June 2015 - OpenStack-announce - lists.openstack.org

[OSSA 2015-012] Neutron L2 agent DoS through incorrect allowed address pairs (CVE-2015-3221)
by Tristan Cacqueray 23 Jun '15

23 Jun '15

=========================================================================== OSSA-2015-012: Neutron L2 agent DoS through incorrect allowed address pairs =========================================================================== :Date: June 23, 2015 :CVE: CVE-2015-3221 Affects ~~~~~~~ - Neutron: 2014.2 versions through 2014.2.3 and 2015.1.0 version Description ~~~~~~~~~~~ Darragh O'Reilly from HP reported a vulnerability in Neutron. By adding an address pair which is rejected as invalid by the ipset tool, an authenticated user may crash the Neutron L2 agent resulting in a denial of service attack. Neutron setups using the IPTables firewall driver are affected. Patches ~~~~~~~ - https://review.openstack.org/194696 (Juno) - https://review.openstack.org/194697 (Kilo) - https://review.openstack.org/194695 (Liberty) Credits ~~~~~~~ - Darragh O'Reilly from HP (CVE-2015-3221) References ~~~~~~~~~~ - https://launchpad.net/bugs/1461054 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3221 Notes ~~~~~ - This fix will be included in future 2014.2.4 (juno) and 2015.1.1 (kilo) releases. - Zero prefixed address pairs are no longer accepted by the Juno API, users need to use 0.0.0.0/1 and 128.0.0.1/1 or ::/1 and 8000::/1 instead. The fix_zero_length_ip_prefix.py tool is provided to clean ports previously configured with a zero prefixed address pair -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[release][ceilometer] ceilometermiddleware release 0.2.0 (liberty)
by doug＠doughellmann.com 23 Jun '15

23 Jun '15

We are jubilant to announce the release of: ceilometermiddleware 0.2.0: OpenStack Telemetry middleware for generating metrics This release is part of the liberty release series. With source available at: http://git.openstack.org/cgit/openstack/ceilometermiddleware For more details, please see the git log history below and: http://launchpad.net/ceilometermiddleware/+milestone/0.2.0 Please report issues through launchpad: http://bugs.launchpad.net/ceilometermiddleware Changes in ceilometermiddleware 0.1.0..0.2.0 -------------------------------------------- a086aac Updated from global requirements 22681aa Drop use of 'oslo' namespace package 1fc5037 Update README to work with release tools 881aaa4 Updated from global requirements 3d52e84 Add *paste.filter_factory* entry point cb8677e use pycadf helper module to assign action a0997c7 Updated from global requirements e4068a7 remove gitignore files Diffstat (except docs and test files) ------------------------------------- AUTHORS | 2 -- ChangeLog | 6 ------ README.rst | 13 +++++-------- ceilometermiddleware/swift.py | 10 ++++++---- requirements.txt | 14 +++++++------- setup.cfg | 4 ++++ setup.py | 8 ++++++++ test-requirements.txt | 6 +++--- 8 files changed, 33 insertions(+), 30 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index bfdc603..431a81e 100644 --- a/requirements.txt +++ b/requirements.txt @@ -5,7 +5,7 @@ -oslo.config>=1.6.0 -oslo.context>=0.1.0 -oslo.messaging>=1.4.0,!=1.5.0 -oslo.utils>=1.2.0 -pbr>=0.6,!=0.7,<1.0 -pycadf>=0.6.0 -six>=1.7.0 +oslo.config>=1.11.0 # Apache-2.0 +oslo.context>=0.2.0 # Apache-2.0 +oslo.messaging>=1.8.0 # Apache-2.0 +oslo.utils>=1.4.0 # Apache-2.0 +pbr>=0.11,<2.0 +pycadf>=0.8.0 +six>=1.9.0 diff --git a/test-requirements.txt b/test-requirements.txt index 1803eb5..f142509 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -9 +9 @@ discover -python-subunit +python-subunit>=0.0.18 @@ -11,2 +11,2 @@ sphinx>=1.1.2,!=1.2.0,!=1.3b1,<1.3 -oslosphinx>=2.2.0 -oslotest>=1.2.0 +oslosphinx>=2.5.0 # Apache-2.0 +oslotest>=1.5.1 # Apache-2.0

1 0

OpenStack Community Weekly Newsletter (June 12 – 19)
by Nicole Martinelli 22 Jun '15

22 Jun '15

1 0

[release][openstack-doc-tools] openstack-doc-tools release 0.29.1
by Robert Collins 22 Jun '15

22 Jun '15

We are thrilled to announce the release of: openstack-doc-tools 0.29.1: Tools for OpenStack Documentation With source available at: http://git.openstack.org/cgit/openstack/openstack-doc-tools For more details, please see the git log history below and: http://launchpad.net/openstack-manuals/+milestone/0.29.1 Please report issues through launchpad: http://bugs.launchpad.net/openstack-manuals Changes in openstack-doc-tools 0.29.0..0.29.1 --------------------------------------------- f7895df Add --use-first option to msgcat Diffstat (except docs and test files) ------------------------------------- RELEASE_NOTES.rst | 5 +++++ bin/doc-tools-check-languages | 6 +++--- 2 files changed, 8 insertions(+), 3 deletions(-) -- Robert Collins <rbtcollins(a)hp.com> Distinguished Technologist HP Converged Cloud

1 0

[release][pbr] pbr release 1.2.0
by Robert Collins 22 Jun '15

22 Jun '15

We are tickled pink to announce the release of: pbr HEAD: Python Build Reasonableness With source available at: http://git.openstack.org/cgit/openstack-dev/pbr For more details, please see the git log history below and: http://launchpad.net/pbr/+milestone/HEAD Please report issues through launchpad: http://bugs.launchpad.net/pbr Changes in pbr 1.1.1..1.2.0 -------------------------- 4b15038 Strip markers from test requirements. Diffstat (except docs and test files) ------------------------------------- pbr/hooks/backwards.py | 3 ++- pbr/packaging.py | 10 ++++++++-- 3 files changed, 11 insertions(+), 3 deletions(-) -- Robert Collins <rbtcollins(a)hp.com> Distinguished Technologist HP Converged Cloud

1 0

OpenStack 2014.1.5 released
by Alan Pevec 20 Jun '15

20 Jun '15

Hello everyone, The OpenStack Stable Maintenance team is eager to announce the release of the 2014.1.5 stable Icehouse. We have been busy reviewing and accepting backported bugfixes to the stable/icehouse branches according to the criteria set at: https://wiki.openstack.org/wiki/StableBranch A total of 41 bugs have been fixed across all projects since 2014.1.4. These updates to Icehouse are intended to be low risk with no intentional regressions or API changes. The list of bugs, tarballs and other milestone information for each project may be found on Launchpad: https://launchpad.net/cinder/icehouse/2014.1.5 https://launchpad.net/glance/icehouse/2014.1.5 https://launchpad.net/horizon/icehouse/2014.1.5 https://launchpad.net/keystone/icehouse/2014.1.5 https://launchpad.net/nova/icehouse/2014.1.5 https://launchpad.net/neutron/icehouse/2014.1.5 https://launchpad.net/ceilometer/icehouse/2014.1.5 https://launchpad.net/heat/icehouse/2014.1.5 Release notes may be found on the wiki: https://wiki.openstack.org/wiki/ReleaseNotes/2014.1.5 No further upstream Icehouse releases are planned. Thanks, Alan

1 0

[release][documentation] openstack-doc-tools release 0.29.0 (liberty)
by doug＠doughellmann.com 19 Jun '15

19 Jun '15

We are happy to announce the release of: openstack-doc-tools 0.29.0: Tools for OpenStack Documentation This release is part of the liberty release series. Special highlights of this release are: * doc-tools-check-languages: Handle common-rst directory, update for User Guides and firstapp. * autohelp.py: Suport generation of RST tables, fixes for extensions. With source available at: http://git.openstack.org/cgit/openstack/openstack-doc-tools For more details, please see the git log history below and: http://launchpad.net/openstack-manuals/+milestone/0.29.0 Please report issues through launchpad: http://bugs.launchpad.net/openstack-manuals Changes in openstack-doc-tools 0.28.0..0.29.0 --------------------------------------------- 072fc1d Fix up README to work with the release tools 6fa66c8 Update RELEASE_NOTES.rst 6a846ec Handle common-rst pot file 9263ac8 Add missing requirement PyYAML 6329eea autohelp: use correct option names from extensions 8a8ccdf let the autohelp_wrapper use local repos b455d12 autohelp: generate rst tables 9aa45dd autohelp: remove rootwrap discovery code 4c9922b Translation updates Diffstat (except docs and test files) ------------------------------------- CONTRIBUTING.rst | 26 +++++ README.rst | 31 +----- RELEASE_NOTES.rst | 8 ++ autogenerate_config_docs/autohelp-wrapper | 33 ++++-- autogenerate_config_docs/autohelp.py | 163 ++++++++++++++---------------- bin/doc-tools-check-languages | 62 +++++++----- requirements.txt | 1 + 7 files changed, 171 insertions(+), 153 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 178ab94..1ebdf09 100644 --- a/requirements.txt +++ b/requirements.txt @@ -12,0 +13 @@ demjson # GNU LGPL 3.0 +PyYAML>=3.1.0

1 0

[release] [ironic] python-ironic-inspector-client release 1.0.1
by Dmitry Tantsur 18 Jun '15

18 Jun '15

Hi all! I'm glad to announce the first release of the Python library and CLI too for (yet-to-be released) Ironic Inspector. Code for this library was extracted from ironic-discoverd tree, with removing deprecated code and adding basic support for API versioning. Big warning: while client itself is compatible with ironic-discoverd API, they are not co-installable due to using the same setuptools entry point. Grab the source: http://git.openstack.org/cgit/openstack/python-ironic-inspector-client/ Report issues: https://bugs.launchpad.net/python-ironic-inspector-client Cheers, Dmitry

1 0

[release][keystone] keystonemiddleware release 2.0.0 (liberty)
by doug＠doughellmann.com 18 Jun '15

18 Jun '15

We are overjoyed to announce the release of: keystonemiddleware 2.0.0: Middleware for OpenStack Identity This release is part of the liberty release series. With source available at: http://git.openstack.org/cgit/openstack/keystonemiddleware For more details, please see the git log history below and: http://launchpad.net/keystonemiddleware/+milestone/2.0.0 Please report issues through launchpad: http://bugs.launchpad.net/keystonemiddleware Changes in keystonemiddleware 1.6.1..2.0.0 ------------------------------------------ 2d4e194 Ensure cache keys are a known/fixed length 5690dc1 Updated from global requirements 9fd3986 Refactor request methods onto request object 468addb validate_token returns AccessInfo bdf03b0 Updated from global requirements 8723d88 Fixes a spelling error in a test name 6f9b7a4 Remove custom header handling c94f403 Stop using function deprecated in py34 570f26b Fetch user token from request rather than env 7074ee2 Remove the _msg_format function 675729b Base use webob aca9909 Don't rely on token_info for header building 2c00f8c Move project included validation c67420b Depend on keystoneclient for expiration checking c965851 Don't store expire into memcache 0aeea58 Removes discover from test-reqs 8aa9e80 Drop py2.6 support for keystone middleware 2a841f1 Create new user plugin tests bd74215 Add an explicit test failure condition when auth_token is missing c482f5b Fixup test-requirements-py3.txt 03d6f0c Fix list_opts test to not check all deps 0e2c5b5 tox env for Bandit 530b5cb Cleanup token hashes generated by cache 7940e10 Updated from global requirements 47fed2f Improved handling of endpoints missing urls 7148072 Refactor: extract echo_app from enclosing class 194e00a Add keystone v3 API to fetch revocation list 68bc769 Simplify request making in auth_token tests f45d766 Change auth_token to use keystoneclient 74d978c Deprecate auth_token authentication ea9ac13 Updated from global requirements dc44d62 Ignore cover directory Diffstat (except docs and test files) ------------------------------------- .gitignore | 1 + bandit.yaml | 134 ++++ keystonemiddleware/audit.py | 26 +- keystonemiddleware/auth_token/__init__.py | 428 +++------- keystonemiddleware/auth_token/_auth.py | 19 +- keystonemiddleware/auth_token/_cache.py | 87 +-- keystonemiddleware/auth_token/_identity.py | 105 +-- keystonemiddleware/auth_token/_request.py | 180 +++++ keystonemiddleware/auth_token/_user_plugin.py | 19 + keystonemiddleware/auth_token/_utils.py | 32 - keystonemiddleware/echo/service.py | 16 +- .../unit/auth_token/test_auth_token_middleware.py | 870 +++++++-------------- requirements.txt | 8 +- setup.cfg | 1 - test-requirements-bandit.txt | 1 + test-requirements-py3.txt | 4 +- test-requirements.txt | 2 +- tox.ini | 4 + 24 files changed, 1389 insertions(+), 1142 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index b611a31..b13a89e 100644 --- a/requirements.txt +++ b/requirements.txt @@ -6 +6 @@ Babel>=1.3 -oslo.config>=1.9.3 # Apache-2.0 +oslo.config>=1.11.0 # Apache-2.0 @@ -11 +11 @@ oslo.utils>=1.4.0 # Apache-2.0 -pbr>=0.6,!=0.7,<1.0 +pbr>=0.11,<2.0 @@ -13,2 +13,2 @@ pycadf>=0.8.0 -python-keystoneclient>=1.1.0 -requests>=2.2.0,!=2.4.0 +python-keystoneclient>=1.6.0 +requests>=2.5.2 diff --git a/test-requirements-bandit.txt b/test-requirements-bandit.txt new file mode 100644 index 0000000..b21da7f --- /dev/null +++ b/test-requirements-bandit.txt @@ -0,0 +1 @@ +bandit>=0.10.1 diff --git a/test-requirements-py3.txt b/test-requirements-py3.txt index 9a33730..abada85 100644 --- a/test-requirements-py3.txt +++ b/test-requirements-py3.txt @@ -4,0 +5,2 @@ +hacking>=0.10.0,<0.11 + @@ -8 +9,0 @@ fixtures>=0.3.14 -hacking>=0.8.0,<0.9 @@ -15,0 +17 @@ sphinx>=1.1.2,!=1.2.0,!=1.3b1,<1.3 +stevedore>=1.5.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index e36b86e..a305e6c 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -8 +7,0 @@ coverage>=3.6 -discover @@ -16,0 +16 @@ sphinx>=1.1.2,!=1.2.0,!=1.3b1,<1.3 +stevedore>=1.5.0 # Apache-2.0

1 0

[release][oslo] oslo.service release 0.1.0 (liberty)
by doug＠doughellmann.com 18 Jun '15

18 Jun '15

We are pleased to announce the release of: oslo.service 0.1.0: oslo.service library This release is part of the liberty release series, and is the first experimental release of this library. With source available at: http://git.openstack.org/cgit/openstack/oslo.service For more details, please see the git log history below and: http://launchpad.net/oslo.service/+milestone/HEAD Please report issues through launchpad: http://bugs.launchpad.net/oslo.service

1 0