May 2015 - OpenStack-announce - lists.openstack.org

OpenStack Community Weekly Newsletter (May 8 - 22)
by Stefano Maffulli 29 May '15

29 May '15

1 0

[OSSA 2015-009] Persistent XSS in Horizon metadata dashboard (CVE-2015-3988)
by Tristan Cacqueray 25 May '15

25 May '15

=========================================================== OSSA-2015-009: Persistent XSS in Horizon metadata dashboard =========================================================== :Date: May 25, 2015 :CVE: CVE-2015-3988 Affects ~~~~~~~ - Horizon: 2014.2 versions through 2014.2.3 and version 2015.1.0 Description ~~~~~~~~~~~ Sunil Yadav from IBM Security Services reported a persistent XSS in Horizon. An authenticated user may conduct a persistent XSS attack by setting a malicious metadata to a Glance image, a Nova flavor or a Host Aggregate and tricking an administrator to load the update metadata page. Once executed in a legitimate context this attack may result in a privilege escalation. All Horizon setups are affected. Patches ~~~~~~~ - https://review.openstack.org/183659 (Juno) - https://review.openstack.org/183656 (Kilo) - https://review.openstack.org/179429 (Liberty) Credits ~~~~~~~ - Sunil Yadav from IBM (CVE-2015-3988) References ~~~~~~~~~~ - https://launchpad.net/bugs/1449260 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3988 Notes ~~~~~ - This fix will be included in future 2014.2.4 (juno) and 2015.1.1 (kilo) releases. -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (May 1 - 8)
by Stefano Maffulli 08 May '15

08 May '15

1 0

[OSSA 2015-008] Potential Keystone cache backend password leak in log (CVE-2015-3646)
by Tristan Cacqueray 05 May '15

05 May '15

==================================================================== OSSA-2015-008: Potential Keystone cache backend password leak in log ==================================================================== :Date: May 04, 2015 :CVE: CVE-2015-3646 Affects ~~~~~~~ - Keystone: versions through 2014.1.4, and 2014.2 versions through 2014.2.3 Description ~~~~~~~~~~~ Eric Brown from VMware reported a vulnerability in Keystone. The backend_argument configuration option content is being logged, and it may contain sensitive information for specific backends (like a password for MongoDB). An attacker with read access to Keystone logs may therefore obtain sensitive data about certain backends. All Keystone setups are potentially impacted. Patches ~~~~~~~ - https://review.openstack.org/175519 (Icehouse) - https://review.openstack.org/173116 (Juno) Credits ~~~~~~~ - Eric Brown from VMware (CVE-2015-3646) References ~~~~~~~~~~ - https://launchpad.net/bugs/1443598 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3646 Notes ~~~~~ - This fix will be included in future 2014.1.5 (icehouse) and 2014.2.4 (juno) releases. - The 2015.1.0 (kilo) release is not affected.

1 0

OpenStack Community Weekly Newsletter (Apr 24 - May 1)
by Stefano Maffulli 01 May '15

01 May '15

Kilo Logo Superuser Awards final faceoff: your vote counts Four great finalists, but only one can win: it’s a close call as the voting deadline approaches for this edition of the Superuser Awards. Snapshot of the OpenStack community behind Kilo The OpenStack community that helped create the Kilo release has done some seriously heavy lifting. For the 11th release, there were more contributors, more companies involved and more work across time zones than ever before. The Road to Vancouver * Canada Visa Information * Official Hotel Room Blocks * Preparation to Design summit * What's a Design Summit? * (Unofficial) Social activities: Geocaching in Vancover Relevant Conversations * Results of the TC Election * Go! Swift! * API working group liaisons and responsibilities Deadlines and Development Priorities * Relax for a day :) Reports from Previous Events * OpenStack superusers deliver the goods at CONNECT Security Advisories and Notices * [OSSN 0048] Glance method filtering does not work under certain conditions Tips ‘n Tricks * By Adam Young: Creating Hierarchical Projects in Keystone * By Spencer Smith: Image Creation - Packer and OpenStack * By Ronald Bradford: Running openstack tests with tox and Understanding the different Openstack tox configs * By Nir Yechiel: SR-IOV Networking – Part II: Walking Through the Implementation * By Craige McWhirter: Rebuilding An OpenStack Instance and Keeping the Same Fixed IP * By Daisy.Guo: reStructuredText markups in manuals and the translation tips * By Kyle Mestery: Subnetpools in Neutron * By Robert Collins: Dealing with deps in OpenStack * By Joe Topjian: introducing and using Terraform * By Swapnil Kulkarni: OpenStack oslo packages not available in devstack? * By Steve Martinelli: Debugging keystone tests and live deployments Upcoming Events OpenStack Israel CFP Voting is Open PyCon-AU Openstack miniconf CFP closes May 8th * May 04, 2015 [ONLINE MEETUP] OpenStack & Beyond Podcast: Talking NFV + SDN in the Cloud with * May 05, 2015 London OpenStack May Meetup London, GB * May 05, 2015 May Sydney Meetup - Midokura presents "I Can Haz Moar Networks?" * May 05 - 07, 2015 CeBIT AU 2015 Sydney, NSW, AU * May 06 - 07, 2015 OpenStack Meetup May - Ceilometer Telemetry Presentation Richardson, TX, US * May 07, 2015 Online Meetup: How StackStorm builds and Operates StackStorm Software Itself Mountain View, CA, US * May 07, 2015 OpenStack Seattle Meetup: The Ins and Outs of Deploying OpenStack Seattle, WA, US * May 07, 2015 Open...House. Community. Stack. Sunnyvale, CA, US * May 08, 2015 Open... House. Community. Stack. Sunnyvale, CA, US * May 09, 2015 OpenStack Meetup Hanoi Hanoi, Hanoi, VN * May 12, 2015 OpenStack Munich Meetup Munich, DE * May 18 - 22, 2015 OpenStack Summit May 2015 Vancouver, BC * Jun 02, 2015 OpenStack Day LATAM Mexico City, MX * Jun 04, 2015 OpenStack Days Istanbul – 2015 Istanbul, TR * Jun 06, 2015 OpenStack Meetup, Bangalore Bangalore, Karnataka, IN * Jun 08, 2015 OpenStack CEE Day 2015 Budapest, HU * Jun 11, 2015 OpenStack DACH Day 2015 Berlin, DE * Jun 11, 2015 OpenStack DACH Day 2015 Berlin, DE * Jun 15, 2015 OpenStack Israel 2015 Tev Aviv, IL * Jul 20 - 24, 2015 OSCON 2015 Portland, OR, US * Jul 30 - 31, 2015 DCD INTERNET San Francisco, CA, US Other News * Neutron, ZeroMQ and Git – Ubuntu OpenStack 15.04 Charm release! * OpenStack SWIFT Object Storage Tape Library Connector, first release * Support for Python 2.6 in Swift * Introducing the Xen Project – OpenStack CI Loop * What AWS Revenues Mean for Public Cloud and OpenStack More Generally The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment.

1 0