+w3k28bz41COUWtynrTy5FAoDgvGtLM2m1GedMygNKdMb1yERC9z ELWb0P1Z6qt5zZa6BORM185PJ9Dy5zQkOOOH1I7nWjnIa9wFzvbQBKHv5WPARWDu rdAM2I55JmGxo6qFJWK6QnpYI6o6PQjQ2s0FC/H2kCMgXPygURD/X101Y2lOFSZ7 P8OhTKoVYqZf5pImpKCbtm1GHWIpev7BkzWvsFpPhVz4ExHSTsmc1Mk2ugDGQrgO tCcF7Eo0eABepY4qVrSUi4euZvpFsWcjl7GzQ0WLCWyMUdPo9271ZfsgxfPxId7l CMgn2hgpGv5+yTDDg4p8NSqmUp5hSMo/i6zgDrL9XEn4qx5Rr8pNqV/vUhmYQmzV qQqwB3DR57T1eFMlGL7y =9dar -----END PGP SIGNATURE-----

1 0

[OSSA 2013-008] Nova DoS by allocating all Fixed IPs (CVE-2013-1838)
by Thierry Carrez 14 Mar '13

14 Mar '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 OpenStack Security Advisory: 2013-008 CVE: CVE-2013-1838 Date: March 14, 2013 Title: Nova DoS by allocating all Fixed IPs Reporter: Vish Ishaya (Nebula) Products: Nova Affects: All versions Description: Vish Ishaya reported a vulnerability in Nova where there is no quota for Fixed IPs. Previously the instance quota acted as a proxy for a Fixed IP quota, but if your configuration allows an instance to consume more than one Fixed IP via an extension such as multinic then this is no longer true. Running out of Fixed IPs would result in not being able to spawn new instances. Grizzly (development branch) fix: https://review.openstack.org/#/c/24451/ Folsom fix: https://review.openstack.org/#/c/24452/ Essex fix: https://review.openstack.org/#/c/24453/ References: https://bugs.launchpad.net/nova/+bug/1125468 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2013-1838 - -- Thierry Carrez (ttx) OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iQIcBAEBCAAGBQJRQgtEAAoJEFB6+JAlsQQjf6gP/0Ao3Hq5MSChlbwtjMiUPPlC ralE6V5l3/V/jPJ/XiHrSJo2qbwgil4SSrwj6mDx00bwj3lLyYKV9KjRx9FJjwl0 YuUm/AY1R4/miED8HyjhhteC0xAisqciwZQLrN6DwAdP3YEDZZk0Cfxp3Xw6XxAM SAb2Gp0Ranu0lc7jLBNsp0G4idZvF232kXRDEMgpAwcsjmxh1sl97IBUqq87UJax RDnI2p/bpPahZXBZK4RPZR92IbdVZ4SE+piC0b4ITESdxAh9NadWfUBIkf4fOdvM yVKWFvRMhIFqTFEnpaX/091mOzkHJ8bWRpKImrw3qSLvXzyzlBwuuT0NyL6qDTPQ 0cY9gkiyqOtlvsAxF7tNDHxnIlq/zy86Tvi3KVoyJcUenGPjZwWNINhyvvFWs03t n0W58XQOnXPxYLSI3CG5gUcJUWTbJQKQAapkoMGUASc7kcVCNv334z45Ui4n51o4 5WUOQTzgWJRskqolull7wpScaNoZtQgnnSTHwtAXt4Pykum4N3FEOEo4C/gHa1uz nW8YkZRgoHbGYNypNDDWE6UdPZT/WOO/+RbMQwRVitFJtHzG1FuLa1fNP6mKxDPn vpHnp9jBZlW9OjBZgp7/YqFv586l/xrT1hG3i+I6fq2w5G7Gru5PeRhUElzq4qHF k+FvT1+nkHkvTbMb8z1z =gipy -----END PGP SIGNATURE-----

1 0

[OSSA 2013-007] Backend credentials leak in Glance v1 API (CVE-2013-1840)
by Thierry Carrez 14 Mar '13

14 Mar '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 OpenStack Security Advisory: 2013-007 CVE: CVE-2013-1840 Date: March 14, 2013 Title: Backend credentials leak in Glance v1 API Reporter: Stuart McLaren (HP) Products: Glance Affects: All versions Description: Stuart McLaren from HP reported a vulnerability in the information potentially returned to the user in Glance v1 API. If an authenticated user requests, through the v1 API, an image that is already cached, the headers returned may disclose the Glance operator's backend credentials for that endpoint. Only setups accepting the Glance v1 API and using either the single-tenant Swift store or S3 store are affected. Grizzly (development branch) fix: https://review.openstack.org/24437 Folsom fix: https://review.openstack.org/24438 Essex fix: https://review.openstack.org/24439 References: https://bugs.launchpad.net/glance/+bug/1135541 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2013-1840 - -- Thierry Carrez (ttx) OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iQIcBAEBCAAGBQJRQfdoAAoJEFB6+JAlsQQj0g4QAL+tmSjDHukvwPZ1D72ClLIR NKV9ceVNT+qus1W5Og2GOKjnrib8X4qkoR/P/Wp+nEoWYosch4YTMvpxc8hamm9P OohMdT4RFxQut//ZR6sn/TC2qLgErovlZRMxBKA43sFqHNbirprF5b9A4fF7glp6 atPAAM7rIHTJDXHvE+a8Qe8qOPKJKP1pOXrSZDL94ZMPq6uAy/0M0v/r/++aAUHy Qr7p2ITuVepJ3IM9/sZ+RQ1PXFya0BGBpLBEgaotBmmOMI/FNbthS3PT8W1ywX0S gpgcBLiXMXoNsMZCmsLeYirzldaT+ZtqjOxYqZYiAjn5cIQ5XXjFPq8w9vlh83An 8IVnanVl4C1M4hnYo3sCeFsCnh5sLdM/LVnd19Wz1k1PHTCM7vrNtU0wqAMQFj2C BQqNMMcQvFZdEjvzYymlm365DP07DHOi/jgK59EWCfeaEHx4Vs4fL0a9nnoxs/fV 8SysPv4A3iAaXDOan+0s+T0dac2/KU2FBio0+cuvV4qASYWN5CHAR9/6icWJQ2qh InUWIqcgwcOqR6azhQHg/ARw7iNZtv+omVvVOYZu6HOiK4BDj8RkQmPyWsis/ekU 4Ez6AyKSDmRHtoR9w7GcM14xCrHyqFfbaGUp+qDI73NNGmbXXtXlVEO8/g2ywbKc F0k3S2Z5fLOPFeo9ll4C =BmKh -----END PGP SIGNATURE-----

1 0

OpenStack Community Weekly Newsletter (Mar 1 -8)
by Stefano Maffulli 08 Mar '13

08 Mar '13

Highlights of the week We Wrote an OpenStack Operations Guide in 5 Days! <http://blog.phymata.com/2013/03/07/we-wrote-openstack-ops-guide-5-days/> OpenStack Operations Guide <http://www.openstack.org/blog/wp-content/uploads/2013/03/OpenStackOpsGuide.…>And here it is...the OpenStack Operations Guide <http://docs.openstack.org/ops/>. You can read it in EPUB, MOBI, PDF, or print <http://www.lulu.com/content/paperback-book/openstack-operations-guide/13692…>. The electronic formats are free to download so click away. The print version costs $29.90 and all proceeds go to the OpenStack Foundation to support more book sprints like the one that produced this book. Read from the protagonists how they did it: Lorin <http://Lorin/>Hochstein <http://lorinhochstein.wordpress.com/2013/03/05/open-source-documentation-in…>, Everett <http://blog.phymata.com/2013/03/07/we-wrote-openstack-ops-guide-5-daysEvere…>Toews <http://blog.phymata.com/2013/03/07/we-wrote-openstack-ops-guide-5-days/>, Anne Gentle <http://www.openstack.org/blog/2013/03/we-did-it-zero-to-book-in-five-days/>. Case Study on OpenStack Cloud in Health Care <http://www.mirantis.com/blog/case-study-on-openstack-cloud-in-health-care/> Computing for health care and life sciences is rapidly adapting to opportunities created by new technologies for scalable data storage, elastic compute service resources, and data analytics. Given the powerful forces changing the economics of the overall health care marketplace, technologies that can address security and compliance at reduced cost are getting a lot of attention. OpenStack Object Storage and quotas in upcoming 1.8.0 (Grizzly) release. <http://www.enovance.com/fr/blog/5458/swift-and-quotas-in-upcoming-1-8-0-gri…> OpenStack Object Storage (codename Swift) will have two new middleware for managing quotas: container_quotas and account_quotas. The first, container_quotas, allows users to specify a limit on one of their containers. The account_quotas is more the typical quota implementation. A «super user» with the reselleradmin group/role can set a byte limit for an account and the account will not be able to have new objects/containers until someone cleanups his account to get under the limited quotas. OpenStack Updated Individual Contributor License Agreements <http://anteaya.info/blog/2013/03/08/openstack-updated-individual-contributo…> Last weekend we updated the OpenStack Individual Contributor License Agreement and all OpenStack contributors needed to sign a new individual agreement. We graphed the data of the rate of signups: almost 400 developers signed in less than a week. Tips and Tricks * By Loïc Dachary <http://dachary.org/>: nova-network debugging tips <http://dachary.org/?p=1929> * ByAdam Young <http://adam.younglogic.com/>: Keystone, MySQL and Fedora 18 <http://adam.younglogic.com/2013/03/keystone-mysql-and-fedora-18/> * By John Bresnahan <https://tropicaldevel.wordpress.com/>: A Look At Performance When Glance Is Backed By Gluster <https://tropicaldevel.wordpress.com/2013/03/06/a-look-at-performance-when-g…> * By Kashyap Chamarthy <http://kashyapc.wordpress.com/>: OpenStack nova --- dealing with unused base images <http://kashyapc.wordpress.com/2013/03/03/openstack-nova-dealing-with-unused…> Upcoming Events * OpenStack Day Tokyo 2013 <http://openstackdays.com/en/> Mar 12, 2013 -- Tokyo, Japan Details <http://openstackdays.com/en/> * OpenStack Italia User Group <http://www.meetup.com/OpenStack-User-Group-Italia/events/102481022/> Mar 14, 2013 -- Milano, Italy Details <http://www.meetup.com/OpenStack-User-Group-Italia/events/102481022/> * PyCon 2013 & Job Fair <https://us.pycon.org/2013/> Mar 14 -- 17, 2013 -- Santa Clara, CA Details <https://us.pycon.org/2013/> * OpenStack Meetup <http://www.meetup.com/Indian-OpenStack-User-Group/events/105831232/> Mar 17, 2013 -- Bangalore, India Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/105831232/> * OpenStack Object Storage (Swift) API Sprint at PyCon 2013 <https://us.pycon.org/2013/community/sprints/swift/> Mar 18, 2013 -- Santa Clara, CA Details <https://us.pycon.org/2013/community/sprints/swift/> * OpenStack Paris Meetup <http://www.meetup.com/OpenStack-France/events/104394682/> Mar 19, 2013 -- Paris, France Details <http://www.meetup.com/OpenStack-France/events/104394682/> * World Hosting Days 2013 <http://www.worldhostingdays.com/eng/index.php> Mar 19 -- 21, 2013 -- Rust, Germany Details <http://www.worldhostingdays.com/eng/index.php> * OpenStack Presentation at BALUG <http://www.balug.org/#2013-03-19>Mar 19, 2013 -- San Francisco, CA RSVP <http://www.balug.org/#2013-03-19> * OpenStack Developers Meetup <http://www.meetup.com/openstack-atlanta/> Mar 21, 2013 -- Atlanta, GA Details <http://www.meetup.com/openstack-atlanta/> * 1st OpenStack User Group Nordics meetup <http://www.meetup.com/OpenStack-User-Group-Nordics/events/95258382/> Apr 03, 2013 -- Kista, Sweden Details <http://www.meetup.com/OpenStack-User-Group-Nordics/events/95258382/> * OpenStack Summit April 2013 <http://www.openstack.org/summit/portland-2013/> Apr 15 -- 18, 2013 -- Portland, OR Details <http://www.openstack.org/summit/portland-2013/> * OpenStack Israel <http://www.openstack.org/> May 27, 2013 -- Tel-Aviv, Israel Coming Soon <http://www.openstack.org/> * GigaOM Structure <http://event.gigaom.com/structure/> Jun 19 -- 20, 2013 -- San Francisco, CA Details <http://event.gigaom.com/structure/> Reports from past events * OpenStack at Linux.conf.au 2013 -- Videos posted and some pics <http://www.openstack.org/blog/2013/03/openstack-at-linux-conf-au-2013-video…> Other News * Important CLA changes to the way we handle the CLA <http://markmail.org/message/azrdwianmnt2j5oc> * Internship is 2/3 Complete -- How Am I Doing? <http://anteaya.info/blog/2013/03/08/internship-is-2-slash-3-complete-how-am…> * Scalr multi-cloud capabilities extended: OpenStack (Folsom release) now supported <http://scalr.com/blog/multi-cloud-capabilities-extended-openstack-folsom-re…> * Kwapi: an energy efficiency architecture <http://xlcloud.org/bin/view/Blog/Kwapi+an+energy+efficiency+architecture?la…> * Ceilometer bug squash day #2 <http://julien.danjou.info/blog/2013/ceilometer-bug-squash-day-2> * OpenStack Project Meeting: Summary <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-03-05-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-03-05-21.…>. Welcome New Contributors Celebrating the first patches submitted this week by: * Bob Ball, Citrix * Stas Maksimov, Dell * Fei Long Wang, IBM * Avinash Prasad, NTT Data * KC Wang, Bigswitch * Divakar Padiyar Nandavar, HP /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

OpenStack Community Weekly Newsletter (Feb 22 - Mar 1)
by Stefano Maffulli 01 Mar '13

01 Mar '13

Highlights of the week Important CLA changes coming this weekend (2nd try) <http://markmail.org/message/azrdwianmnt2j5oc> Last weekend the change was blocked at the last minute by a request to amend the CLA text. We're trying again this weekend. Starting on March 3, 2013 1700UTC all contributors MUST review and agree to the new OpenStack Individual Contributor License Agreement and provide updated contact information at https://review.openstack.org/#/settings/agreements. On that day the Gerrit interface will be changing to present the new CLA text referring to the OpenStack Foundation, and will prompt you to agree to it there. Any previous agreement with OpenStack LLC will be marked expired at that time. The text of the new agreement is available for your convenience <https://review.openstack.org/static/cla.html>. You must also sign up for an OpenStack Foundation Individual Membership with the same E-mail address as used for your Gerrit contact information: http://openstack.org/register/. What's new in OpenStack Grizzly ? <http://www.enovance.com/%25postname> Folsom brought us two new core projects : Quantum <https://wiki.openstack.org/wiki/Quantum> (Networking) and Cinder <https://wiki.openstack.org/wiki/Cinder> (Volumes). Two new projects have been incubated : Ceilometer <https://wiki.openstack.org/wiki/Ceilometer> (metering) led by Nicolas Barcet <http://fr.linkedin.com/in/nbarcet> (VP Products at eNovance), and Heat <https://wiki.openstack.org/wiki/Heat> (Cloud Orchestration). Oslo <https://wiki.openstack.org/wiki/Oslo> is a new incubated project which produces a set of python libraries containing infrastructure code shared by all OpenStack projects. More details for each OpenStack project on this post by eNovance. OpenStack Ceilometer and Heat projects graduated <http://julien.danjou.info/blog/2013/openstack-ceilometer-head-graduated> The OpenStack Technical Committee <http://www.openstack.org/foundation/technical-committee/> have voted these last weeks about graduation of Heat <https://launchpad.net/heat> and Ceilometer <http://launchpad.net/ceilometer>, to change their status from /incubation/ to /integrated/*. *Heat and Ceilometer will be released as part as OpenStack for the next release cycle /Havana/, due in October 2013. **Raspberry Pi as a transparent squid caching proxy* <http://blog.stevebaker.org/2013/02/raspberry-pi-as-transparent-squid.html>* How does a hacker improve build times when he has a slow Internet connection? A fascinating use of a tiny sub-$50 computer (RaspberryPi) to build cloud images for OpenStack. By Steve Baker <http://blog.stevebaker.org/search/label/openstack> **Data placement in OpenStack Object Storage Swift* <http://swiftstack.com/blog/2013/02/25/data-placement-in-swift/>* Technical deep dive in how OpenStack Object Storage solves one of the hard problems of all distributed storage system: how to effectively place the data within the storage cluster. Swift has a "unique-as-possible" placement algorithm which ensures that the data is placed efficiently and with as much protection from hardware failure as possible. **The life of an OpenStack libvirt image* <http://www.pixelbeat.org/docs/openstack_libvirt_images/#1361764412>* The main stages of a Virtual Machine disk image as it transfers through OpenStack to be booted under libvirt explained by Pádraig Brady <http://www.pixelbeat.org/>. Security Advisories * OSSA-2013-006] VNC proxy can connect to the wrong VM (CVE-2013-0335) <http://lists.openstack.org/pipermail/openstack-announce/2013-February/00008…> Tips and Tricks * By Daniel P. Berrangé <https://www.berrange.com/>: Installing a 4 node Fedora 18 OpenStack Folsom cluster with PackStack <https://www.berrange.com/posts/2013/03/01/installing-a-4-node-fedora-18-ope…> * By Victoria Martínez de la Cruz <http://vmartinezdelacruz.com/>: Attention newcomers! #openstack-101 is now open at Freenode <http://vmartinezdelacruz.com/attention-newcomers-openstack-101-is-now-open-…> * By Anita Kuno <http://anteaya.info/>: The Structure and Habits of Git <http://anteaya.info/blog/2013/02/26/the-structure-and-habits-of-git/> * By Andreas Jaeger <http://jaegerandi.blogspot.com/search/label/OpenStack>: Coordinating efforts to create OpenStack packages for openSUSE and SUSE Linux Enterprise Server <http://jaegerandi.blogspot.com/2013/02/coordinating-efforts-to-create.html> Upcoming Events * OpenStack Sessions @ Barcamp Bangalore13 <http://barcampbangalore.org/bcb/event/bcb13> Mar 02, 2013 -- Bangalore, India Details <http://barcampbangalore.org/bcb/event/bcb13> * Pulse Open Cloud Summit <http://www.ibmpulseblog.com/new-pulse-open-cloud-summit-arrive-early-on-sun…>Mar 03, 2013 -- MGM Grand in Las Vegas, NV Details <http://www.ibmpulseblog.com/new-pulse-open-cloud-summit-arrive-early-on-sun…> * Pulse 2013 <https://www-01.ibm.com/software/tivoli/pulse/agenda/index.html> Mar 04 -- 06, 2013 -- Las Vegas, NV Details <https://www-01.ibm.com/software/tivoli/pulse/agenda/index.html> * OpenStack Day Tokyo 2013 <http://openstackdays.com/en/> Mar 12, 2013 -- Tokyo, Japan Details <http://openstackdays.com/en/> * OpenStack Italia User Group: ...dove eravamo rimasti? <http://www.meetup.com/OpenStack-User-Group-Italia/events/102481022/> Mar 14, 2013 -- Milano, Italy Details <http://www.meetup.com/OpenStack-User-Group-Italia/events/102481022/> * PyCon 2013 & Job Fair <https://us.pycon.org/2013/> Mar 14 -- 17, 2013 -- Santa Clara, CA Details <https://us.pycon.org/2013/> * OpenStack Meetup <http://www.meetup.com/Indian-OpenStack-User-Group/events/105831232/> Mar 17, 2013 -- Bangalore, India Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/105831232/> * OpenStack Object Storage (Swift) API Sprint at PyCon 2013 <https://us.pycon.org/2013/community/sprints/swift/> Mar 18, 2013 -- Santa Clara, CA Details <https://us.pycon.org/2013/community/sprints/swift/> * OpenStack Paris Meetup <http://www.meetup.com/OpenStack-France/events/104394682/> Mar 19, 2013 -- Paris, France Details <http://www.meetup.com/OpenStack-France/events/104394682/> * World Hosting Days 2013 <http://www.worldhostingdays.com/eng/index.php> Mar 19 -- 21, 2013 -- Rust, Germany Details <http://www.worldhostingdays.com/eng/index.php> * OpenStack Developers Meetup <http://www.meetup.com/openstack-atlanta/> Mar 21, 2013 -- Atlanta, GA Details <http://www.meetup.com/openstack-atlanta/> * 1st OpenStack User Group Nordics meetup <http://www.meetup.com/OpenStack-User-Group-Nordics/events/95258382/> Apr 03, 2013 -- Kista, Sweden Details <http://www.meetup.com/OpenStack-User-Group-Nordics/events/95258382/> * OpenStack Summit April 2013 <http://www.openstack.org/summit/portland-2013/> Apr 15 -- 18, 2013 -- Portland, OR Details <http://www.openstack.org/summit/portland-2013/> * OpenStack Israel <http://www.openstack.org/> May 27, 2013 -- Tel-Aviv, Israel Coming Soon <http://www.openstack.org/> * GigaOM Structure <http://event.gigaom.com/structure/> Jun 19 -- 20, 2013 -- San Francisco, CA Details <http://event.gigaom.com/structure/> Reports from past events * OpenStack Delhi Meetup <http://www.hastexo.com/blogs/syed/2013/02/25/openstack-delhi-meetup> Other News * The path to Ask OpenStack <http://lists.openstack.org/pipermail/community/2013-February/000153.html> * OpenStack Unit Testing: a Long Journey Starts With a Small Step <http://openstackgd.wordpress.com/2013/02/23/openstack-unit-testing-a-long-j…> * Session proposals for the Havana Design Summit now open <http://lists.openstack.org/pipermail/openstack-dev/2013-February/005664.html> * OpenStack Project Meeting: Summary <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-02-26-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-02-26-21.…>. Welcome New Contributors Celebrating the first patches submitted this week by: * Jian Zhang, Intel * Dae S. Kim * Robert van Leeuwen, Spilgames /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0