- OpenStack-announce - lists.openstack.org

[release][ironic] python-ironic-inspector-client release 1.4.0 (mitaka)
by doug＠doughellmann.com 25 Jan '16

25 Jan '16

We are content to announce the release of: python-ironic-inspector-client 1.4.0: Python client for Ironic Inspector This release is part of the mitaka release series. With source available at: http://git.openstack.org/cgit/openstack/python-ironic-inspector- client With package available at: https://pypi.python.org/pypi/python-ironic-inspector-client Please report issues through launchpad: http://bugs.launchpad.net/python-ironic-inspector-client For more details, please see below. 1.4.0 ^^^^^ New Features * Added "introspection data save" command to retrieve stored introspection data for the node. Changes in python-ironic-inspector-client 1.3.0..1.4.0 ------------------------------------------------------ 62ef4eb Updated from global requirements 84ca803 Implement 'introspection data save' command ac5952a Stop relying on deprecated and removed support for maintenance mode in tests 0eac673 Put py34 first in the env order of tox de24821 Removes MANIFEST.in as it is not needed explicitely by PBR f7e7d5c Updated from global requirements ca495d0 Updated from global requirements 8461549 Updated from global requirements ba85623 Fixed links to the new ironic-inspector documentation Diffstat (except docs and test files) ------------------------------------- MANIFEST.in | 5 ---- README.rst | 17 +++++++---- ironic_inspector_client/shell.py | 23 ++++++++++++++ ironic_inspector_client/test/functional.py | 2 +- ironic_inspector_client/test/test_shell.py | 35 ++++++++++++++++++++++ releasenotes/notes/data-save-9d9d4b3ac7c9851f.yaml | 4 +++ requirements.txt | 10 +++---- setup.cfg | 1 + test-requirements.txt | 8 ++--- tox.ini | 2 +- 10 files changed, 85 insertions(+), 22 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 00d309a..4c5a5b6 100644 --- a/requirements.txt +++ b/requirements.txt @@ -6,5 +6,5 @@ oslo.i18n>=1.5.0 # Apache-2.0 -oslo.utils>=2.8.0 # Apache-2.0 -pbr>=1.6 -python-openstackclient>=1.5.0 -requests>=2.8.1 -six>=1.9.0 +oslo.utils>=3.4.0 # Apache-2.0 +pbr>=1.6 # Apache-2.0 +python-openstackclient>=2.0.0 # Apache-2.0 +requests!=2.9.0,>=2.8.1 # Apache-2.0 +six>=1.9.0 # MIT diff --git a/test-requirements.txt b/test-requirements.txt index 195b582..7d9e3a1 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -4 +4 @@ -coverage>=3.6 +coverage>=3.6 # Apache-2.0 @@ -6 +6 @@ doc8 # Apache-2.0 -fixtures>=1.3.1 +fixtures>=1.3.1 # Apache-2.0/BSD @@ -8,2 +8,2 @@ hacking<0.11,>=0.10.0 -mock>=1.2 -sphinx!=1.2.0,!=1.3b1,<1.3,>=1.1.2 +mock>=1.2 # BSD +sphinx!=1.2.0,!=1.3b1,<1.3,>=1.1.2 # BSD

1 0

[release][stable][telemetry] ceilometer release 5.0.2 (liberty)
by doug＠doughellmann.com 25 Jan '16

25 Jan '16

We are tickled pink to announce the release of: ceilometer 5.0.2: OpenStack Telemetry This release is part of the liberty stable release series. With package available at: https://pypi.python.org/pypi/ceilometer For more details, please see below. 5.0.2 ^^^^^ Critical Issues *************** * [bug 1519767 (https://bugs.launchpad.net/ceilometer/+bug/1519767)] fnmatch functionality in python <= 2.7.9 is not threadsafe. this issue and its potential race conditions are now patched. Bug Fixes ********* * [bug 1531626 (https://bugs.launchpad.net/ceilometer/+bug/1531626)] Ensure aggregator transformer timeout is honoured if size is not provided. Changes in ceilometer 5.0.1..5.0.2 ---------------------------------- 278c484 fix unknown gnocchi db in liberty gate 3b35c40 add ceilometer 5.0.2 release notes 5d18618 Fix snmp pollster to not ignore valid meters fd54d10 Changes aggregator transformer to allow retention_time w/o size cd2065d oslo.messaging option group/name change for notification topics 9aeb38a Updated from global requirements 4b66eee fix functional gate e253e7e gnocchi: remove possible ending / in URL 4f67ed8 Move the content of ReleaseNotes to README.rst 40c5cee don't pass ceilometer options to oslo.db engine facade Diffstat (except docs and test files) ------------------------------------- README.rst | 7 +- ReleaseNotes | 11 --- ceilometer/agent/plugin_base.py | 6 ++ ceilometer/alarm/storage/impl_sqlalchemy.py | 4 + ceilometer/compute/notifications/__init__.py | 5 +- ceilometer/database/notifications.py | 5 +- ceilometer/dispatcher/gnocchi_client.py | 2 +- ceilometer/dns/notifications.py | 5 +- ceilometer/event/storage/impl_sqlalchemy.py | 4 + ceilometer/hardware/pollsters/generic.py | 9 ++- ceilometer/ipmi/notifications/ironic.py | 5 +- ceilometer/meter/notifications.py | 3 +- ceilometer/middleware.py | 5 +- ceilometer/network/notifications.py | 5 +- ceilometer/storage/impl_sqlalchemy.py | 3 + ceilometer/telemetry/notifications.py | 5 +- .../functional/storage/test_impl_sqlalchemy.py | 14 ++++ ceilometer/transformer/conversions.py | 5 +- devstack/plugin.sh | 8 +- ...gator-transformer-timeout-e0f42b6c96aa7ada.yaml | 5 ++ .../thread-safe-matching-4a635fc4965c5d4c.yaml | 6 ++ requirements.txt | 6 +- 28 files changed, 198 insertions(+), 56 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index f793172..18f6449 100644 --- a/requirements.txt +++ b/requirements.txt @@ -27,2 +27,2 @@ pecan>=1.0.0 -oslo.messaging!=1.17.0,!=1.17.1,!=2.6.0,!=2.6.1,!=2.7.0,!=2.8.0,!=2.8.1,!=2.9.0,>=1.16.0 # Apache-2.0 -oslo.middleware>=2.8.0 # Apache-2.0 +oslo.messaging!=1.17.0,!=1.17.1,!=2.6.0,!=2.6.1,!=2.7.0,!=2.8.0,!=2.8.1,!=2.9.0,!=3.1.0,>=1.16.0 # Apache-2.0 +oslo.middleware!=3.0.0,!=3.1.0,!=3.2.0,>=2.8.0 # Apache-2.0 @@ -40 +40 @@ PyYAML>=3.1.0 -requests!=2.8.0,>=2.5.2 +requests!=2.8.0,!=2.9.0,>=2.5.2

1 0

[release][stable][telemetry] aodh release 1.1.1 (liberty)
by doug＠doughellmann.com 25 Jan '16

25 Jan '16

We are happy to announce the release of: aodh 1.1.1: OpenStack Telemetry Alarming This release is part of the liberty stable release series. With package available at: https://pypi.python.org/pypi/aodh For more details, please see below. 1.1.1 ^^^^^ Upgrade Notes ************* * A new default policy.json is provided to properly handle RBAC control. Existing policy.json files may not grant the appropriate access. Security Issues *************** * Patch was added to address inconsistent RBAC policy handling. Certain rules may not have been given appropriate access. Bug Fixes ********* * [bug 1504495 (https://bugs.launchpad.net/ceilometer/+bug/1504495)] Patch was added to address inconsistent RBAC policy handling. Certain rules may not have been given appropriate access. Other Notes *********** * Start using reno to manage release notes. Changes in aodh 1.1.0..1.1.1 ---------------------------- de554a3 add aodh 1.1.1 release notes 3a05a1d rbac: add some backport compat tests 410d8da Fix rbac system 5f01d91 Update policy.json.sample with correct values 216b287 Move the content of ReleaseNotes to README.rst c88f02f initialize ceilometerclient when we use it 78e4544 remove unnecessary mock for rpc server start 15c1454 add reno for release notes management e68a17b add first reno-based release note 251b566 liberty super fix Diffstat (except docs and test files) ------------------------------------- .gitignore | 3 + .gitreview | 1 + README.rst | 7 +- ReleaseNotes | 11 - aodh/api/controllers/v2/alarms.py | 50 ++-- aodh/api/controllers/v2/query.py | 9 +- aodh/api/hooks.py | 2 +- aodh/api/rbac.py | 57 +++-- aodh/evaluator/threshold.py | 41 +-- .../functional/api/v2/test_alarm_scenarios.py | 108 ++++++-- .../api/v2/test_complex_query_scenarios.py | 12 + devstack/plugin.sh | 7 +- etc/aodh/policy.json | 19 +- etc/aodh/policy.json.sample | 20 -- releasenotes/notes/.placeholder | 0 releasenotes/notes/fix-rbac-50825144e0897d7d.yaml | 14 ++ .../notes/start-using-reno-53e47f9e40a30c2a.yaml | 3 + releasenotes/source/_static/.placeholder | 0 releasenotes/source/_templates/.placeholder | 0 releasenotes/source/conf.py | 274 +++++++++++++++++++++ releasenotes/source/index.rst | 9 + releasenotes/source/liberty.rst | 6 + releasenotes/source/unreleased.rst | 5 + test-requirements.txt | 1 + tox.ini | 3 + 33 files changed, 567 insertions(+), 134 deletions(-)

1 0

[release][stable][ironic] ironic-inspector release 2.2.3 (liberty)
by doug＠doughellmann.com 25 Jan '16

25 Jan '16

We are content to announce the release of: ironic-inspector 2.2.3: Hardware introspection for OpenStack Bare Metal This release is part of the liberty stable release series. With source available at: http://git.openstack.org/cgit/openstack/ironic-inspector With package available at: https://pypi.python.org/pypi/ironic-inspector Please report issues through launchpad: http://bugs.launchpad.net/ironic-inspector For more details, please see below. 2.2.3 ^^^^^ Bug Fixes ********* * Fixed an issue with deleting nodes from cache on MySQL, see https://bugs.launchpad.net/ironic-inspector/+bug/1511187 for details. Other Notes *********** * Start using reno to manage release notes. Changes in ironic-inspector 2.2.2..2.2.3 ---------------------------------------- 23bf0b5 Add missing release note 2bb0134 Add a simple docs target to make docs gate jobs happy bddc264 Add first reno-based release note 95a9220 Use Reno for release notes management 24da57c Support IPA for devstack-plugin a1a0f26 Updated from global requirements 37717e1 Properly order node deletion from cache Diffstat (except docs and test files) ------------------------------------- .gitignore | 3 + CONTRIBUTING.rst | 40 +++ devstack/plugin.sh | 48 +++- ironic_inspector/node_cache.py | 10 +- ironic_inspector/version.py | 15 ++ releasenotes/notes/.placeholder | 0 .../node-deletion-ordering-d78351f43838c078.yaml | 4 + .../notes/start-using-reno-9b57e019cb4e7efc.yaml | 3 + releasenotes/source/_static/.placeholder | 0 releasenotes/source/_templates/.placeholder | 0 releasenotes/source/conf.py | 276 +++++++++++++++++++++ releasenotes/source/index.rst | 9 + releasenotes/source/liberty.rst | 6 + releasenotes/source/unreleased.rst | 5 + requirements.txt | 4 +- setup.cfg | 8 + test-requirements.txt | 3 + tox.ini | 11 + 20 files changed, 518 insertions(+), 18 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 39b8423..b45f991 100644 --- a/requirements.txt +++ b/requirements.txt @@ -10 +10 @@ jsonschema!=2.5.0,<3.0.0,>=2.0.0 -keystonemiddleware>=2.0.0 +keystonemiddleware!=2.4.0,>=2.0.0 @@ -14 +14 @@ python-ironicclient>=0.8.0 -python-keystoneclient>=1.6.0 +python-keystoneclient!=1.8.0,>=1.6.0 diff --git a/test-requirements.txt b/test-requirements.txt index 72a44b2..b91c754 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -7,0 +8,3 @@ mock>=1.2 +sphinx!=1.2.0,!=1.3b1,<1.3,>=1.1.2 +oslosphinx>=2.5.0 # Apache-2.0 +reno>=0.1.1 # Apache2

1 0

[release][stable][sahara] sahara-image-elements release 3.0.1 (liberty)
by doug＠doughellmann.com 25 Jan '16

25 Jan '16

We are stoked to announce the release of: sahara-image-elements 3.0.1: Image elements for Sahara This release is part of the liberty stable release series. With package available at: https://pypi.python.org/pypi/sahara-image-elements For more details, please see below. Changes in sahara-image-elements 3.0.0..3.0.1 --------------------------------------------- a4af7cd Switch to post-versioning Diffstat (except docs and test files) ------------------------------------- setup.cfg | 1 - 1 file changed, 1 deletion(-)

1 0

[release][stable][sahara] sahara-extra release 3.0.1 (liberty)
by doug＠doughellmann.com 25 Jan '16

25 Jan '16

We are jazzed to announce the release of: sahara-extra 3.0.1: Extras for Sahara: hadoop-swiftfs This release is part of the liberty stable release series. With package available at: https://pypi.python.org/pypi/sahara-extra For more details, please see below. Changes in sahara-extra 3.0.0..3.0.1 ------------------------------------ 6e7d615 Switch to post-versioning Diffstat (except docs and test files) ------------------------------------- setup.cfg | 1 - 1 file changed, 1 deletion(-)

1 0

[release][stable][sahara] sahara release 3.0.1 (liberty)
by doug＠doughellmann.com 25 Jan '16

25 Jan '16

We are amped to announce the release of: sahara 3.0.1: Sahara project This release is part of the liberty stable release series. With source available at: http://git.openstack.org/cgit/openstack/sahara With package available at: https://pypi.python.org/pypi/sahara For more details, please see below. 3.0.1 ^^^^^ Bug Fixes ********* * Fixed issue with launching clusters without auto-security groups. * Cluster with 'is_protected' field can be created now, closed bug 1510929 * Wait condition feature can be disabled by the option. * Event log hanling fixed in case of problems with volumes formatting, closed bug 1506839 * Fixed search of devices that need to be mounted, closed bug 1508872 * Fixed issues with using Swift as an output datasource. * Fixed arguments list in latest cdh plugin * Fixed problems with validation of job binaries update, closed bug 1508507 * Job execution can be created with 'is_protected' field, closed bug 1510994 * Issues with job types call are fixed. Jobs can be launched from UI if ambari plugin enabled. * Open ports for Kafka in Ambari plugin, closed bug 1512661 * Heat engine shows reasons in case of failure * Escape unhandled unicode characters in environment configuration files * Spark workers are found by fqdn * Timeouts for ssh operations are configurable now * Removed unneeded volume serialization * In case of XFS volume will be formatted with '-f' option. * Added additional filter to volume_type check, closed bug 1508017 Other Notes *********** * Fixed client tempest tests * Fixed tempest config group * Start using reno to manage release notes. Changes in sahara 3.0.0..3.0.1 ------------------------------ 1f3a1a1 Update image address CDH plugin document c716f5b Don't configure hadoop.tmp.dir in Spark plugin abdb0ea Updated from global requirements cc218dd Add release notes for missed bugs 4cd7844 Force releasenotes warnings to be treated as errors d717068 Option for disabling wait condition feature d438011 Remove sharps from release notes b419f5e Updated from global requirements d2a792d Fix Spark installation fails when parsing spark-env.sh ea18624 Remove unneeded 'self' in plugins.cdh.v5_4_0.plugin_utils 2c8b1eb Report stack_status_reason on heat failure a6b3a88 Remove unneeded volume serialization 0920c6d Add "unreleased" release notes page ddd875a Support reno for release notes management 9cb41e4 Fix spark workers do not start in MapR plugin f04da88 Make ssh timeout configurable a944047 Fix of client tests in tempest 5d4871c Fix tempest tests 0e5198b Fixing search of devices that need to be mount ece97e9 Fixing problem with validation of job binaries update 5c7b09d Add additional filter to volume_type check 653d76c Fixing event log handling during volumes mount 0777402 Fixing cluster creation with is_protected field ab75f2b Missing stuff for Kafka in Ambari plugin 95096e6 Fixing job execution creation with is_protected field 68301c4 Add first reno-based release note d736017 Changing fedora image url for grenade job 570a0ba Fixing grenade_job faaa266 Updated from global requirements cd9df52 Add -f option to formatting volumes 2fb37cd Updated from global requirements ea70bb8 Fix issue with job types in Ambari plugin 8abaa88 Updated from global requirements bd944eb Fix .gitreview for stable/liberty branch 7ab41f1 Switch to post-versioning 307c115 Fixing cluster creation without auto_security_group Diffstat (except docs and test files) ------------------------------------- .gitignore | 3 + .gitreview | 1 + devstack/upgrade/resources.sh | 2 +- devstack/upgrade/settings | 4 +- devstack/upgrade/shutdown.sh | 3 +- releasenotes/notes/.placeholder | 0 releasenotes/notes/asg-fix-6243442b85931c40.yaml | 3 + .../cluster-is-protected-eee9e2bd2595fdc8.yaml | 4 + .../notes/disable-wc-option-ddf011af6ebb32b7.yaml | 3 + .../notes/event-log-handle-97dd75f428aa28f7.yaml | 4 + .../notes/fix-search-devices-72026264ce828187.yaml | 4 + .../fix-spark-swift-outputs-b4cd588b5f4e8571.yaml | 3 + .../notes/fix-tempest-d68a1c712b219a64.yaml | 3 + .../notes/fix_cdh_args-ee888dfeaf8ef0de.yaml | 3 + .../job-binary-validation-3b97219ae8c8e7bb.yaml | 4 + .../job-exec-is-protected-31831f9f3fb51aeb.yaml | 4 + .../notes/job-types-ambari-0873ad7deeecf8ba.yaml | 4 + .../notes/ports-ambari-43c5be3f3e7b3107.yaml | 4 + ...how_stack_failure_reasons-02ca814308c61718.yaml | 3 + .../notes/spark-installation-5ed2c7ca75f79de1.yaml | 3 + .../notes/spark-workers-67ae5e0da9dec137.yaml | 3 + .../notes/ssh-timeout-310a05c55cb0a086.yaml | 3 + .../notes/start-using-reno-689372a0a8dd3093.yaml | 3 + .../notes/unneeded_volume-37032bc35630cb46.yaml | 3 + .../volume-formatting-with-f-1e4459ac32a8957c.yaml | 3 + .../notes/volume-type-check-58203c2df50999d2.yaml | 4 + releasenotes/source/_static/.placeholder | 0 releasenotes/source/_templates/.placeholder | 0 releasenotes/source/conf.py | 216 +++++++++++++++++++++ releasenotes/source/index.rst | 9 + releasenotes/source/liberty.rst | 6 + releasenotes/source/unreleased.rst | 5 + requirements.txt | 14 +- sahara/api/v10.py | 2 +- sahara/api/v11.py | 3 +- sahara/config.py | 6 +- sahara/db/sqlalchemy/api.py | 9 - sahara/plugins/ambari/plugin.py | 13 +- sahara/plugins/cdh/v5_4_0/plugin_utils.py | 2 +- sahara/plugins/mapr/domain/configuration_file.py | 12 +- sahara/plugins/mapr/services/spark/spark.py | 2 +- sahara/plugins/spark/config_helper.py | 2 - sahara/service/heat/templates.py | 62 +++--- sahara/service/validations/base.py | 4 +- sahara/service/validations/clusters.py | 7 + sahara/service/validations/edp/job_binary.py | 22 ++- sahara/service/validations/edp/job_execution.py | 8 + sahara/service/volumes.py | 69 ++++--- .../tempest/scenario/data_processing/README.rst | 22 ++- .../tempest/scenario/data_processing/plugin.py | 4 +- .../service/validation/edp/test_job_executor.py | 33 ++++ .../validation/test_cluster_update_validation.py | 36 ++++ sahara/utils/openstack/heat.py | 2 +- sahara/utils/ssh_remote.py | 46 ++++- setup.cfg | 1 - test-requirements.txt | 2 + tools/gate/scenario/pre_test_hook.sh | 5 + tox.ini | 3 + 67 files changed, 651 insertions(+), 198 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 9746470..d9a2c36 100644 --- a/requirements.txt +++ b/requirements.txt @@ -14 +14 @@ jsonschema!=2.5.0,<3.0.0,>=2.0.0 -keystonemiddleware>=2.0.0 +keystonemiddleware!=2.4.0,>=2.0.0 @@ -21,2 +21,2 @@ oslo.log>=1.8.0 # Apache-2.0 -oslo.messaging!=1.17.0,!=1.17.1,>=1.16.0 # Apache-2.0 -oslo.middleware>=2.8.0 # Apache-2.0 +oslo.messaging!=1.17.0,!=1.17.1,!=2.6.0,!=2.6.1,!=2.7.0,!=2.8.0,!=2.8.1,!=2.9.0,!=3.1.0,>=1.16.0 # Apache-2.0 +oslo.middleware!=3.0.0,!=3.1.0,!=3.2.0,>=2.8.0 # Apache-2.0 @@ -27 +27 @@ oslo.service>=0.7.0 # Apache-2.0 -oslo.utils>=2.0.0 # Apache-2.0 +oslo.utils!=2.6.0,>=2.0.0 # Apache-2.0 @@ -29 +29 @@ paramiko>=1.13.0 -requests>=2.5.2 +requests!=2.8.0,!=2.9.0,>=2.5.2 @@ -32 +32 @@ python-cinderclient>=1.3.1 -python-keystoneclient>=1.6.0 +python-keystoneclient!=1.8.0,>=1.6.0 @@ -34 +34 @@ python-manilaclient>=1.3.0 -python-novaclient>=2.28.1 +python-novaclient!=2.33.0,>=2.28.1 diff --git a/test-requirements.txt b/test-requirements.txt index d55c732..09dba17 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -17,0 +18 @@ pylint==1.4.4 # GNU GPL v2 +reno>=0.1.1 # Apache2 @@ -22,0 +24 @@ testrepository>=0.0.18 +testresources>=0.2.4

1 0

[release] mitaka-2 development milestone
by Thierry Carrez 22 Jan '16

22 Jan '16

1 0

[heat] heat-cfntools release 1.4.2
by Steve Baker 21 Jan '16

21 Jan '16

We are chuffed to announce the release of: heat-cfntools 1.4.2: Tools required to be installed on Heat provisioned cloud instances With source available at: http://git.openstack.org/cgit/openstack/heat-cfntools Please report issues through launchpad: http://bugs.launchpad.net/heat-cfntools For more details, please see below. Changes in heat-cfntools 1.4.1..1.4.2 ------------------------------------- fe2b57b Remove argparse from requirements d3a0e97 Trivial: Remove vim header from source files 6a83420 py26/py33 is no longer supported by Infra's CI 032c385 remove python 2.6 trove classifier 5684248 Put py34 first in the env order of tox e4503e4 Replace assertEqual(None, *) with assertIsNone in tests c737d48 Deprecated tox -downloadcache option removed 6571e5a Don't run commands given as list on shell Diffstat (except docs and test files) ------------------------------------- heat_cfntools/cfntools/cfn_helper.py | 7 ++----- requirements.txt | 1 - setup.cfg | 1 - tools/lintstack.py | 1 - tox.ini | 5 +---- 6 files changed, 30 insertions(+), 16 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 531eb32..e595465 100644 --- a/requirements.txt +++ b/requirements.txt @@ -2 +1,0 @@ pbr>=0.6,!=0.7,<1.0 -argparse

1 0

[OSSA 2016-004] Swift proxy-server DoS through Large Object (CVE-2016-0737, CVE-2016-0738)
by Tristan Cacqueray 20 Jan '16

20 Jan '16

========================================================== OSSA-2016-004: Swift proxy-server DoS through Large Object ========================================================== :Date: January 20, 2016 :CVE: CVE-2016-0737 (client to proxy), CVE-2016-0738 (proxy to server) Affects ~~~~~~~ - Swift: >=2.2.1 <= 2.3.0, >= 2.4.0 <= 2.5.0 Description ~~~~~~~~~~~ Romain LE DISEZ from OVH and Örjan Persson from Kiliaro independently reported two vulnerabilities in Swift Large Object. By repeatedly requesting and interrupting connections to a Large Object (Dynamic or Static) URL, a remote attacker may exhausts Swift proxy-server resources, potentially resulting in a denial of service. Note that there are two distinct bugs that can exhaust proxy resources, one for client connection (client to proxy), one for servers connection (proxy to server). All Swift setup are affected. Patches ~~~~~~~ - https://review.openstack.org/217750 (client to proxy) (Kilo) - https://review.openstack.org/270234 (proxy to server) (Kilo) - https://review.openstack.org/270235 (proxy to server) (Liberty) - https://review.openstack.org/270233 (proxy to server) (Mitaka) Credits ~~~~~~~ - Romain LE DISEZ from OVH (CVE-2016-0737) - Örjan Persson from Kiliaro (CVE-2016-0738) References ~~~~~~~~~~ - https://bugs.launchpad.net/bugs/1466549 (client to proxy) - https://bugs.launchpad.net/bugs/1493303 (proxy to server) - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0737 (client to proxy) - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0738 (proxy to server) Notes ~~~~~ - The client to proxy issue (CVE-2016-0737) is already fixed in Liberty - The remaining fix will be included in future 2.3.1 (Kilo) and 2.5.1 (Liberty) releases. -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0