June 2015 - OpenStack-announce - lists.openstack.org

[OSSA 2015-011.1] Cinder host file disclosure through qcow2 backing file (CVE-2015-1851) ERRATA 1
by Tristan Cacqueray 17 Jun '15

17 Jun '15

======================================================================= OSSA-2015-011.1: Cinder host file disclosure through qcow2 backing file ======================================================================= :Date: June 16, 2015 :CVE: CVE-2015-1851 Affects ~~~~~~~ - Cinder: versions through 2014.1.4, and 2014.2 versions through 2014.2.3, and version 2015.1.0 Description ~~~~~~~~~~~ Bastian Blank from credativ reported a vulnerability in Cinder. By overwriting an image with a malicious qcow2 header, an authenticated user may mislead Cinder upload-to-image action, resulting in disclosure of any file from the Cinder server. All Cinder setups are affected. Errata ~~~~~~ CVE-2015-1850 has been assigned to a similar issue in Nova, the correct CVE number for Cinder is CVE-2015-1851. Patches ~~~~~~~ - https://review.openstack.org/191871 (Icehouse) - https://review.openstack.org/191865 (Juno) - https://review.openstack.org/191786 (Kilo) - https://review.openstack.org/191785 (Liberty) Credits ~~~~~~~ - Bastian Blank from Credativ (CVE-2015-1851) References ~~~~~~~~~~ - https://launchpad.net/bugs/1415087 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1851 Notes ~~~~~ - This fix will be included in future 2014.1.5 (icehouse), 2014.2.4 (juno) and 2015.1.1 (kilo) releases. OSSA History ~~~~~~~~~~~~ - 2015-06-17 - Errata 1 - 2015-06-16 - Original Version -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[release][openstackclient] python-openstackclient release 1.5.0 (liberty)
by doug＠doughellmann.com 16 Jun '15

16 Jun '15

We are delighted to announce the release of: python-openstackclient 1.5.0: OpenStack Command-line Client This release is part of the liberty release series. With source available at: https://git.openstack.org/cgit/openstack/python-openstackclient For more details, please see the git log history below and: https://launchpad.net/python-openstackclient/+milestone/1.5.0 Please report issues through launchpad: https://bugs.launchpad.net/python-openstackclient Changes in python-openstackclient 1.4.0..1.5.0 ---------------------------------------------- 291ba62 Add release notes for 1.5.0 258f4ca reference corect ec2 helper function dca47a7 Updated from global requirements c88b433 Add support for volume snapshot v2 command Diffstat (except docs and test files) ------------------------------------- openstackclient/identity/v3/ec2creds.py | 8 +- openstackclient/volume/v2/snapshot.py | 205 ++++++++++++++++++++++- requirements.txt | 2 +- setup.cfg | 4 + 7 files changed, 412 insertions(+), 11 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index d420b1a..11d2a39 100644 --- a/requirements.txt +++ b/requirements.txt @@ -17 +17 @@ python-novaclient>=2.22.0 -python-cinderclient>=1.2.1 +python-cinderclient>=1.2.2

1 0

[release][oslo] taskflow release 0.11.0 (liberty)
by doug＠doughellmann.com 16 Jun '15

16 Jun '15

We are satisfied to announce the release of: taskflow 0.11.0: Taskflow structured state management library. This release is part of the liberty release series. With source available at: http://git.openstack.org/cgit/openstack/taskflow For more details, please see the git log history below and: http://launchpad.net/taskflow/+milestone/0.11.0 Please report issues through launchpad: http://bugs.launchpad.net/taskflow/ Changes in taskflow 0.10.1..0.11.0 ---------------------------------- 6e62842 Updated from global requirements 28eafa6 Switch badges from 'pypip.in' to 'shields.io' 3d4bbb9 Adding a revert_all option to retry controllers 4b28b32 Updated from global requirements 61a4f97 Remove example not tested deaf61c Make the default file encoding a class constant with a docstring 33e9ccc Use a lru cache to limit the size of the internal file cache 14f5d0a Updated from global requirements 24752c2 Use hash path lookup vs path finding f1bd24f Remove all 'lock_utils' now that fasteners provides equivalents 4ee5ffd Add a new `ls_r` method 9091a9c Updated from global requirements c3afeb5 Replace lock_utils lock(s) with fasteners package 1e6b991 Updated from global requirements ae6e48f Use shared '_check' function to check engine stages b8da7f7 Remove a couple more useless 'pass' keywords found 16a2c79 Add a test that checks for task result visibility 6b5b9dc Remove testing using persistence sqlalchemy backend with 'mysqldb' 2e0eac0 Remove customized pyX.Y tox requirements 553b6b3 Updated from global requirements c7e8c86 Allow same deps for requires and provides in task b9da5e1 Remove 'pass' usage not needed 712eed5 Only show state transitions to logging when in BLATHER mode e183fc9 Fix updated_at column of sqlalchemy tables 9c4520e Remove script already nuked from oslo-incubator 58f43d2 Ensure path_based abstract base class is included in docs ad5b556 Beef up docs on the logbook/flow detail/atom details models fb2b813 Remove custom py26/py27 tox venvs no longer used 6990fb1 Use newer versions of futures that adds exception tracebacks 5d4dfe0 Ensure empty paths raise a value error 4fc6b61 Remove listener stack and replace with exit stack 24a11aa Expose action engine no reraising states constants 5cfeeb6 Chain a few more exception raises that were previously missed d76bd26 Expose in memory backend split staticmethod 4e550ba Updated from global requirements 98cb841 Remove tox py33 environment no longer used 84c1ad6 Avoid creating temporary removal lists 115bf98 Avoid re-normalizing paths when following links e247e07 Add a profiling context manager that can be easily enabled 562884d Updated from global requirements 73b98de Avoid duplicating exception message 7c3fdcc Small refactoring of 'merge_uri' utility function 530328a Refactor/reduce shared 'ensure(task/retry)' code 22fd32f Just let the future executors handle the max workers Diffstat (except docs and test files) ------------------------------------- README.rst | 4 +- openstack-common.conf | 3 - requirements.txt | 17 +- taskflow/atom.py | 11 - taskflow/conductors/backends/impl_blocking.py | 11 +- taskflow/conductors/base.py | 6 +- taskflow/engines/action_engine/compiler.py | 5 +- taskflow/engines/action_engine/engine.py | 42 +- taskflow/engines/action_engine/executor.py | 9 +- taskflow/engines/action_engine/runner.py | 4 +- taskflow/engines/worker_based/protocol.py | 4 +- taskflow/engines/worker_based/worker.py | 13 +- taskflow/examples/dump_memory_backend.py | 2 +- taskflow/examples/job_board_no_test.py | 171 ------ .../examples/jobboard_produce_consume_colors.py | 9 + taskflow/jobs/backends/impl_zookeeper.py | 6 +- taskflow/jobs/base.py | 2 - taskflow/persistence/backends/impl_dir.py | 29 +- taskflow/persistence/backends/impl_memory.py | 106 +++- taskflow/persistence/backends/impl_zookeeper.py | 8 +- taskflow/persistence/backends/sqlalchemy/tables.py | 6 +- taskflow/persistence/base.py | 17 - taskflow/persistence/logbook.py | 473 +++++++++++---- taskflow/retry.py | 31 +- taskflow/storage.py | 177 +++--- .../unit/persistence/test_memory_persistence.py | 66 ++- taskflow/types/futures.py | 23 +- taskflow/utils/async_utils.py | 9 +- taskflow/utils/lock_utils.py | 517 ----------------- taskflow/utils/misc.py | 80 +-- test-requirements.txt | 16 +- tools/speed_test.py | 87 ++- tox.ini | 37 -- 46 files changed, 1380 insertions(+), 1878 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 8e0c5f3..f85b92d 100644 --- a/requirements.txt +++ b/requirements.txt @@ -6 +6 @@ -pbr>=0.6,!=0.7,<1.0 +pbr>=0.11,<2.0 @@ -18,0 +19,3 @@ enum34 +# For reader/writer + interprocess locks. +fasteners>=0.7 # Apache-2.0 + @@ -21,0 +25,3 @@ networkx>=1.8 +# For contextlib new additions/compatibility for <= python 3.3 +contextlib2>=0.4.0 # PSF License + @@ -23 +29 @@ networkx>=1.8 -stevedore>=1.3.0 # Apache-2.0 +stevedore>=1.5.0 # Apache-2.0 @@ -26 +32 @@ stevedore>=1.3.0 # Apache-2.0 -futures>=2.1.6 +futures>=3.0 @@ -29 +35 @@ futures>=2.1.6 -jsonschema>=2.0.0,<3.0.0 +jsonschema>=2.0.0,<3.0.0,!=2.5.0 @@ -34,0 +41,3 @@ oslo.serialization>=1.4.0 # Apache-2.0 +# For lru caches and such +cachetools>=1.0.0 # MIT License + diff --git a/test-requirements.txt b/test-requirements.txt index a6a7a19..f25f6d4 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -16 +16 @@ zake>=0.1.6 # Apache-2.0 -kazoo>=1.3.1 +kazoo>=1.3.1,!=2.1 @@ -19,9 +19 @@ kazoo>=1.3.1 -# -# NOTE(harlowja): SQLAlchemy isn't listed here currently but is -# listed in our tox.ini files so that we can test multiple varying SQLAlchemy -# versions to ensure a wider range of compatibility. -# -# Explict mysql drivers are also not listed here so that we can test against -# PyMySQL or MySQL-python depending on the python version the tests are being -# ran in (MySQL-python is currently preferred for 2.x environments, since -# it has been used in openstack for the longest). +SQLAlchemy>=0.9.7,<1.1.0 @@ -29,0 +22,4 @@ psycopg2 +PyMySQL>=0.6.2 # MIT License + +# Used for making sure we still work with eventlet. +eventlet>=0.17.3

1 0

[OSSA 2015-011] Cinder host file disclosure through qcow2 backing file (CVE-2015-1850)
by Tristan Cacqueray 16 Jun '15

16 Jun '15

===================================================================== OSSA-2015-011: Cinder host file disclosure through qcow2 backing file ===================================================================== :Date: June 16, 2015 :CVE: CVE-2015-1850 Affects ~~~~~~~ - Cinder: versions through 2014.1.4, and 2014.2 versions through 2014.2.3, and version 2015.1.0 Description ~~~~~~~~~~~ Bastian Blank from credativ reported a vulnerability in Cinder. By overwriting an image with a malicious qcow2 header, an authenticated user may mislead Cinder upload-to-image action, resulting in disclosure of any file from the Cinder server. All Cinder setups are affected. Patches ~~~~~~~ - https://review.openstack.org/191871 (Icehouse) - https://review.openstack.org/191865 (Juno) - https://review.openstack.org/191786 (Kilo) - https://review.openstack.org/191785 (Liberty) Credits ~~~~~~~ - Bastian Blank from Credativ (CVE-2015-1850) References ~~~~~~~~~~ - https://launchpad.net/bugs/1415087 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1850 Notes ~~~~~ - This fix will be included in future 2014.1.5 (icehouse), 2014.2.4 (juno) and 2015.1.1 (kilo) releases. -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[release][openstackclient] python-openstackclient release 1.4.0 (liberty)
by doug＠doughellmann.com 15 Jun '15

15 Jun '15

We are thrilled to announce the release of: python-openstackclient 1.4.0: OpenStack Command-line Client This release is part of the liberty release series. With source available at: https://git.openstack.org/cgit/openstack/python-openstackclient For more details, please see the git log history below and: https://launchpad.net/python-openstackclient/+milestone/1.4.0 Please report issues through launchpad: https://bugs.launchpad.net/python-openstackclient Changes in python-openstackclient 1.3.0..1.4.0 ---------------------------------------------- 9f69b43 Improve the hint message b328960 Fix the typo in `openstackclient/shell.py` ec903a1 Add oidc plugin for listing federation projects aac0d58 Skip trying to set project_domain_id if not using password f3725b4 Updated from global requirements 18991ab Updated from global requirements 1f1ed4c Imported Translations from Transifex 4afd308 Include links to developer workflow documentation f7feef7 Enable specifying domain for group and role commands 7cf7790 Not use the deprecated argument b808566 Create 1.4.0 release notes 43d12db Updated from global requirements 31d785e Allow --insecure to override --os-cacert 3fa0bbc Clean up ec2 credentials help text 8d185a6 Add functional tests for volume set and unset 7665d52 Add domain support for ec2creds in v3 identity 15d3717 Add EC2 support for identity v3 API db7d4eb Imported Translations from Transifex bf99218 Add a reference to the IRC channels 226fc6c Change Credentials header to Blob from data f737160 Get rid of oslo_i18n deprecation notice b2cf651 Fix security group list command a05cbf4 Rework shell tests 746f642 Add image functional tests f9fa307 Add volume functional tests 0c9f5c2 Ignore cover directory from git 3ae247f Set tenant options on parsed namespace 5361652 Add support for volume v2 API d14316a add domain scope arguments to v3 role add in doc 01573be project create is missing --parent in doc 542f587 add --domain argument to v3 project set 224d375 Add --wait to server delete ae29f7f Use ostestr for test runs 2c4b878 Add cli tests for --verify and friends da083d1 Small tweaks to osc plugin docs 211c14c Fix shell tests Diffstat (except docs and test files) ------------------------------------- .gitignore | 1 + README.rst | 5 + examples/object_api.py | 4 +- examples/osc-lib.py | 4 +- functional/common/test.py | 2 +- openstackclient/api/auth.py | 10 +- openstackclient/common/clientmanager.py | 4 + openstackclient/common/utils.py | 46 ++ openstackclient/compute/v2/security_group.py | 2 +- openstackclient/compute/v2/server.py | 17 + openstackclient/i18n.py | 4 +- openstackclient/identity/common.py | 16 +- openstackclient/identity/v2_0/ec2creds.py | 18 +- openstackclient/identity/v3/credential.py | 5 +- openstackclient/identity/v3/ec2creds.py | 251 +++++++ openstackclient/identity/v3/group.py | 116 ++- openstackclient/identity/v3/project.py | 8 + openstackclient/identity/v3/role.py | 321 +++------ openstackclient/identity/v3/unscoped_saml.py | 2 +- openstackclient/identity/v3/user.py | 2 +- openstackclient/shell.py | 50 +- openstackclient/volume/client.py | 3 +- openstackclient/volume/v2/__init__.py | 0 openstackclient/volume/v2/backup.py | 70 ++ openstackclient/volume/v2/snapshot.py | 71 ++ openstackclient/volume/v2/volume.py | 83 +++ openstackclient/volume/v2/volume_type.py | 68 ++ .../de/LC_MESSAGES/python-openstackclient.po | 783 +++++++++++---------- .../locale/python-openstackclient.pot | 208 +++--- .../zh_TW/LC_MESSAGES/python-openstackclient.po | 687 +++++++++--------- requirements.txt | 8 +- setup.cfg | 18 + test-requirements.txt | 1 + tox.ini | 4 +- 60 files changed, 2907 insertions(+), 1337 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 415d27a..d420b1a 100644 --- a/requirements.txt +++ b/requirements.txt @@ -10 +10 @@ cliff-tablib>=1.0 -os-client-config +os-client-config>=1.2.0 @@ -14,2 +14,2 @@ oslo.utils>=1.4.0 # Apache-2.0 -python-glanceclient>=0.17.1 -python-keystoneclient>=1.3.0 +python-glanceclient>=0.18.0 +python-keystoneclient>=1.6.0 @@ -20 +20 @@ requests>=2.5.2 -stevedore>=1.3.0 # Apache-2.0 +stevedore>=1.5.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index 24f5c68..f82e48d 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -13,0 +14 @@ sphinx>=1.1.2,!=1.2.0,!=1.3b1,<1.3 +os-testr>=0.1.0

1 0

OpenStack Community Weekly Newsletter (June 5 - 12)
by Stefano Maffulli 12 Jun '15

12 Jun '15

1 0

[OSSA 2015-010] XSS in Horizon Heat stack creation (CVE-2015-3219)
by Tristan Cacqueray 10 Jun '15

10 Jun '15

================================================= OSSA-2015-010: XSS in Horizon Heat stack creation ================================================= :Date: June 09, 2015 :CVE: CVE-2015-3219 Affects ~~~~~~~ - Horizon: 2014.2 versions through 2014.2.3 and version 2015.1.0 Description ~~~~~~~~~~~ Nikita Konovalov from Mirantis reported a vulnerability in Horizon. By tricking a Horizon user into using a malicious template in the Orchestration/Stack section of Horizon, a remote attacker may trigger a cross-site-scripting vulnerability during the stack creation. It may result in potential assets theft like user access credentials. Only setups exposing the orchestration dashboard in Horizon are affected. Patches ~~~~~~~ - https://review.openstack.org/189821 (Juno) - https://review.openstack.org/189822 (Kilo) - https://review.openstack.org/189820 (Liberty) Credits ~~~~~~~ - Nikita Konovalov from Mirantis (CVE-2015-3219) References ~~~~~~~~~~ - https://launchpad.net/bugs/1453074 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3219 Notes ~~~~~ - This fix will be included in future 2014.2.4 (juno) and 2015.1.1 (kilo) releases. -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (May 29 - June 5)
by Stefano Maffulli 06 Jun '15

06 Jun '15

1 0