OpenStack-announce

Thread Start a new thread

Download

openstack-announce@lists.openstack.org

December 2014

7 participants
13 discussions

[OSSA 2014-040] Horizon denial of service attack through login page (CVE-2014-8124)
by Tristan Cacqueray 09 Dec '14

09 Dec '14

OpenStack Security Advisory: 2014-040 CVE: CVE-2014-8124 Date: December 09, 2014 Title: Horizon denial of service attack through login page Reporter: Eric Peterson (Time Warner Cable) Products: Horizon Versions: up to 2014.1.3 and 2014.2 version up to 2014.2.1 Description: Eric Peterson from Time Warner Cable reported a vulnerability in Horizon. By making repeated requests to the Horizon login page a remote attacker may generate unwanted session records, potentially resulting in a denial of service. Only Horizon setups using a db or memcached session engine are affected. Kilo (development branch) fix: https://review.openstack.org/140353 Juno fix: https://review.openstack.org/140358 Icehouse fix: https://review.openstack.org/140356 django_openstack_auth fix: https://review.openstack.org/140352 Notes: This fix will be included in future 2014.1.3 and 2014.2.1 releases. The django_openstack_auth Horizon dependency requires the additional patch above. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8124 https://launchpad.net/bugs/1394370 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Nov 28 - Dec 6)
by Stefano Maffulli 06 Dec '14

06 Dec '14

December 2014 OpenStack Infrastructure User Manual Sprint <http://princessleia.com/journal/?p=9952> During this week the Infrastructure team released a significant milestone for the Infrastructure User Manual. The manual consolidates documentation for Developers, Core Reviewers and Project Drivers, which was spread across wiki pages, project-specific documentation files and general institutional knowledge. The manual is starting to look great and a lot of wiki pages have been declared obsolete meanwhile. Third-party CI account creation is now self-serve <http://lists.openstack.org/pipermail/third-party-announce/2014-December/000…> This means that new third-party account will need to follow a new, leaner process <http://ci.openstack.org/third_party.html#creating-a-service-account>. There are some changes for existing accounts. Read the full announcement <http://lists.openstack.org/pipermail/third-party-announce/2014-December/000…>. My Key Learning from Paris <http://www.mattfischer.com/blog/?p=610> Matt Fischer <http://www.mattfischer.com/blog> “learned a bunch of things in Paris: French food is amazing <http://www.yelp.com/biz/le-volant-basque-paris>, always upgrade OVS” and “All operators have the same problems.” The result of his and others' realization is the beginnings of an Operations Project <https://wiki.openstack.org/wiki/Operations>. Relevant Conversations * Nova Specs for Kilo <http://www.stillhq.com/openstack/kilo/000006.html> * Three Flavours of Infrastructure Cloud <http://www.zerobanana.com/archive/2014/12/04#three-flavours-of-cloud> * Studying Midcycle Sprints and Meetings <http://www.openstack.org/blog/2014/12/studying-midcycle-sprints-and-meeting…> * Proposal for Neutron core and vendor code decomposition <https://review.openstack.org/134680> * change to Oslo release process to support stable branch requirement caps <http://lists.openstack.org/pipermail/openstack-dev/2014-December/051872.html> Deadlines and Development Priorities * Neutron Spec Proposal Deadline (SPD) <https://wiki.openstack.org/wiki/NeutronKiloProjectPlan>: Monday 12-8-2014 * Neutron Spec Approval Deadline (SAD) <https://wiki.openstack.org/wiki/NeutronKiloProjectPlan>: Monday 12-15-2014 * [nova] Kilo Project Priorities <http://lists.openstack.org/pipermail/openstack-dev/2014-December/052225.html> * Neutron Priorities for Kilo <http://lists.openstack.org/pipermail/openstack-dev/2014-December/052230.html> Stable Release * OpenStack 2014.2.1 released <http://lists.openstack.org/pipermail/openstack-announce/2014-December/00030…> Tips ‘n Tricks * By Craige McWhirter <http://mcwhirter.com.au//tags/OpenStack/>: Managing KVM Console Logs for Nova <http://mcwhirter.com.au//craige/blog/2014/Managing_KVM_Console_Logs_for_Nov…> * By Arx Cruz <http://blog.arxcruz.net/welcome-to-postach-io>: OpenStack 3rd Party CI - Part I <http://blog.arxcruz.net/openstack-3rd-party-ci-part-i> and Part II – Puppetboard <http://blog.arxcruz.net/openstack-3rd-party-ci-part-ii-puppetboard> andPart III - Configuring your puppet recipes <http://blog.arxcruz.net/openstack-3rd-party-ci-part-iii-configuring-your-pu…> and Deleting OpenStack Instances directly from database <http://blog.arxcruz.net/deleting-openstack-instances-directly-from-database> and Ubuntu cloud image password <http://blog.arxcruz.net/ubuntu-cloud-image-password> and One controller to rule them all <http://blog.arxcruz.net/one-controller-to-rule-them-all> * By Oleg Gelbukh <https://www.mirantis.com/blog/pumphouse-deep-dive-part-1-2/>: Pumphouse Deep Dive, Part 1 <https://www.mirantis.com/blog/pumphouse-deep-dive-part-1-2/> * By Maish Saidel-Keesing <http://technodrone.blogspot.com/search/label/OpenStack>: Landing your first OpenStack Contribution <http://technodrone.blogspot.com/2014/12/landing-your-first-openstack.html> Reports from Previous Events * BootstrappingHour: Authentication Flows in OpenStack <https://wiki.openstack.org/wiki/BootstrappingHour/Authentication_Flows> Upcoming Events * Dec 09 - 11, 2014 <http://bitex.bh/> Bitex 2014 <http://bitex.bh/> Bahrain, BH <http://bitex.bh/> * Dec 09, 2014 <http://www.meetup.com/OpenStack-France/events/218918493/> PaaS with OpenStack <http://www.meetup.com/OpenStack-France/events/218918493/> Paris, FR <http://www.meetup.com/OpenStack-France/events/218918493/> * Dec 09, 2014 Stockholm OpenStack Meetup Stockholm, Sweden <http://www.meetup.com/OpenStack-User-Group-Nordics/events/218754241/> * Dec 09 - 11, 2014 <http://bitex.bh/> Bitex 2014 <http://bitex.bh/> Bahrain, BH <http://bitex.bh/> * Dec 10, 2014 <http://go.cumulusnetworks.com/opencontrail-openstack> Accelerating SDN Applications <http://go.cumulusnetworks.com/opencontrail-openstack> Mountain View, CA, US <http://go.cumulusnetworks.com/opencontrail-openstack> * Dec 10, 2014 <http://www.opensourcecloudday.be/> Open Source Cloud Day <http://www.opensourcecloudday.be/> Mechelen, Antwerp, BE <http://www.opensourcecloudday.be/> * Dec 11 - 12, 2014 <http://www.e-side.co.jp/okinawaopendays/2014/en.html> Okinawa Open Days 2014 <http://www.e-side.co.jp/okinawaopendays/2014/en.html> Naha, Okinawa, JP <http://www.e-side.co.jp/okinawaopendays/2014/en.html> * Dec 17, 2014 <http://fit.edu.pk/tutorials> Building Cloud with OpenStack <http://fit.edu.pk/tutorials> Islamabad, PK <http://fit.edu.pk/tutorials> * Dec 18, 2014 <http://meetu.ps/2DTr9p> Is OpenStack ready for Enterprises? <http://meetu.ps/2DTr9p> New York, New York, US <http://meetu.ps/2DTr9p> * Jan 15, 2015 <http://ow.ly/EKWpY> Deep Dive into Trove <http://ow.ly/EKWpY> Austin, Texas, US <http://ow.ly/EKWpY> * Feb 19 - 20, 2015 <http://www.tech-ies.com/> World Techies Forum <http://www.tech-ies.com/> Mumbai, Maharashtra, IN <http://www.tech-ies.com/> * Apr 13 - 14, 2015 <http://www.percona.com/live/openstack-live-2015/> OpenStack Live <http://www.percona.com/live/openstack-live-2015/> Santa Clara, CA, US <http://www.percona.com/live/openstack-live-2015/> * May 18 - 22, 2015 <https://www.openstack.org/summit/vancouver-2015/> OpenStack Summit May 2015 <https://www.openstack.org/summit/vancouver-2015/> Vancouver, BC <https://www.openstack.org/summit/vancouver-2015/> * Sep 17, 2015 <http://www.openstackbeneluxconference.nl/> OpenStack Benelux Conference 2015 <http://www.openstackbeneluxconference.nl/> Bussum, NL <http://www.openstackbeneluxconference.nl/> Other News * What's Up, Doc? Nov 19, 2014 <http://lists.openstack.org/pipermail/openstack-dev/2014-November/051113.html> * PKI Tokens Don't Give Better Security <http://www.jamielennox.net/blog/2014/12/01/pki-tokens-dont-give-better-secu…> * Who are the OpenStack Ambassadors? <http://opensource.com/business/14/12/who-are-openstack-ambassadors> * MySQL and OpenStack deep dive: Dec. 10 webinar <http://www.percona.com/blog/2014/12/04/mysql-and-openstack-deep-dive-dec-10…> * OpenStack Project Meeting: Summary <http://eavesdrop.openstack.org/meetings/project/2014/project.2014-11-25-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2014/project.2014-11-25-21.…>. Got Answers? Ask OpenStack <https://ask.openstack.org/> is the go-to destination for OpenStack users. Interesting questions waiting for answers: * How to make the fips used for dvr l3 routing on the compute nodes be persistent on boot? <https://ask.openstack.org/en/question/55213/how-to-make-the-fips-used-for-d…> * How to restrict incoming http requests to VM using load balancer? <https://ask.openstack.org/en/question/55298/how-to-restrict-incoming-http-r…> * Setup IceHouse with ZeroMQ <https://ask.openstack.org/en/question/55273/setup-icehouse-with-zeromq/> Welcome New Reviewers and Developers Kai Qiang Wu <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Midun Kumar <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Jing Zeng <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Jukka Lehtniemi <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Marco Fargetta <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Sunil Kumar <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Sam Yaple <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> chenglch <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Qi Zhang <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Yoni <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Richard Hedlind <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Kyle Rockman <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Hironori Shiina <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> qiaomin032 <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> yoan desbordes <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Stefano Canepa <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Surojit Pathak <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Sam Yaple <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Rohit Jaiswal <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Chris Cannon <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

OpenStack 2014.2.1 released
by Alan Pevec 05 Dec '14

05 Dec '14

Hello everyone, The OpenStack Stable Maintenance team is happy to announce the release of the 2014.2.1 stable Juno release. We have been busy reviewing and accepting backported bugfixes to the stable/juno branches according to the criteria set at: https://wiki.openstack.org/wiki/StableBranch A total of 123 bugs have been fixed across all projects. These updates to Juno are intended to be low risk with no intentional regressions or API changes. The list of bugs, tarballs and other milestone information for each project may be found on Launchpad: https://launchpad.net/ceilometer/juno/2014.2.1 https://launchpad.net/cinder/juno/2014.2.1 https://launchpad.net/glance/juno/2014.2.1 https://launchpad.net/heat/juno/2014.2.1 https://launchpad.net/horizon/juno/2014.2.1 https://launchpad.net/keystone/juno/2014.2.1 https://launchpad.net/neutron/juno/2014.2.1 https://launchpad.net/nova/juno/2014.2.1 https://launchpad.net/sahara/juno/2014.2.1 OpenStack Database Service (Trove) did not have stable/juno fixes at this time and will skip 2014.2.1 release. Release notes may be found on the wiki: https://wiki.openstack.org/wiki/ReleaseNotes/2014.2.1 The freeze on the stable/juno branches will be lifted today as we begin working toward the 2014.2.2 release, planned for Jan 29 2015 release and managed by Chuck Short. Thanks, Alan

1 0