- OpenStack-announce - lists.openstack.org

[OSSA 2014-030] TLS cert verification option not honoured in paste configs (CVE-2014-7144)
by Grant Murphy 25 Sep '14

25 Sep '14

OpenStack Security Advisory: 2014-030 CVE: CVE-2014-7144 Date: September 25, 2014 Title: TLS cert verification option not honoured in paste configs Reporter: Qin Zhao (IBM) Products: keystonemiddleware, python-keystoneclient Versions: versions up to 1.1.1 (keystonemiddleware), versions up to 0.10.1 (python-keystoneclient) Description: Qin Zhao from IBM reported a vulnerability in keystonemiddleware (formerly shipped as python-keystoneclient). When the 'insecure' option is set in a paste configuration file it is effectively ignored, regardless of its value. As a result certificate verification will be disabled, leaving TLS connections open to MITM attacks. All versions of keystonemiddleware with TLS settings configured via a paste.ini file are affected by this flaw. keystonemiddleware fix: https://review.openstack.org/113191 python-keystoneclient fix: https://review.openstack.org/112232 Notes: These fixes are included in the keystonemiddleware 1.2.0 release and in the python-keystoneclient 0.11.0 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7144 https://launchpad.net/bugs/1353315 -- Grant Murphy OpenStack Vulnerability Management Team

1 0

[OpenStack][keystonemiddleware] Release of keystonemiddleware 1.2.0
by Morgan Fainberg 25 Sep '14

25 Sep '14

The Keystone development community would like to announce the release of keystonemiddleware 1.2.0. This release can be installed from the following locations: * http://tarballs.openstack.org/keystonemiddleware * https://pypi.python.org/pypi/keystonemiddleware 1.2.0 features -------------- * Added support for service tokens in conjunction with the user auth-tokens Detailed changes in this release: https://launchpad.net/keystonemiddleware/+milestone/1.2.0

1 0

[OpenStack][python-keystoneclient] Release of python-keystoneclient 0.11.1
by Morgan Fainberg 23 Sep '14

23 Sep '14

The Keystone development community would like to announce the release of python-keystoneclient 0.11.1. The 0.11.1 version includes two fixes on top of the 0.11.0 release. This release can be installed from the following locations: * http://tarballs.openstack.org/python-keystoneclient * https://pypi.python.org/pypi/python-keystoneclient 0.11.x ------ * Added an authentication plugin to support ECP SAML2 workflow * Added support for Active Directory Federated Services (ADFS) SAML2 authentication workflow Detailed changes in this release: https://launchpad.net/python-keystoneclient/+milestone/0.11.0 https://launchpad.net/python-keystoneclient/+milestone/0.11.1

1 0

OpenStack 2013.2.4 released
by Alan Pevec 23 Sep '14

23 Sep '14

Hello everyone, The OpenStack Stable Maintenance team is happy to announce the release of the 2013.2.4 stable Havana. We have been busy reviewing and accepting backported bugfixes to the stable/havana branches according to the criteria set at: https://wiki.openstack.org/wiki/StableBranch A total of 180 bugs have been fixed across all projects since 2013.2.3. These updates to Havana are intended to be low risk with no intentional regressions or API changes. The list of bugs, tarballs and other milestone information for each project may be found on Launchpad: https://launchpad.net/cinder/havana/2013.2.4 https://launchpad.net/glance/havana/2013.2.4 https://launchpad.net/horizon/havana/2013.2.4 https://launchpad.net/keystone/havana/2013.2.4 https://launchpad.net/nova/havana/2013.2.4 https://launchpad.net/neutron/havana/2013.2.4 https://launchpad.net/ceilometer/havana/2013.2.4 https://launchpad.net/heat/havana/2013.2.4 Release notes may be found on the wiki: https://wiki.openstack.org/wiki/ReleaseNotes/2013.2.4 No further official Havana releases are planned. Thanks, Alan

1 0

OpenStack Community Weekly Newsletter (Sep 12 – 19)
by Stefano Maffulli 19 Sep '14

19 Sep '14

1 0

python-heatclient 0.2.11 released
by Steve Baker 19 Sep '14

19 Sep '14

The heat development community would like to announce the release of python-heatclient version 0.2.11. python-heatclient is a client library for Heat built on the Heat orchestration API. It provides a Python API (the heatclient module) and a command-line tool (heat). This release can be installed from the following locations: http://tarballs.openstack.org/python-heatclient https://pypi.python.org/pypi/python-heatclient Changes in this release: https://launchpad.net/python-heatclient/+milestone/v0.2.11

1 0

[OSSA 2014-029] Configuration option leak through Keystone catalog (CVE-2014-3621)
by Tristan Cacqueray 16 Sep '14

16 Sep '14

OpenStack Security Advisory: 2014-029 CVE: CVE-2014-3621 Date: September 16, 2014 Title: Configuration option leak through Keystone catalog Reporter: Brant Knudson (IBM) Products: Keystone Versions: up to 2013.2.3 and 2014.1 versions up to 2014.1.2.1 Description: Brant Knudson from IBM reported a vulnerability in Keystone catalog url replacement. By creating a malicious endpoint a privileged user may reveal configuration options resulting in sensitive information, like master admin_token, being exposed through the service url. All Keystone setups that allow non-admin users to create endpoints are affected. Juno (development branch) fix: https://review.openstack.org/121889 Icehouse fix: https://review.openstack.org/121890 Havana fix: https://review.openstack.org/121891 Notes: This fix will be included in the Juno release 2014.2.0 and in future stable 2013.2.4 and 2014.1.3 releases. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3621 https://launchpad.net/bugs/1354208 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OpenStack] [python-cinderclient] Release of python-cinderclient 1.1.0
by John Griffith 13 Sep '14

13 Sep '14

Hello, I'd like to announce the release of python-cinderclient 1.1.0. A brief summary of the changes are included below. Thanks, John 1.1.0 ------ * Add support for ConsistencyGroups * Use Adapter from keystoneclient * Add support for Replication feature * Add pagination for Volume List .. _1325773 http://bugs.launchpad.net/python-cinderclient/+bug/1325773 .. _1333257 http://bugs.launchpad.net/python-cinderclient/+bug/1333257 .. _1268480 http://bugs.launchpad.net/python-cinderclient/+bug/1268480 .. _1275025 http://bugs.launchpad.net/python-cinderclient/+bug/1275025 .. _1258489 http://bugs.launchpad.net/python-cinderclient/+bug/1258489 .. _1241682 http://bugs.launchpad.net/python-cinderclient/+bug/1241682 .. _1203471 http://bugs.launchpad.net/python-cinderclient/+bug/1203471 .. _1210874 http://bugs.launchpad.net/python-cinderclient/+bug/1210874 .. _1200214 http://bugs.launchpad.net/python-cinderclient/+bug/1200214 .. _1130572 http://bugs.launchpad.net/python-cinderclient/+bug/1130572 .. _1156994 http://bugs.launchpad.net/python-cinderclient/+bug/1156994 ** Note Connection refused --> Connection error commit: c9e7818f3f90ce761ad8ccd09181c705880a4266 ** Note Mask Passwords in log output commit: 80582f2b860b2dadef7ae07bdbd8395bf03848b1

1 0

OpenStack Community Weekly Newsletter (Sep 5 – 12)
by Stefano Maffulli 12 Sep '14

12 Sep '14

1 0

OpenStack Community Weekly Newsletter (Aug 29 – Sep 5)
by Stefano Maffulli 05 Sep '14

05 Sep '14

1 0