April 2014 - OpenStack-announce - lists.openstack.org

[OSSA 2014-011] RBAC policy not properly enforced in Nova EC2 API (CVE-2014-0167)
by Tristan Cacqueray 09 Apr '14

09 Apr '14

OpenStack Security Advisory: 2014-011 CVE: CVE-2014-0167 Date: April 09, 2014 Title: RBAC policy not properly enforced in Nova EC2 API Reporter: Marc Heckmann (Ubisoft) Products: Nova Versions: from 2013.1 to 2013.2.3 Description: Marc Heckmann from Ubisoft reported a vulnerability in the Nova EC2 API security group implementation. RBAC policies are not enforced when using the EC2 API, in particular the add_rules, remove_rules and destroy methods. A restricted user may overcome his limitation by using EC2 API resulting in unauthorized action on security groups. Only setups using non-default RBAC rules for Nova may be affected. Juno (development branch) fix: https://review.openstack.org/86358 Icehouse (milestone-proposed branch) fix: https://review.openstack.org/86360 Havana fix: https://review.openstack.org/86361 Notes: This fix will be included in the icehouse-rc2 development milestone and in a future 2013.2.4 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0167 https://launchpad.net/bugs/1290537 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OSSA 2014-010] XSS in Horizon orchestration dashboard (CVE-2014-0157)
by Tristan Cacqueray 08 Apr '14

08 Apr '14

OpenStack Security Advisory: 2014-010 CVE: CVE-2014-0157 Date: April 08, 2014 Title: XSS in Horizon orchestration dashboard Reporter: Cristian Fiorentino (Intel) Products: Horizon Versions: 2013.2 version up to 2013.2.3 Description: Cristian Fiorentino from Intel reported a vulnerability in Horizon Orchestration dashboard. By tricking a Horizon user into using a malicious template in the Orchestration/Stack section of Horizon, a remote attacker may trigger a cross-site-scripting vulnerability. It may result in potential assets theft (Horizon user/admin access credentials, tenants confidential information, etc.). Only setups exposing the orchestration dashboard in Horizon are affected. Juno (development branch) fix: https://review.openstack.org/86059 Icehouse (milestone-proposed branch) fix: https://review.openstack.org/86054 Havana fix: https://review.openstack.org/86056 Notes: This fix will be included in the icehouse-rc2 development milestone and in a future 2013.2.4 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0157 https://launchpad.net/bugs/1289033 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Mar 28 – Apr 4)
by Stefano Maffulli 05 Apr '14

05 Apr '14

1 0

OpenStack 2013.2.3 released
by Adam Gandelman 03 Apr '14

03 Apr '14

Hello everyone, The OpenStack Stable Maintenance team is happy to announce the release of the 2013.2.3 stable Havana release. We have been busy reviewing and accepting backported bugfixes to the stable/havana branches according to the criteria set at: https://wiki.openstack.org/wiki/StableBranch A total of 106 bugs have been fixed across all projects. These updates to Havana are intended to be low risk with no intentional regressions or API changes. The list of bugs, tarballs and other milestone information for each project may be found on Launchpad: https://launchpad.net/ceilometer/havana/2013.2.3 https://launchpad.net/cinder/havana/2013.2.3 https://launchpad.net/glance/havana/2013.2.3 https://launchpad.net/heat/havana/2013.2.3 https://launchpad.net/horizon/havana/2013.2.3 https://launchpad.net/keystone/havana/2013.2.3 https://launchpad.net/neutron/havana/2013.2.3 https://launchpad.net/nova/havana/2013.2.3 Release notes may be found on the wiki: https://wiki.openstack.org/wiki/ReleaseNotes/2013.2.3 The freeze on the stable/havana branches will be lifted today as we begin working toward the 2013.3.4 release, to be released by Alan Pevec at a TBD date after the Icehouse release has wrapped up. Thanks, Adam Gandelman

1 0

Old stable/grizzly branches removed as of March 30, 2014
by Jeremy Stanley 02 Apr '14

02 Apr '14

Based on discussion[1] at the Icehouse Summit in Hong Kong, official support for stable/grizzly branches of OpenStack projects reached end of life and was frozen on March 6, 2014 (coincident with the icehouse-3 milestone). We kept these branches around for the scheduled 2013.1.5 stable point release[2] on March 20, 2014, and then tagged them "grizzly-eol" and deleted them from official Git repositories on March 30, 2014. At that time, all related provisions within our testing infrastructure for these branches were removed in preparation for upcoming stable/icehouse branch testing. My apologies for the delayed notice on the branch deletion, in case anyone was caught off guard by it. [1] https://etherpad.openstack.org/p/stable-havana-ideas [2] http://lists.openstack.org/pipermail/openstack-announce/2014-March/000209.h… -- Jeremy Stanley

1 0