October 2014 - OpenStack-announce

[OSSA 2014-038] Nova network DoS through API filtering (CVE-2014-3708)
by Tristan Cacqueray 28 Oct '14

28 Oct '14

OpenStack Security Advisory: 2014-038 CVE: CVE-2014-3708 Date: October 28, 2014 Title: Nova network DoS through API filtering Reporter: Mohammed Naser (Vexxhost) Products: Nova Versions: up to 2014.1.3, and 2014.2 Description: Mohammed Naser from Vexxhost reported a vulnerability in Nova API filters. By listing active servers using an ip filter, an authenticated user may overload nova-network or neutron-server process, resulting in a denial of services. All Nova setups are affected. Kilo (development branch) fix: https://review.openstack.org/131460 Juno fix: https://review.openstack.org/131462 Icehouse fix: https://review.openstack.org/131461 Notes: This fix will be included in future 2014.1.4 and 2014.2.1 releases. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3708 https://launchpad.net/bugs/1358583 --· Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Oct 17 – 24)
by Stefano Maffulli 24 Oct '14

24 Oct '14

1 0

[python-keystoneclient] Release of python-keystoneclient 0.11.2
by Morgan Fainberg 23 Oct '14

23 Oct '14

The Keystone team has released python-keystoneclient 0.11.2. This release can be installed from the following locations: * http://tarballs.openstack.org/python-keystoneclient * https://pypi.python.org/pypi/python-keystoneclient Detailed changes in this release: https://launchpad.net/python-keystoneclient/+milestone/0.11.2

1 0

[OSSA 2014-037] Nova VMware instance in resize state may leak (CVE-2014-8333)
by Tristan Cacqueray 21 Oct '14

21 Oct '14

OpenStack Security Advisory: 2014-037 CVE: CVE-2014-8333 Date: October 21, 2014 Title: Nova VMware instance in resize state may leak Reporter: Zhu Zhu (IBM) Products: Nova Versions: up to 2014.1.3 Description: Zhu Zhu from IBM reported a vulnerability in Nova VMware driver. If an authenticated user deletes an instance while it is in resize state, it will cause the original instance to not be deleted. An attacker can use this to launch a denial of service attack. All Nova VMware setups are affected. Juno fix: https://review.openstack.org/118595 Icehouse fix: https://review.openstack.org/125492 Notes: This fix was included in the 2014.2 release and will appear in a future 2014.1.4 stable point release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8333 https://launchpad.net/bugs/1359138 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Oct 10 – 17)
by Stefano Maffulli 17 Oct '14

17 Oct '14

1 0

[Elections] End of the Election Cycle - Results of PTL & TC Elections
by Anita Kuno 17 Oct '14

17 Oct '14

PTL Election Results: * Compute (Nova) ** Michael Still * Object Storage (Swift) ** John Dickinson * Image Service (Glance) ** Nikhil Komawar * Identity (Keystone) ** Morgan Fainberg * Dashboard (Horizon) ** David Lyle * Networking (Neutron) ** Kyle Mestery * Block Storage (Cinder) ** Mike Perez * Metering/Monitoring (Ceilometer) ** Eoghan Glynn * Orchestration (Heat) ** Angus Salkeld * Database Service (Trove) ** Nikhil Manchanda * Bare metal (Ironic) ** Devananda van der Veen * Common Libraries (Oslo) ** Doug Hellmann * Infrastructure ** James E. Blair * Documentation ** Anne Gentle * Quality Assurance (QA) ** Matthew Treinish * Deployment (TripleO) ** Clint Byrum * Release cycle management ** Thierry Carrez * Data Processing Service (Sahara) ** Sergey Lukjanov * Message Service (Zaqar) ** Flavio Percoco * Key Management Service (Barbican) ** Douglas Mendizabal * DNS Services (Designate) ** Kiall Mac Innes * Shared File Systems (Manila) ** Ben Swartzlander Full Election Results: * Cinder: http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_3bc8db78251af391 * TripleO: http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_d8d7335f4de67d94 TC Election Results: * Monty Taylor * Sean Dague * Doug Hellmann * Russell Bryant * Anne Gentle * John Griffith Full results: http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_c105db929e6c11f4 Stay up to date on Election activity by following our Governance page: https://wiki.openstack.org/wiki/Governance Thanks to my fellow election official, Tristan Cacqueray, I appreciate your help and perspective. Thank you, Anita

1 0

OpenStack 2014.2 ("Juno") is released !
by Thierry Carrez 16 Oct '14

16 Oct '14

Hello everyone, It is my great pleasure to announce the final release of OpenStack 2014.2, code-named "Juno". This concludes the 6-month Juno development cycle, which saw the completion of more than 340 features and the fixing of more than 3200 bugs in integrated projects and common libraries alone. Juno is also the first OpenStack release to officially include the Data Processing Service (Sahara). You can find source tarballs for each integrated project, together with complete lists of features and bugfixes, at the following links: Compute (Nova): https://launchpad.net/nova/juno/2014.2 Object Storage (Swift): https://launchpad.net/swift/juno/2.2.0 Image Service (Glance): https://launchpad.net/glance/juno/2014.2 Networking (Neutron): https://launchpad.net/neutron/juno/2014.2 Block Storage (Cinder): https://launchpad.net/cinder/juno/2014.2 Identity (Keystone): https://launchpad.net/keystone/juno/2014.2 Dashboard (Horizon): https://launchpad.net/horizon/juno/2014.2 Telemetry (Ceilometer): https://launchpad.net/ceilometer/juno/2014.2 Orchestration (Heat): https://launchpad.net/heat/juno/2014.2 Database Service (Trove): https://launchpad.net/trove/juno/2014.2 Data Processing (Sahara): https://launchpad.net/sahara/juno/2014.2 The Juno Release Notes wikipage contains an overview of the key features, as well as upgrade notes and current lists of known issues. You can access them at: https://wiki.openstack.org/wiki/ReleaseNotes/Juno Congratulations and thanks to the 1400+ individuals who contributed to this development cycle and helped in making this release a success. -- Thierry Carrez (ttx)

1 0

[OSSA 2014-036] Potential leak of passwords into log files (CVE-2014-7230, CVE-2014-7231)
by Tristan Cacqueray 15 Oct '14

15 Oct '14

OpenStack Security Advisory: 2014-036 CVE: CVE-2014-7230, CVE-2014-7231 Date: October 15, 2014 Title: Potential leak of passwords into log files Reporter: Amrith Kumar (Tesora) Products: Cinder and Nova (versions up to 2014.1.3) Trove (versions up to 2014.1.2) Description: Amrith Kumar from Tesora reported two vulnerabilities in the processutils.execute() and strutils.mask_password() functions available from oslo-incubator that are copied into each project's code. An attacker with read access to the services' logs may obtain passwords used as a parameter of a command that has failed (CVE-2014-7230) or when mask_password did not mask passwords properly (CVE-2014-7231). All Cinder, Nova and Trove setups are affected. Kilo (development branch) fixes: https://review.openstack.org/116927 (Cinder) https://review.openstack.org/126052 (Cinder ssh_execute) https://review.openstack.org/116982 (Nova) https://review.openstack.org/126047 (Nova ssh_execute) https://review.openstack.org/121417 (Trove) Juno (proposed branch) fixes: https://review.openstack.org/126594 (Nova ssh_execute) https://review.openstack.org/126592 (Cinder ssh_execute) Icehouse fixes: https://review.openstack.org/121382 (Cinder) https://review.openstack.org/126665 (Cinder ssh_execute) https://review.openstack.org/121096 (Nova) https://review.openstack.org/126699 (Nova ssh_execute) https://review.openstack.org/121416 (Trove) Notes: The former patch did not cover the ssh_execute method used in Nova and Cinder, thus two more patches are required for these projects. Nova and Cinder fixes are included in the 2014.2rc2 release candidate and will appear in a future 2014.1.4 release. Trove fix was included in the 2014.2rc1 release candidate and 2014.1.3 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7230 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7231 https://launchpad.net/bugs/1377981 https://launchpad.net/bugs/1343604 https://launchpad.net/bugs/1345233 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OSSA 2014-035] Nova VMware driver may connect VNC to another tenant's console (CVE-2014-8750)
by Jeremy Stanley 14 Oct '14

14 Oct '14

OpenStack Security Advisory: 2014-035 CVE: CVE-2014-8750 Date: October 14, 2014 Title: Nova VMware driver may connect VNC to another tenant's console Reporter: Marcio Roberto Starke Products: Nova Versions: up to 2014.1.3 Description: Marcio Roberto Starke reported a vulnerability in the Nova VMware driver. A race condition in its VNC port allocation may cause it to connect the wrong console if instances are created concurrently. By repeatedly spawning new instances, an authenticated user may be able to gain unauthorized console access to instances belonging to other tenants. Only Nova setups using the VMware driver and the VNC proxy service are affected. Juno (development branch) fix: https://review.openstack.org/114548 Icehouse fix: https://review.openstack.org/126425 Notes: This fix was included in the 2014.2rc1 release candidate and will appear in a future 2014.1.4 stable point release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8750 https://launchpad.net/bugs/1357372 -- Jeremy Stanley OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Oct 3 - 10)
by Stefano Maffulli 10 Oct '14

10 Oct '14

1 0