October 2014 - OpenStack-announce

[OSSA 2014-038] Nova network DoS through API filtering (CVE-2014-3708)
by Tristan Cacqueray 28 Oct '14

28 Oct '14

OpenStack Security Advisory: 2014-038 CVE: CVE-2014-3708 Date: October 28, 2014 Title: Nova network DoS through API filtering Reporter: Mohammed Naser (Vexxhost) Products: Nova Versions: up to 2014.1.3, and 2014.2 Description: Mohammed Naser from Vexxhost reported a vulnerability in Nova API filters. By listing active servers using an ip filter, an authenticated user may overload nova-network or neutron-server process, resulting in a denial of services. All Nova setups are affected. Kilo (development branch) fix: https://review.openstack.org/131460 Juno fix: https://review.openstack.org/131462 Icehouse fix: https://review.openstack.org/131461 Notes: This fix will be included in future 2014.1.4 and 2014.2.1 releases. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3708 https://launchpad.net/bugs/1358583 --· Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Oct 17 – 24)
by Stefano Maffulli 25 Oct '14

25 Oct '14

1 0

[python-keystoneclient] Release of python-keystoneclient 0.11.2
by Morgan Fainberg 23 Oct '14

23 Oct '14

The Keystone team has released python-keystoneclient 0.11.2. This release can be installed from the following locations: * http://tarballs.openstack.org/python-keystoneclient * https://pypi.python.org/pypi/python-keystoneclient Detailed changes in this release: https://launchpad.net/python-keystoneclient/+milestone/0.11.2

1 0

[OSSA 2014-037] Nova VMware instance in resize state may leak (CVE-2014-8333)
by Tristan Cacqueray 22 Oct '14

22 Oct '14

OpenStack Security Advisory: 2014-037 CVE: CVE-2014-8333 Date: October 21, 2014 Title: Nova VMware instance in resize state may leak Reporter: Zhu Zhu (IBM) Products: Nova Versions: up to 2014.1.3 Description: Zhu Zhu from IBM reported a vulnerability in Nova VMware driver. If an authenticated user deletes an instance while it is in resize state, it will cause the original instance to not be deleted. An attacker can use this to launch a denial of service attack. All Nova VMware setups are affected. Juno fix: https://review.openstack.org/118595 Icehouse fix: https://review.openstack.org/125492 Notes: This fix was included in the 2014.2 release and will appear in a future 2014.1.4 stable point release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8333 https://launchpad.net/bugs/1359138 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Oct 10 – 17)
by Stefano Maffulli 18 Oct '14

18 Oct '14

1 0

[Elections] End of the Election Cycle - Results of PTL & TC Elections
by Anita Kuno 17 Oct '14

17 Oct '14

PTL Election Results: * Compute (Nova) ** Michael Still * Object Storage (Swift) ** John Dickinson * Image Service (Glance) ** Nikhil Komawar * Identity (Keystone) ** Morgan Fainberg * Dashboard (Horizon) ** David Lyle * Networking (Neutron) ** Kyle Mestery * Block Storage (Cinder) ** Mike Perez * Metering/Monitoring (Ceilometer) ** Eoghan Glynn * Orchestration (Heat) ** Angus Salkeld * Database Service (Trove) ** Nikhil Manchanda * Bare metal (Ironic) ** Devananda van der Veen * Common Libraries (Oslo) ** Doug Hellmann * Infrastructure ** James E. Blair * Documentation ** Anne Gentle * Quality Assurance (QA) ** Matthew Treinish * Deployment (TripleO) ** Clint Byrum * Release cycle management ** Thierry Carrez * Data Processing Service (Sahara) ** Sergey Lukjanov * Message Service (Zaqar) ** Flavio Percoco * Key Management Service (Barbican) ** Douglas Mendizabal * DNS Services (Designate) ** Kiall Mac Innes * Shared File Systems (Manila) ** Ben Swartzlander Full Election Results: * Cinder: http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_3bc8db78251af391 * TripleO: http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_d8d7335f4de67d94 TC Election Results: * Monty Taylor * Sean Dague * Doug Hellmann * Russell Bryant * Anne Gentle * John Griffith Full results: http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_c105db929e6c11f4 Stay up to date on Election activity by following our Governance page: https://wiki.openstack.org/wiki/Governance Thanks to my fellow election official, Tristan Cacqueray, I appreciate your help and perspective. Thank you, Anita

1 0

OpenStack 2014.2 ("Juno") is released !
by Thierry Carrez 16 Oct '14

16 Oct '14

Hello everyone, It is my great pleasure to announce the final release of OpenStack 2014.2, code-named "Juno". This concludes the 6-month Juno development cycle, which saw the completion of more than 340 features and the fixing of more than 3200 bugs in integrated projects and common libraries alone. Juno is also the first OpenStack release to officially include the Data Processing Service (Sahara). You can find source tarballs for each integrated project, together with complete lists of features and bugfixes, at the following links: Compute (Nova): https://launchpad.net/nova/juno/2014.2 Object Storage (Swift): https://launchpad.net/swift/juno/2.2.0 Image Service (Glance): https://launchpad.net/glance/juno/2014.2 Networking (Neutron): https://launchpad.net/neutron/juno/2014.2 Block Storage (Cinder): https://launchpad.net/cinder/juno/2014.2 Identity (Keystone): https://launchpad.net/keystone/juno/2014.2 Dashboard (Horizon): https://launchpad.net/horizon/juno/2014.2 Telemetry (Ceilometer): https://launchpad.net/ceilometer/juno/2014.2 Orchestration (Heat): https://launchpad.net/heat/juno/2014.2 Database Service (Trove): https://launchpad.net/trove/juno/2014.2 Data Processing (Sahara): https://launchpad.net/sahara/juno/2014.2 The Juno Release Notes wikipage contains an overview of the key features, as well as upgrade notes and current lists of known issues. You can access them at: https://wiki.openstack.org/wiki/ReleaseNotes/Juno Congratulations and thanks to the 1400+ individuals who contributed to this development cycle and helped in making this release a success. -- Thierry Carrez (ttx)

1 0

[OSSA 2014-036] Potential leak of passwords into log files (CVE-2014-7230, CVE-2014-7231)
by Tristan Cacqueray 15 Oct '14

15 Oct '14

OpenStack Security Advisory: 2014-036 CVE: CVE-2014-7230, CVE-2014-7231 Date: October 15, 2014 Title: Potential leak of passwords into log files Reporter: Amrith Kumar (Tesora) Products: Cinder and Nova (versions up to 2014.1.3) Trove (versions up to 2014.1.2) Description: Amrith Kumar from Tesora reported two vulnerabilities in the processutils.execute() and strutils.mask_password() functions available from oslo-incubator that are copied into each project's code. An attacker with read access to the services' logs may obtain passwords used as a parameter of a command that has failed (CVE-2014-7230) or when mask_password did not mask passwords properly (CVE-2014-7231). All Cinder, Nova and Trove setups are affected. Kilo (development branch) fixes: https://review.openstack.org/116927 (Cinder) https://review.openstack.org/126052 (Cinder ssh_execute) https://review.openstack.org/116982 (Nova) https://review.openstack.org/126047 (Nova ssh_execute) https://review.openstack.org/121417 (Trove) Juno (proposed branch) fixes: https://review.openstack.org/126594 (Nova ssh_execute) https://review.openstack.org/126592 (Cinder ssh_execute) Icehouse fixes: https://review.openstack.org/121382 (Cinder) https://review.openstack.org/126665 (Cinder ssh_execute) https://review.openstack.org/121096 (Nova) https://review.openstack.org/126699 (Nova ssh_execute) https://review.openstack.org/121416 (Trove) Notes: The former patch did not cover the ssh_execute method used in Nova and Cinder, thus two more patches are required for these projects. Nova and Cinder fixes are included in the 2014.2rc2 release candidate and will appear in a future 2014.1.4 release. Trove fix was included in the 2014.2rc1 release candidate and 2014.1.3 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7230 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7231 https://launchpad.net/bugs/1377981 https://launchpad.net/bugs/1343604 https://launchpad.net/bugs/1345233 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OSSA 2014-035] Nova VMware driver may connect VNC to another tenant's console (CVE-2014-8750)
by Jeremy Stanley 14 Oct '14

14 Oct '14

OpenStack Security Advisory: 2014-035 CVE: CVE-2014-8750 Date: October 14, 2014 Title: Nova VMware driver may connect VNC to another tenant's console Reporter: Marcio Roberto Starke Products: Nova Versions: up to 2014.1.3 Description: Marcio Roberto Starke reported a vulnerability in the Nova VMware driver. A race condition in its VNC port allocation may cause it to connect the wrong console if instances are created concurrently. By repeatedly spawning new instances, an authenticated user may be able to gain unauthorized console access to instances belonging to other tenants. Only Nova setups using the VMware driver and the VNC proxy service are affected. Juno (development branch) fix: https://review.openstack.org/114548 Icehouse fix: https://review.openstack.org/126425 Notes: This fix was included in the 2014.2rc1 release candidate and will appear in a future 2014.1.4 stable point release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8750 https://launchpad.net/bugs/1357372 -- Jeremy Stanley OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Oct 3 - 10)
by Stefano Maffulli 10 Oct '14

10 Oct '14

1 0

[OSSA 2014-034] Swift metadata constraints are not correctly enforced (CVE-2014-7960)
by Thierry Carrez 09 Oct '14

09 Oct '14

OpenStack Security Advisory: 2014-034 CVE: CVE-2014-7960 Date: October 09, 2014 Title: Swift metadata constraints are not correctly enforced Reporter: Rajaneesh Singh Products: Swift Versions: up to 2.1.0 Description: Rajaneesh Singh reported a vulnerability in the way Swift enforces metadata constraints. By adding metadata in several separate calls, an authenticated attacker can bypass the max_meta_count constraint, potentially resulting in the storage of more metadata than allowed in configuration. Juno (development branch) fix: https://review.openstack.org/125360 Icehouse fix: https://review.openstack.org/126645 Notes: This fix will be included in the upcoming 2.2.0 Juno release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7960 https://launchpad.net/bugs/1365350 -- Thierry Carrez OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Sep 26 - Oct 3)
by Stefano Maffulli 04 Oct '14

04 Oct '14

1 0

OpenStack 2014.1.3 released
by Adam Gandelman 03 Oct '14

03 Oct '14

Hello everyone, The OpenStack Stable Maintenance team is happy to announce the 2014.1.3 stable Icehouse release. We have been busy reviewing and accepting backported bugfixes to the stable/icehouse branches according to the criteria set at: https://wiki.openstack.org/wiki/StableBranch A total of 131 bugs have been fixed across all projects since 2014.1.2. These updates to Icehouse are intended to be low risk with no intentional regressions or API changes. The list of bugs, tarballs and other milestone information for each project may be found on Launchpad: https://launchpad.net/ceilometer/icehouse/2014.1.3 https://launchpad.net/cinder/icehouse/2014.1.3 https://launchpad.net/glance/icehouse/2014.1.3 https://launchpad.net/heat/icehouse/2014.1.3 https://launchpad.net/horizon/icehouse/2014.1.3 https://launchpad.net/keystone/icehouse/2014.1.3 https://launchpad.net/neutron/icehouse/2014.1.3 https://launchpad.net/nova/icehouse/2014.1.3 https://launchpad.net/trove/icehouse/2014.1.3 Release notes may be found on the wiki: https://wiki.openstack.org/wiki/ReleaseNotes/2014.1.3 The freeze on the stable/icehouse branches will be lifted today as we begin working toward 2014.1.4, which will be released on a TBD date after the Kilo-3 release. Thanks, Adam

1 0

[OSSA 2014-033] Cinder-volume host data leak to vm instance (CVE-2014-3641)
by Tristan Cacqueray 03 Oct '14

03 Oct '14

OpenStack Security Advisory: 2014-033 CVE: CVE-2014-3641 Date: October 02, 2014 Title: Cinder-volume host data leak to vm instance Reporter: Duncan Thomas (HP) Products: Cinder Versions: up to 2014.1.2 Description: Duncan Thomas from Hewlett Packard reported a vulnerability in Cinder GlusterFS and Linux Smbfs drivers. By overwriting a volume from within an instance with a malicious qcow2 header, an authenticated user may be able to clone and attach that corrupted volume resulting in affected drivers leaking an arbitrary file from the Cinder-volume host to the virtual instance. Note that the host file must be readable by the Cinder context to be exposed. Only Cinder setups using GlusterFS volume driver configured with glusterfs_qcow2_volumes=False (which is the default) or Cinder setups using Smbfs volume driver configured with smbfs_default_volume_format=raw (which is not the default) are affected. Juno (development branch) fix: https://review.openstack.org/125671 Icehouse fix: https://review.openstack.org/125710 Notes: This fix will be included in the Juno release 2014.2 and in the upcoming 2014.1.3 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3641 https://launchpad.net/bugs/1350504 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OSSA 2014-032] Nova VMware driver still leaks rescued images (CVE-2014-3608)
by Tristan Cacqueray 02 Oct '14

02 Oct '14

OpenStack Security Advisory: 2014-032 CVE: CVE-2014-3608 Date: October 2, 2014 Title: Nova VMware driver still leaks rescued images Reporter: Garth Mollett (Red Hat) Products: Nova Versions: up to 2014.1.2 Description: Garth Mollett from Red Hat reported an incomplete fix to OSSA-2014-017 (CVE-2014-2573), a vulnerability affecting Nova. If an authenticated user places an instance into rescue, and then issues a suspend command it will cause the instance to enter an ERROR state. Nova does not clean up an instance in this state correctly upon deletion. An attacker can use this to launch a denial of service attack. Only setups using the Nova VMware driver are affected by this flaw. Juno (development branch) fix: https://review.openstack.org/94281/ Icehouse fix: https://review.openstack.org/109624/ Notes: This fix will be included in the Juno release 2014.2.0 and in the upcoming 2014.1.3 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3608 https://launchpad.net/bugs/1338830 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0