- OpenStack-announce - lists.openstack.org

[OSSA 2015-002.1] Glance v2 API unrestricted path traversal through filesystem:// scheme (CVE-2015-1195) ERRATA 1
by Tristan Cacqueray 20 Jan '15

20 Jan '15

======================================================================================= OSSA-2015-002.1: Glance v2 API unrestricted path traversal through filesystem:// scheme ======================================================================================= :Date: January 20, 2015 :CVE: CVE-2015-1195 Affects ~~~~~~~ - Glance: up to 2014.1.3 and 2014.2 versions up to 2014.2.1 Description ~~~~~~~~~~~ Jin Liu from EMC reported that path traversal vulnerabilities in Glance were not fully patched in OSSA 2014-041. By setting a malicious image location to a filesystem:// scheme an authenticated user can still download or delete any file on the Glance server for which the Glance process user has access to. Only setups using the Glance V2 API are affected by this flaw. Errata ~~~~~~ When the original advisory was published a CVE number was not assigned. CVE-2015-1195 can now be used to track this vulnerability. Patches ~~~~~~~ - https://review.openstack.org/145974 (Icehouse) - https://review.openstack.org/145916 (Juno) - https://review.openstack.org/145640 (Kilo) Credits ~~~~~~~ - Jin Liu from EMC (CVE-2015-1195) References ~~~~~~~~~~ - https://launchpad.net/bugs/1408663 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1195 Notes ~~~~~ - This fix was included in the kilo-1 development milestone and will be included in future 2014.2.2 (juno) and 2014.1.4 (icehouse) releases. - The OpenStack VMT recommends revoking all credentials stored in files accessible by Glance as a precautionary measure. OSSA History ~~~~~~~~~~~~ - 2015-01-20 - Errata 1 - 2015-01-15 - Original Version -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Jan 9 - 16)
by Stefano Maffulli 17 Jan '15

17 Jan '15

2015 Election Results Thank you to everyone who voted in this year's election. We reached quorum and passed the three bylaws amendments. We also reached quorum in electing eight Individual Directors to the 2015 OpenStack Board of Directors. And the winner is.... Individual Directors * Tim Bell * Russell Bryant * Alex Freedland * Rob Hirschfeld * Vishvananda Ishaya * Kavit Munshi * Egle Sigler * Monty Taylor Platinum Directors * Alan Clark * Eileen Evans * Toby Ford * Van Lindberg * Mark McLoughlin * Todd Moore * Imad Sousou * John Zannos Gold Directors * Simon Anderson * Robert Esker * Tristan Goode * Steven Hallett * Chris Kemp * Boris Renski * Sean Roberts * Lew Tucker Kilo Nova deploy recommendations What would a Nova developer tell a deployer to think about before their first OpenStack install? Michael Still shares his thought process to consider your options and make informed decisions. OpenStack Ambassadors Come Together Ambassadors to help other user groups through communicating. meeting alternating Weekly on first, third, fifth Tuesdays at 08:00 GMT and second and fourth Fridays at 18:00 GMT on the chat.freenode.net IRC channel: #openstack-meeting-alt. Small openstack An interesting conversation on the Operators mailing list discussing request for small installation of openstack (about 3-5 nodes). The messages started in December, continued in January and drifted to discuss distributed glance. User self registration and management Adrian Turjak asked on the Development mailing list if there is any interest or need for an open-source user registration and management service for people using OpenStack. There seems to be a basic need a way for users to sign up themselves, choose their own password, and request new users to be added to their project. David Chadwick pointed to a blueprint and a demo of the system for University of Kent.Enrique Garcia also expressed interest in helping out in the effort. The Road to Vancouver * Call For Speakers Relevant Conversations * Requirements for future "OpenStack projects" * The Future of OpenStack is Now, 2015 * Infrastructure Puppet module split sprint, Jan 28 * Vancouver Design Summit format changes * Another Nova spec update Deadlines and Development Priorities * [Keystone] Spec proposal deadline Feb 5 * [Cinder] Cutoff deadlines for cinder drivers: volume drivers need to have a CI by end of K-3, March 19th 2015 * [nova] Kilo FeatureProposalFreeze 22nd Jan and FeatureFreeze 5th Feb * Etherpad for the Nova midcycle meetup * Etherpad for the Keystone midcycle meetup * Etherpad for the Cinder midcycle meetup * [Nova] Kilo Release Status - just passed spec freeze * [neutron] BPs in Launchpad for Kilo-2 * [Ironic] Bay Area Midcycle * [barbican] Kilo Mid-Cycle Sprint Security Advisories and Notices * [OSSA 2015-002] Glance v2 API unrestricted path traversal through filesystem:// scheme Tips ‘n Tricks * By Sébastien Han: Fix nova-scheduler issue with RBD and UUID not found Upcoming Events 2015 OpenStack Foundation Events Plan and Calls for Papers Available. The 2015 events plan is now available on the Global Events Calendar wiki. The detailed spreadsheet covers industry events, Summits (dates and locations), as well as regional OpenStack Days organized by the community. If you’re interested in sponsoring or speaking at a planned OpenStack Day, please contact the contact listed in the spreadsheet. * OpenStack Bootstrapping Hour - oslo.messaging anti-patterns - Friday Jan 16th 17:00 UTC * Jan 19, 2015 OpenStack Meetup Nuremberg Nuremberg, Bavaria, DE * Jan 22, 2015 OpenStack L.A. January Meetup Pasadena, CA, US * Jan 27 - 29, 2015 Cinder Kilo Midcycle Meetup Austin, Texas, US * Feb 02 - 03, 2015 Upstream Training in Japan Tokyo, JP * Feb 03 - 04, 2015 OpenStack Days Tokyo 2015 Tokyo, JP * Feb 05, 2015 OpenStack Day in Korea Seoul, Seoul, KR * Feb 19 - 20, 2015 World Techies Forum Mumbai, Maharashtra, IN * Mar 26, 2015 PDX OpenStack Hackathon Portland, OR, US * Apr 13 - 14, 2015 OpenStack Live Santa Clara, CA, US * Apr 22 - 23, 2015 China SDNNFV Conference Beijing, CN * May 18 - 22, 2015 OpenStack Summit May 2015 Vancouver, BC * Jun 11, 2015 OpenStack DACH Day 2015 Berlin, DE * Sep 17, 2015 OpenStack Benelux Conference 2015 Bussum, NL Other News * OpenStack Product Management Kilo Midcycle Meeting * OpenStack Crossproject Meeting: Summary and full logs. Got Answers? Ask OpenStack is the go-to destination for OpenStack users. Interesting questions waiting for answers: * Heat AutoScalingGroup with different user data * How to retrieve updated topology after an autoscaling has been done? * How to configure OCCI API with OpenStack/DevStack? The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment.

1 0

[OSSA 2015-002] Glance v2 API unrestricted path traversal through filesystem:// scheme
by Tristan Cacqueray 15 Jan '15

15 Jan '15

===================================================================================== OSSA-2015-002: Glance v2 API unrestricted path traversal through filesystem:// scheme ===================================================================================== :Date: January 15, 2015 :CVE: Requested Affects ~~~~~~~ - Glance: up to 2014.1.3 and 2014.2 versions up to 2014.2.1 Description ~~~~~~~~~~~ Jin Liu from EMC reported that path traversal vulnerabilities in Glance were not fully patched in OSSA 2014-041. By setting a malicious image location to a filesystem:// scheme an authenticated user can still download or delete any file on the Glance server for which the Glance process user has access to. Only setups using the Glance V2 API are affected by this flaw. Patches ~~~~~~~ - https://review.openstack.org/145974 (Icehouse) - https://review.openstack.org/145916 (Juno) - https://review.openstack.org/145640 (Kilo) Credits ~~~~~~~ - Jin Liu from EMC References ~~~~~~~~~~ - https://launchpad.net/bugs/1408663 Notes ~~~~~ - This fix was included in the kilo-1 development milestone and will be included in future 2014.2.2 (juno) and 2014.1.4 (icehouse) releases. - The OpenStack VMT recommends revoking all credentials stored in files accessible by Glance as a precautionary measure. - A CVE has been requested for this issue, the OpenStack VMT will issue an errata with the correct CVE number assigned once this information is available. -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Week 1, 2015)
by Stefano Maffulli 10 Jan '15

10 Jan '15

Happy 2015! OpenStack Gold Director Selector Election Results for 2015 * Aptira – Tristan Goode * Cisco – Lew Tucker * Dreamhost – Simon Anderson * EMC – Sean Roberts * Mirantis – Boris Renski * Nebula – Chris Kemp * (new) NetApp – Robert Esker * (new) Symantec – Steven Hallett Welcome to all and good work! Women of OpenStack Working Session Update The WOS Group has a established a new women-of-openstack mailing list and is hosting next week a webinar to help Designing an OpenStack Summit Session Submission for Success. Register now, as this webinar comes just in time for the OpenStack Summit Vancouver Call For Speakers Submissions are open now for Vancouver OpenStack Summit 2015. Gate Bug Triage Conclusion A few months ago Matthew Treinish wrote about debugging a gate failure. He wrote an update about the conclusion to the triage efforts for the Out Of Memory failures on Neutron jobs. The cause of the failures was running out of memory but what was leading to the OOM failures wasn’t just limited to neutron. It was just that the neutron jobs ran with more services which used more memory which made failures there more common. Sneak Peek into Heat New Features in OpenStack Kilo Release Arthur Berezin gives a sneak peek at the new upcoming features in Kilo release, just as the first Kilo milestone has been reached. Relevant Conversations * Requirements for future “OpenStack projects” * OpenStack: Evolution * 10 pounds of OpenStack cloud in a 5 pound bag? Do we need a bigger bag? WARNING: explicit images * Vancouver Design Summit format changes * [nova] reckoning time for nova ec2 stack * OpenStack Product Management Kilo Midcycle Meeting Deadlines and Development Priorities * [Nova] Kilo Release Status – just passed spec freeze * [neutron] BPs in Launchpad for Kilo-2 * review log guidelines Security Advisories and Notices * [OSSA 2015-001] L3 agent denial of service with radvd 2.0+ (CVE-2014-8153) * [OSSA 2014-041.1] Glance v2 API unrestricted path traversal (CVE-2014-9493) ERRATA 1 Tips ‘n Tricks * By Tim Bell: Using bitnami images with OpenStack * By Rob Hirschfeld: OpenCrowbar v2.1 Video Tour from Metal to OpenStack and beyond * By Jay Pipes: Understanding reservations, concurrency, and locking in Nova * By Giulio Fidente: Ceph for Cinder in TripleO * By benn: Reliability Analysis of OpenStack VMs using Python, fabric and R – Part 1: Reliability Concepts * By Robert van Leeuwen: The kernel panics from 2014 on our OpenStack Hypervisors * By Assaf Muller: Juno Advanced Routing Compatibility Upcoming Events 2015 OpenStack Foundation Events Plan and Calls for Papers Available. The 2015 events plan is now available on the Global Events Calendar wiki. The detailed spreadsheet covers industry events, Summits (dates and locations), as well as regional OpenStack Days organized by the community. If you’re interested in sponsoring or speaking at a planned OpenStack Day, please contact the contact listed in the spreadsheet. * Jan 10, 2015 OpenStack Mini Meetup, Chennai Chennai, Tamil Nadu, IN * Jan 11, 2015 OpenStack India Meetup, Bangalore BANGALORE, Karnataka, IN * Jan 14, 2015 BareMetal & OpenNetworking webinar Mountain View, CA, US * Jan 19, 2015 OpenStack Meetup Nuremberg Nuremberg, Bavaria, DE * Jan 22, 2015 OpenStack L.A. January Meetup Pasadena, CA, US * Jan 27 – 29, 2015 Cinder Kilo Midcycle Meetup Austin, Texas, US * Feb 02 – 03, 2015 Upstream Training in Japan Tokyo, JP * Feb 03 – 04, 2015 OpenStack Days Tokyo 2015 Tokyo, JP * Feb 05, 2015 OpenStack Day in Korea Seoul, Seoul, KR * Feb 19 – 20, 2015 World Techies Forum Mumbai, Maharashtra, IN * Apr 13 – 14, 2015 OpenStack Live Santa Clara, CA, US * Apr 22 – 23, 2015 China SDNNFV Conference Beijing, CN * May 18 – 22, 2015 OpenStack Summit May 2015 Vancouver, BC * Jun 11, 2015 OpenStack DACH Day 2015 Berlin, DE * Sep 17, 2015 OpenStack Benelux Conference 2015 Bussum, NL Other News * 6 new things Fedora 21 brings to the open source cloud * OpenStack Gold Director Selector Election Results for 2015 * What’s Up Doc? Jan 8 2015 * [stable] release notes for 2014.2.2 * OpenStack Crossproject Meeting: Summary and full logs. Got Answers? Ask OpenStack is the go-to destination for OpenStack users. Interesting questions waiting for answers: * Does anyone have Xenserver 6.5 and Openstack playing nicely? * Does Stackalytics have API to report data for a specific period? * Windows 7 VM taking on IP from wrong subnet * how to install vpnaas under juno with dvr ? * Does Swift send updates when objects have been modified in a container? * HEAT grub commands for CentOS 7 Nova Instance The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment.

1 1

[OSSA 2015-001] L3 agent denial of service with radvd 2.0+ (CVE-2014-8153)
by Tristan Cacqueray 08 Jan '15

08 Jan '15

========================================================= OSSA-2015-001: L3 agent denial of service with radvd 2.0+ ========================================================= :Date: January 08, 2015 :CVE: CVE-2014-8153 Affects ~~~~~~~ - Neutron: 2014.2 version up to 2014.2.1 Description ~~~~~~~~~~~ Ihar Hrachyshka from Red Hat reported a vulnerability in Neutron. By creating 8 routers and assigning each of them a non-provider ipv6 subnet, a malicious user may block router update processing for all tenants, potentially resulting in a Denial of Service. Only Neutron setups running with radvd 2.0+ are affected. Patches ~~~~~~~ - https://review.openstack.org/141575 (Juno) - https://review.openstack.org/138688 (Kilo) Credits ~~~~~~~ - Ihar Hrachyshka from Red Hat (CVE-2014-8153) References ~~~~~~~~~~ - https://launchpad.net/bugs/1399172 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8153 Notes ~~~~~ - This fix will be included in a future 2014.2.2 release. - The OSSA announce format for the 2015 advisories has been changed to RST. -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OSSA 2014-041.1] Glance v2 API unrestricted path traversal (CVE-2014-9493) ERRATA 1
by Grant Murphy 05 Jan '15

05 Jan '15

OpenStack Security Advisory: 2014-041 (ERRATA 1) CVE: CVE-2014-9493 Date: January 5, 2015 Title: Glance v2 API unrestricted path traversal Reporter: Masahito Muroi (NTT) Products: Glance Versions: up to 2014.1.3 and 2014.2 version up to 2014.2.1 Description: Masahito Muroi from NTT reported a vulnerability in Glance. By setting a malicious image location an authenticated user can download or delete any file on the Glance server for which the Glance process user has access to. Only setups using the Glance V2 API are affected by this flaw. Errata: When the original advisory was published a CVE number was not assigned. CVE-2014-9493 can now be used to track this vulnerability. Kilo (development branch) fix: https://review.openstack.org/141706 Juno fix: https://review.openstack.org/142373 Icehouse fix: https://review.openstack.org/142788 Notes: * This fix was included in the kilo-1 development milestone and will be included in future 2014.2.2 (juno) and 2014.1.4 (icehouse) releases. * The OpenStack VMT recommends revoking all credentials stored in files accessible by Glance as a precautionary measure. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9493 https://launchpad.net/bugs/1400966 OSSA History: 2015-01-05 - Errata 1 2014-12-23 - Original Version -- Grant Murphy OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Dec 20 - 26)
by Stefano Maffulli 26 Dec '14

26 Dec '14

Last newsletter of 2014, see you again in 2015! University of Hawaii College of Education harnesses OpenStack to support faculty research via a secure private cloud OpenStack powers a Holodeck at University of Hawaii at Manoa... Read the full story on Mirantis blog. The TOSCA Cloud State of the Union A nice summary of the status of OpenStack Heat and the relation between the different specifications to describe topology and orchestration in cloud world. Relevant Conversations * Application level HA via Heat * The state of nova-network to neutron migration * [Openstack-operators] Packaging sample config versions Deadlines and Development Priorities * [nova] Kilo Project Priorities * Neutron Priorities for Kilo * [Nova] Mid-cycle meetup details for kilo Security Advisories and Notices * [OSSA-2014-041] Glance v2 API unrestricted path traversal Reports from Previous Events * Rhones-Alpes meetup summary Tips ‘n Tricks * By Lars Kellogg-Stedman: Accessing the serial console of your Nova servers * By Darryl Cauldwell:Create A vSphere OpenStack Glance Windows VM Image Upcoming Events 2015 OpenStack Foundation Events Plan and Calls for Papers Available. The 2015 events plan is now available on the Global Events Calendar wiki. The detailed spreadsheet covers industry events, Summits (dates and locations), as well as regional OpenStack Days organized by the community. If you’re interested in sponsoring or speaking at a planned OpenStack Day, please contact the contact listed in the spreadsheet. * [Call for Speaker, Sponsor, Participants] OpenStack Day in Korea - Feb. 05, 2015 * Jan 15, 2015 Deep Dive into Trove Austin, Texas, US * Feb 05, 2015 OpenStack Day in Korea Seoul, Seoul, KR * Feb 19 - 20, 2015 World Techies Forum Mumbai, Maharashtra, IN * Apr 13 - 14, 2015 OpenStack Live Santa Clara, CA, US * Apr 22 - 23, 2015 China SDNNFV Conference Beijing, CN * May 18 - 22, 2015 OpenStack Summit May 2015 Vancouver, BC * Sep 17, 2015 OpenStack Benelux Conference 2015 Bussum, NL Other News * Volunteers needed for OpenStack Stand at FOSDEM in Brussels * Symantec joins OpenStack Foundation as Gold Member! * Keystone Middleware 1.3.1 release * OpenStack Crossproject Meeting: suspended for holidays. Got Answers? Ask OpenStack is the go-to destination for OpenStack users. Interesting questions waiting for answers: * how to extract the image details from glance api * HEAT grub commands for CentOS 7 Nova Instance * swift change replication address * Solaris 11.2 Openstack - CSRF Verification failed * How to retrieve ceilometer statistics for the meter "network.incoming.bytes" for an instance * Nova Scheduler warning "Host has more disk space than database expected" on launching instances * How to configure VirtualBox based testing environment? The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment.

1 0

[OSSA-2014-041] Glance v2 API unrestricted path traversal
by Grant Murphy 23 Dec '14

23 Dec '14

OpenStack Security Advisory: 2014-041 CVE: Requested Date: December 23, 2014 Title: Glance v2 API unrestricted path traversal Reporter: Masahito Muroi (NTT) Products: Glance Versions: up to 2014.1.3 and 2014.2 version up to 2014.2.1 Description: Masahito Muroi from NTT reported a vulnerability in Glance. By setting a malicious image location an authenticated user can download or delete any file on the Glance server for which the Glance process user has access to. Only setups using the Glance V2 API are affected by this flaw. Kilo (development branch) fix: https://review.openstack.org/141706 Juno fix: https://review.openstack.org/142373 Icehouse fix: https://review.openstack.org/142788 Notes: * This fix was included in the kilo-1 development milestone and will be included in future 2014.2.2 (juno) and 2014.1.4 (icehouse) releases. * The OpenStack VMT recommends revoking all credentials stored in files accessible by Glance as a precautionary measure. * A CVE has been requested for this issue, the OpenStack VMT will issue an errata with the correct CVE number assigned once this information is available. References: https://launchpad.net/bugs/1400966 -- Grant Murphy OpenStack Vulnerability Management Team

1 0

[keystonemiddleware] Keystone Middleware 1.3.1 release
by Morgan Fainberg 23 Dec '14

23 Dec '14

The Keystone development community would like to announce the 1.3.1 release of the Keystone Middleware package. This release can be installed from the following locations: * http://tarballs.openstack.org/keystonemiddleware <http://tarballs.openstack.org/keystonemiddleware> * https://pypi.python.org/pypi/keystonemiddleware <https://pypi.python.org/pypi/keystonemiddleware> 1.3.1 ------- * auth_token middleware no longer contacts keystone when a request with no token is received. Detailed changes in this release beyond what is listed above: https://launchpad.net/keystonemiddleware/+milestone/1.3.1

1 0

OpenStack Community Weekly Newsletter (Dec 13 - 20)
by Stefano Maffulli 20 Dec '14

20 Dec '14

1 0