- OpenStack-announce - lists.openstack.org

[OSSA 2016-007.2] Nova host data leak through resize/migration (CVE-2016-2140) ERRATA #2
by Tristan Cacqueray 30 Mar '16

30 Mar '16

============================================================= OSSA-2016-007.2: Nova host data leak through resize/migration ============================================================= :Date: March 08, 2016 :CVE: CVE-2016-2140 Affects ~~~~~~~ - Nova: <=2015.1.3, >=12.0.0 <=12.0.2 Description ~~~~~~~~~~~ Matthew Booth from Red Hat reported a vulnerability in Nova instance resize/migration. By overwriting an ephemeral or root disk with a malicious image before requesting a resize, an authenticated user may be able to read arbitrary files from the compute host. Only setups using libvirt driver with raw storage and setting "use_cow_images = False" (not default) are affected. Errata ~~~~~~ The former fix did not take into account the usage of non-disk-image backends and caused a regression for this use-case. This update provides an additional fix for that issue. Moreover, the kilo backport caused a regression in live migration where the disk info file is JSON encoded. This second update provides an additional fix for stable/kilo. Patches ~~~~~~~ - https://review.openstack.org/289960 - original (Kilo) - https://review.openstack.org/290847 - errata (Kilo) - https://review.openstack.org/294205 - errata#2 (Kilo) - https://review.openstack.org/289958 - original (Liberty) - https://review.openstack.org/290843 - errata (Liberty) - https://review.openstack.org/289957 - original (Mitaka) - https://review.openstack.org/290715 - errata (Mitaka) Credits ~~~~~~~ - Matthew Booth from Red Hat (CVE-2016-2140) References ~~~~~~~~~~ - https://bugs.launchpad.net/bugs/1548450 - https://bugs.launchpad.net/bugs/1555287 - https://bugs.launchpad.net/bugs/1558697 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2140 Notes ~~~~~ - This fix will be included in future 2015.1.4 (kilo) and 12.0.3 (liberty) releases. OSSA History ~~~~~~~~~~~~ - 2016-03-30 - Errata 2 - 2016-03-09 - Errata 1 - 2016-03-08 - Original Version -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[release][stable][sahara] python-saharaclient 0.14.0 release (mitaka)
by no-reply＠openstack.org 30 Mar '16

30 Mar '16

We are delighted to announce the release of: python-saharaclient 0.14.0: Client library for Sahara API This release is part of the mitaka stable release series. With source available at: https://git.openstack.org/cgit/openstack/python-saharaclient Please report issues through launchpad: https://bugs.launchpad.net/python-saharaclient For more details, please see below. Changes in python-saharaclient 0.13.0..0.14.0 --------------------------------------------- ac9868e Updated from global requirements f1dd01f Update .gitreview for stable/mitaka Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + requirements.txt | 2 +- test-requirements.txt | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 1b0f282..5eefe56 100644 --- a/requirements.txt +++ b/requirements.txt @@ -8 +8 @@ Babel>=1.3 # BSD -cliff!=1.16.0,>=1.15.0 # Apache-2.0 +cliff!=1.16.0,!=1.17.0,>=1.15.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index a9c5ba3..33b2db0 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -14 +14 @@ os-testr>=0.4.1 # Apache-2.0 -python-neutronclient>=2.6.0 # Apache-2.0 +python-neutronclient!=4.1.0,>=2.6.0 # Apache-2.0

1 0

[release][searchlight] python-searchlightclient 0.2.1 release (mitaka)
by no-reply＠openstack.org 30 Mar '16

30 Mar '16

We are thrilled to announce the release of: python-searchlightclient 0.2.1: OpenStack Indexing and Search API Client Library This release is part of the mitaka release series. With source available at: http://git.openstack.org/cgit/openstack/python-searchlightclient Please report issues through launchpad: http://bugs.launchpad.net/python-searchlightclient For more details, please see below. Changes in python-searchlightclient 0.2.0..0.2.1 ------------------------------------------------ 9a9b32c Updated from global requirements 538a396 Update README Diffstat (except docs and test files) ------------------------------------- README.rst | 41 ++++++++++++++++++++++++++++++++++++----- requirements.txt | 2 +- 2 files changed, 37 insertions(+), 6 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index ac73512..c463ee5 100644 --- a/requirements.txt +++ b/requirements.txt @@ -7 +7 @@ pbr>=1.6 # Apache-2.0 -cliff!=1.16.0,>=1.15.0 # Apache-2.0 +cliff!=1.16.0,!=1.17.0,>=1.15.0 # Apache-2.0

1 0

[release][stable][openstack] python-openstackclient 2.3.0 release (mitaka)
by no-reply＠openstack.org 29 Mar '16

29 Mar '16

We are pleased to announce the release of: python-openstackclient 2.3.0: OpenStack Command-line Client This release is part of the mitaka stable release series. With source available at: https://git.openstack.org/cgit/openstack/python-openstackclient With package available at: https://pypi.python.org/pypi/python-openstackclient Please report issues through launchpad: https://bugs.launchpad.net/python-openstackclient For more details, please see below. Changes in python-openstackclient 2.2.0..2.3.0 ---------------------------------------------- a0261f8 Updated from global requirements 5125219 Update .gitreview for stable/mitaka Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + requirements.txt | 6 +++--- test-requirements.txt | 2 +- 3 files changed, 5 insertions(+), 4 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 7c01b7c..7349d9f 100644 --- a/requirements.txt +++ b/requirements.txt @@ -8 +8 @@ Babel>=1.3 # BSD -cliff!=1.16.0,>=1.15.0 # Apache-2.0 +cliff!=1.16.0,!=1.17.0,>=1.15.0 # Apache-2.0 @@ -10 +10 @@ keystoneauth1>=2.1.0 # Apache-2.0 -openstacksdk>=0.7.4 # Apache-2.0 +openstacksdk>=0.8.1 # Apache-2.0 @@ -15 +15 @@ oslo.utils>=3.5.0 # Apache-2.0 -python-glanceclient>=1.2.0 # Apache-2.0 +python-glanceclient>=2.0.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index 5db2336..20a2d5a 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -23 +23 @@ python-barbicanclient>=3.3.0 # Apache-2.0 -python-congressclient>=1.0.0 # Apache-2.0 +python-congressclient<2000,>=1.0.0 # Apache-2.0

1 0

[release][stable][ironic] ironic 4.2.3 release (liberty)
by no-reply＠openstack.org 29 Mar '16

29 Mar '16

We are happy to announce the release of: ironic 4.2.3: OpenStack Bare Metal Provisioning This release is part of the liberty stable release series. With source available at: http://git.openstack.org/cgit/openstack/ironic Please report issues through launchpad: http://bugs.launchpad.net/ironic For more details, please see below. 4.2.3 ^^^^^ Upgrade Notes ************* * Updated python-scciclient required version number for iRMC driver to 0.3.0 which fixed the bug '#1518999' and '#1519000'. Bug Fixes ********* * Make boot.ipxe fallback to its previous behavior on *really* old iPXE ROMs where 'inc' command is not available at all, see https://launchpad.net/bugs/1507738. * Disables default execution of clean step 'reset_ilo' during automated cleaning. Resetting of iLO is not required during every invocation of automated cleaning. If required, operator can enable the same. * Add missing "lookup" method to the pxe_drac driver vendor interface enabling it to be deployed using the IPA ramdisk. * Fixes an issue with the provided iPXE template where whole disk images could not be booted. See https://bugs.launchpad.net/ironic/+bug/1524403. * Fixes issue where automated cleaning fails for iLO drivers. Automated cleaning fails for iLO driver if iLO is in System POST state. iLO does not allow setting of boot device when it is in System POST state. * Updated python-scciclient required version number for iRMC driver to 0.3.0 which fixed the bug '#1518999' and '#1519000'. Changes in ironic 4.2.2..4.2.3 ------------------------------ e9f49ad Fix unittests after new release of glanceclient 4ab1231 Fixes automated cleaning failure in iLO drivers e057831 Disable clean step 'reset_ilo' for iLO drivers by default 956e7b7 Tolerate roles in context.RequestContext 031d4f1 Fix iPXE template for whole disk image 5b7dff9 cautiously fail on unhandled heartbeat exception 16bf69c Fix missing lookup() vendor method error for pxe_drac 5b3e1a3 Imported Translations from Zanata 9877f12 Fix: Next cleaning hangs if the previous cleaning was aborted 03904c6 Fix a bug error by passwords only includes numbers 080bbd7 Updated from global requirements 49229d6 Explicitly depend on WebTest>=2.0 952c069 Updated from global requirements 35c7f81 iPXE: Fix assumption that ${mac} is the MAC of the NIC it's booting fcc01c1 Update python-scciclient version number 49baa2c take_over() for iscsi_ilo doesnt recreate boot iso fb00de6 Change required version of ImcSdk to 0.7.2 Diffstat (except docs and test files) ------------------------------------- driver-requirements.txt | 6 +- etc/ironic/ironic.conf.sample | 2 +- ironic/common/context.py | 14 ++-- ironic/conductor/manager.py | 1 + ironic/drivers/drac.py | 4 +- ironic/drivers/modules/agent_base_vendor.py | 2 +- ironic/drivers/modules/boot.ipxe | 22 +++++-- ironic/drivers/modules/ilo/deploy.py | 12 +++- ironic/drivers/modules/ilo/management.py | 2 +- ironic/drivers/modules/ipmitool.py | 2 +- ironic/drivers/modules/ipxe_config.template | 4 +- .../locale/fr/LC_MESSAGES/ironic-log-critical.po | 14 ++-- .../locale/ja/LC_MESSAGES/ironic-log-critical.po | 14 ++-- ironic/locale/ja/LC_MESSAGES/ironic.po | 40 +++++++++--- .../ko_KR/LC_MESSAGES/ironic-log-critical.po | 14 ++-- .../pt_BR/LC_MESSAGES/ironic-log-critical.po | 14 ++-- .../boot-ipxe-inc-workaround-548e10d1d6616752.yaml | 5 ++ ...able-clean-step-reset-ilo-1869a6e08f39901c.yaml | 6 ++ .../drac-missing-lookup-3ad98e918e1a852a.yaml | 4 ++ ...late-for-whole-disk-image-943da0311ca7aeb5.yaml | 4 ++ ...-automated-cleaning-fails-14ee438de3dd8690.yaml | 7 ++ ...ciclient-required-version-71398d5d5e1c0bf8.yaml | 7 ++ requirements.txt | 10 +-- test-requirements.txt | 3 +- 32 files changed, 295 insertions(+), 81 deletions(-) Requirements updates -------------------- diff --git a/driver-requirements.txt b/driver-requirements.txt index c828bff..ad581c4 100644 --- a/driver-requirements.txt +++ b/driver-requirements.txt @@ -11 +11 @@ python-ironic-inspector-client -python-scciclient>=0.2.0 +python-scciclient>=0.3.0 @@ -30,2 +30,2 @@ pyremotevbox>=0.5.0 -# The CIMC drivers use the Cisco IMC SDK version 0.7.1, which is available from -# https://communities.cisco.com/docs/DOC-37174 +# The CIMC drivers use the Cisco IMC SDK version 0.7.2, which is available from +# https://communities.cisco.com/docs/DOC-56257 diff --git a/requirements.txt b/requirements.txt index 0d6cde8..e7fb3a3 100644 --- a/requirements.txt +++ b/requirements.txt @@ -17 +17 @@ python-glanceclient>=0.18.0 -python-keystoneclient>=1.6.0 +python-keystoneclient!=1.8.0,>=1.6.0 @@ -30 +30 @@ oslo.log>=1.8.0 # Apache-2.0 -oslo.middleware>=2.8.0 # Apache-2.0 +oslo.middleware!=3.0.0,!=3.1.0,!=3.2.0,>=2.8.0 # Apache-2.0 @@ -36 +36 @@ pecan>=1.0.0 -requests!=2.8.0,>=2.5.2 +requests!=2.8.0,!=2.9.0,>=2.5.2 @@ -41,2 +41,2 @@ Jinja2>=2.6 # BSD License (3 clause) -keystonemiddleware>=2.0.0 -oslo.messaging!=1.17.0,!=1.17.1,!=2.6.0,!=2.6.1,>=1.16.0 # Apache-2.0 +keystonemiddleware!=2.4.0,>=2.0.0 +oslo.messaging!=1.17.0,!=1.17.1,!=2.6.0,!=2.6.1,!=2.7.0,!=2.8.0,!=2.8.1,!=2.9.0,!=3.1.0,>=1.16.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index 412a907..fdb824b 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -17,0 +18 @@ testscenarios>=0.4 +WebTest>=2.0 @@ -27 +28 @@ oslosphinx>=2.5.0 # Apache-2.0 -reno[sphinx]>=0.1.1 # Apache2 +reno>=0.1.1 # Apache2

1 0

[release][stable][neutron] neutron-lbaas 7.0.4 release (liberty)
by no-reply＠openstack.org 29 Mar '16

29 Mar '16

We are satisfied to announce the release of: neutron-lbaas 7.0.4: OpenStack Networking Load Balancing as a Service This release is part of the liberty stable release series. For more details, please see below. Changes in neutron-lbaas 7.0.3..7.0.4 ------------------------------------- 94ffa50 Update devstack plugin for dependent packages 3e97f6f Set netscaler_ncc_password as secret to prevent it from being logged 58e78d5 Neutron LBaaS leaking admin_password into logs a0646b7 Adding "region and endpoint_type" parameters to barbican_cert_manager.py af19f54 [LBaaS v2] Validate name, description and tenant_id attributes length Diffstat (except docs and test files) ------------------------------------- devstack/plugin.sh | 1 + .../common/cert_manager/barbican_cert_manager.py | 4 +- neutron_lbaas/common/keystone.py | 6 +++ .../drivers/netscaler/netscaler_driver_v2.py | 1 + neutron_lbaas/extensions/loadbalancerv2.py | 27 +++++++----- .../tempest/v2/api/test_health_monitor_admin.py | 17 +++----- .../tempest/v2/api/test_listeners_non_admin.py | 5 --- .../tempest/v2/api/test_load_balancers_admin.py | 14 +++--- .../v2/api/test_load_balancers_non_admin.py | 5 --- 13 files changed, 89 insertions(+), 81 deletions(-)

1 0

[release][stable][neutron] neutron-vpnaas 7.0.4 release (liberty)
by no-reply＠openstack.org 29 Mar '16

29 Mar '16

We are jubilant to announce the release of: neutron-vpnaas 7.0.4: OpenStack Networking VPN as a Service This release is part of the liberty stable release series. For more details, please see below. Changes in neutron-vpnaas 7.0.3..7.0.4 -------------------------------------- e32f350 Add an explicit BRANCH_NAME to tox_install.sh Diffstat (except docs and test files) ------------------------------------- tools/tox_install.sh | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)

1 0

[release][stable][neutron] neutron 7.0.4 release (liberty)
by no-reply＠openstack.org 29 Mar '16

29 Mar '16

We are tickled pink to announce the release of: neutron 7.0.4: OpenStack Networking This release is part of the liberty stable release series. For more details, please see below. 7.0.4 ^^^^^ ML2: ports can now recover from binding failed state. New Features ************ * Ports that failed to bind when an L2 agent was offline can now recover after the agent is back online. Changes in neutron 7.0.3..7.0.4 ------------------------------- 2be884a Add option for nova endpoint type e61a77c Update devstack plugin for dependent packages e4f590d De-dup conntrack deletions before running them fe0a1ca Unmarshall portinfo on update_fdb_entries calls d37288b Avoid DuplicateOptError in functional tests 2601fe0 Retry port create/update on duplicate db records 82cb3c2 Catch PortNotFound after HA router race condition 4ad1834 Documenting network_device_mtu in agents config files 249470f Make all tox targets constrained e2ca10e Filter HA routers without HA interface and state 1382da4 Correct return values for bridge sysctl calls 1f92511 Add tests for RPC methods/classes 2b4838e Fix sanity check --no* BoolOpts 67ab873 Add extension requirement in port-security api test 9e11c5b Fix for adding gateway with IP outside subnet f860bdd Add the rebinding chance in _bind_port_if_needed e573352 DHCP: release DHCP port if not enough memory a381aa0 Disable IPv6 on bridge devices in LinuxBridgeManager e93c5dc ML2: delete_port on deadlock during binding 9cb6591 Postpone heavy policy check for ports to later 4bb3640 Static routes not added to qrouter namespace for DVR a3341b2 Make add_tap_interface resillient to removal 3c9b2aa Fix bug when enable configuration named dnsmasq_base_log_dir 306636e Wait for the watch process in test case 13917bf Trigger dhcp port_update for new auto_address subnets c83b04d Add generated port id to port dict e642808 Protect 'show' and 'index' with Retry decorator 7326b47 Add unit test cases for linuxbridge agent when prevent_arp_spoofing is True e466b50 Rule, member updates are missed with enhanced rpc cda82a1 Remove 'validate' key in 'type:dict_or_nodata' type 819278c dhcp: handle advertise_mtu=True when plugin does not set mtu values Diffstat (except docs and test files) ------------------------------------- etc/dhcp_agent.ini | 3 + etc/l3_agent.ini | 3 + etc/neutron.conf | 4 + etc/policy.json | 24 +- neutron/agent/l3/dvr_edge_router.py | 24 +- neutron/agent/l3/dvr_fip_ns.py | 5 + neutron/agent/l3/ha_router.py | 5 +- neutron/agent/l3/router_info.py | 32 ++- neutron/agent/linux/bridge_lib.py | 35 +++ neutron/agent/linux/dhcp.py | 56 ++++- neutron/agent/linux/interface.py | 3 +- neutron/agent/linux/ip_conntrack.py | 6 +- neutron/agent/securitygroups_rpc.py | 10 +- neutron/api/v2/base.py | 2 + neutron/cmd/sanity_check.py | 32 +-- neutron/common/config.py | 6 + neutron/db/api.py | 12 + neutron/db/db_base_plugin_v2.py | 19 +- neutron/db/ipam_non_pluggable_backend.py | 3 + neutron/db/ipam_pluggable_backend.py | 16 +- neutron/db/l3_hamode_db.py | 7 +- neutron/extensions/l3_ext_gw_mode.py | 2 +- neutron/ipam/utils.py | 15 ++ neutron/notifiers/nova.py | 1 + .../drivers/l2pop/rpc_manager/l2population_rpc.py | 17 ++ .../linuxbridge/agent/linuxbridge_neutron_agent.py | 18 ++ neutron/plugins/ml2/plugin.py | 149 +++++++----- .../test_extension_driver_port_security_admin.py | 1 + .../api/test_extension_driver_port_security.py | 2 + .../agent/l3/test_keepalived_state_change.py | 4 +- .../plugins/ml2/drivers/l2pop/test_mech_driver.py | 22 ++ .../agent/test_linuxbridge_neutron_agent.py | 72 ++++++ .../unit/plugins/ml2/drivers/mechanism_test.py | 10 +- ...add-port-rebinding-chance-33178b9abacf5804.yaml | 6 + tools/configure_for_func_testing.sh | 4 + tox.ini | 34 +-- 61 files changed, 1685 insertions(+), 349 deletions(-)

1 0

[release][stable][ironic] ironic-ui 1.1.1 release (mitaka)
by no-reply＠openstack.org 29 Mar '16

29 Mar '16

We are delighted to announce the release of: ironic-ui 1.1.1: Ironic plugin UI for Horizon to allow users to view and manage bare metal nodes, ports and drivers. This release is part of the mitaka stable release series. With source available at: http://git.openstack.org/cgit/openstack/ironic-ui With package available at: https://pypi.python.org/pypi/ironic-ui Please report issues through launchpad: http://bugs.launchpad.net/ironic-ui For more details, please see below. Changes in ironic-ui 1.1.0..1.1.1 --------------------------------- bc7e437 Remove python-ironicclient from setup_requires e84b866 Update .gitreview for stable/mitaka Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + setup.py | 3 +-- 2 files changed, 2 insertions(+), 2 deletions(-)

1 0

[release][stable][heat] python-heatclient 1.1.0 release (mitaka)
by no-reply＠openstack.org 29 Mar '16

29 Mar '16

We are pumped to announce the release of: python-heatclient 1.1.0: OpenStack Orchestration API Client Library This release is part of the mitaka stable release series. With source available at: https://git.openstack.org/cgit/openstack/python-heatclient With package available at: https://pypi.python.org/pypi/python-heatclient Please report issues through launchpad: https://bugs.launchpad.net/python-heatclient For more details, please see below. Changes in python-heatclient 1.0.0..1.1.0 ----------------------------------------- 9f7b9a5 Updated from global requirements 4d253e7 Fix regression handling relative paths in environment 55472bd Update .gitreview for stable/mitaka Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + heatclient/common/template_utils.py | 6 ++-- requirements.txt | 2 +- 4 files changed, 47 insertions(+), 4 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 1534a96..292d9be 100644 --- a/requirements.txt +++ b/requirements.txt @@ -7 +7 @@ pbr>=1.6 # Apache-2.0 -cliff!=1.16.0,>=1.15.0 # Apache-2.0 +cliff!=1.16.0,!=1.17.0,>=1.15.0 # Apache-2.0

1 0