October 2014 - OpenStack-announce

[OSSA 2014-034] Swift metadata constraints are not correctly enforced (CVE-2014-7960)
by Thierry Carrez 09 Oct '14

09 Oct '14

OpenStack Security Advisory: 2014-034 CVE: CVE-2014-7960 Date: October 09, 2014 Title: Swift metadata constraints are not correctly enforced Reporter: Rajaneesh Singh Products: Swift Versions: up to 2.1.0 Description: Rajaneesh Singh reported a vulnerability in the way Swift enforces metadata constraints. By adding metadata in several separate calls, an authenticated attacker can bypass the max_meta_count constraint, potentially resulting in the storage of more metadata than allowed in configuration. Juno (development branch) fix: https://review.openstack.org/125360 Icehouse fix: https://review.openstack.org/126645 Notes: This fix will be included in the upcoming 2.2.0 Juno release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7960 https://launchpad.net/bugs/1365350 -- Thierry Carrez OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Sep 26 - Oct 3)
by Stefano Maffulli 03 Oct '14

03 Oct '14

1 0

OpenStack 2014.1.3 released
by Adam Gandelman 03 Oct '14

03 Oct '14

Hello everyone, The OpenStack Stable Maintenance team is happy to announce the 2014.1.3 stable Icehouse release. We have been busy reviewing and accepting backported bugfixes to the stable/icehouse branches according to the criteria set at: https://wiki.openstack.org/wiki/StableBranch A total of 131 bugs have been fixed across all projects since 2014.1.2. These updates to Icehouse are intended to be low risk with no intentional regressions or API changes. The list of bugs, tarballs and other milestone information for each project may be found on Launchpad: https://launchpad.net/ceilometer/icehouse/2014.1.3 https://launchpad.net/cinder/icehouse/2014.1.3 https://launchpad.net/glance/icehouse/2014.1.3 https://launchpad.net/heat/icehouse/2014.1.3 https://launchpad.net/horizon/icehouse/2014.1.3 https://launchpad.net/keystone/icehouse/2014.1.3 https://launchpad.net/neutron/icehouse/2014.1.3 https://launchpad.net/nova/icehouse/2014.1.3 https://launchpad.net/trove/icehouse/2014.1.3 Release notes may be found on the wiki: https://wiki.openstack.org/wiki/ReleaseNotes/2014.1.3 The freeze on the stable/icehouse branches will be lifted today as we begin working toward 2014.1.4, which will be released on a TBD date after the Kilo-3 release. Thanks, Adam

1 0

[OSSA 2014-033] Cinder-volume host data leak to vm instance (CVE-2014-3641)
by Tristan Cacqueray 02 Oct '14

02 Oct '14

OpenStack Security Advisory: 2014-033 CVE: CVE-2014-3641 Date: October 02, 2014 Title: Cinder-volume host data leak to vm instance Reporter: Duncan Thomas (HP) Products: Cinder Versions: up to 2014.1.2 Description: Duncan Thomas from Hewlett Packard reported a vulnerability in Cinder GlusterFS and Linux Smbfs drivers. By overwriting a volume from within an instance with a malicious qcow2 header, an authenticated user may be able to clone and attach that corrupted volume resulting in affected drivers leaking an arbitrary file from the Cinder-volume host to the virtual instance. Note that the host file must be readable by the Cinder context to be exposed. Only Cinder setups using GlusterFS volume driver configured with glusterfs_qcow2_volumes=False (which is the default) or Cinder setups using Smbfs volume driver configured with smbfs_default_volume_format=raw (which is not the default) are affected. Juno (development branch) fix: https://review.openstack.org/125671 Icehouse fix: https://review.openstack.org/125710 Notes: This fix will be included in the Juno release 2014.2 and in the upcoming 2014.1.3 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3641 https://launchpad.net/bugs/1350504 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OSSA 2014-032] Nova VMware driver still leaks rescued images (CVE-2014-3608)
by Tristan Cacqueray 02 Oct '14

02 Oct '14

OpenStack Security Advisory: 2014-032 CVE: CVE-2014-3608 Date: October 2, 2014 Title: Nova VMware driver still leaks rescued images Reporter: Garth Mollett (Red Hat) Products: Nova Versions: up to 2014.1.2 Description: Garth Mollett from Red Hat reported an incomplete fix to OSSA-2014-017 (CVE-2014-2573), a vulnerability affecting Nova. If an authenticated user places an instance into rescue, and then issues a suspend command it will cause the instance to enter an ERROR state. Nova does not clean up an instance in this state correctly upon deletion. An attacker can use this to launch a denial of service attack. Only setups using the Nova VMware driver are affected by this flaw. Juno (development branch) fix: https://review.openstack.org/94281/ Icehouse fix: https://review.openstack.org/109624/ Notes: This fix will be included in the Juno release 2014.2.0 and in the upcoming 2014.1.3 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3608 https://launchpad.net/bugs/1338830 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0