- OpenStack-announce - lists.openstack.org

OpenStack Community Weekly Newsletter (Nov 14 - 21)
by Stefano Maffulli 21 Nov '14

21 Nov '14

1 0

[OSSA 2014-039] Neutron DoS through invalid DNS configuration (CVE-2014-7821)
by Tristan Cacqueray 20 Nov '14

20 Nov '14

OpenStack Security Advisory: 2014-039 CVE: CVE-2014-7821 Date: November 19, 2014 Title: Neutron DoS through invalid DNS configuration Reporter: Henry Yamauchi, Charles Neill and Michael Xin (Rackspace) Products: Neutron Versions: up to 2014.1.3 and 2014.2 Description: Henry Yamauchi, Charles Neill and Michael Xin from Rackspace reported a vulnerability in Neutron. By configuring a maliciously crafted dns_nameservers an authenticated user may crash Neutron service resulting in a denial of service attack. All Neutron setups are affected. Kilo (development branch) fix: https://review.openstack.org/135616 Juno fix: https://review.openstack.org/135623 Icehouse fix: https://review.openstack.org/135624 Notes: This fix will be included in future 2014.1.4 and 2014.2.1 releases. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7821 https://launchpad.net/bugs/1378450 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Post Paris)
by Stefano Maffulli 14 Nov '14

14 Nov '14

1 0

[OSSA 2014-038] Nova network DoS through API filtering (CVE-2014-3708)
by Tristan Cacqueray 28 Oct '14

28 Oct '14

OpenStack Security Advisory: 2014-038 CVE: CVE-2014-3708 Date: October 28, 2014 Title: Nova network DoS through API filtering Reporter: Mohammed Naser (Vexxhost) Products: Nova Versions: up to 2014.1.3, and 2014.2 Description: Mohammed Naser from Vexxhost reported a vulnerability in Nova API filters. By listing active servers using an ip filter, an authenticated user may overload nova-network or neutron-server process, resulting in a denial of services. All Nova setups are affected. Kilo (development branch) fix: https://review.openstack.org/131460 Juno fix: https://review.openstack.org/131462 Icehouse fix: https://review.openstack.org/131461 Notes: This fix will be included in future 2014.1.4 and 2014.2.1 releases. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3708 https://launchpad.net/bugs/1358583 --· Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Oct 17 – 24)
by Stefano Maffulli 25 Oct '14

25 Oct '14

1 0

[python-keystoneclient] Release of python-keystoneclient 0.11.2
by Morgan Fainberg 23 Oct '14

23 Oct '14

The Keystone team has released python-keystoneclient 0.11.2. This release can be installed from the following locations: * http://tarballs.openstack.org/python-keystoneclient * https://pypi.python.org/pypi/python-keystoneclient Detailed changes in this release: https://launchpad.net/python-keystoneclient/+milestone/0.11.2

1 0

[OSSA 2014-037] Nova VMware instance in resize state may leak (CVE-2014-8333)
by Tristan Cacqueray 22 Oct '14

22 Oct '14

OpenStack Security Advisory: 2014-037 CVE: CVE-2014-8333 Date: October 21, 2014 Title: Nova VMware instance in resize state may leak Reporter: Zhu Zhu (IBM) Products: Nova Versions: up to 2014.1.3 Description: Zhu Zhu from IBM reported a vulnerability in Nova VMware driver. If an authenticated user deletes an instance while it is in resize state, it will cause the original instance to not be deleted. An attacker can use this to launch a denial of service attack. All Nova VMware setups are affected. Juno fix: https://review.openstack.org/118595 Icehouse fix: https://review.openstack.org/125492 Notes: This fix was included in the 2014.2 release and will appear in a future 2014.1.4 stable point release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8333 https://launchpad.net/bugs/1359138 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Oct 10 – 17)
by Stefano Maffulli 18 Oct '14

18 Oct '14

1 0

[Elections] End of the Election Cycle - Results of PTL & TC Elections
by Anita Kuno 17 Oct '14

17 Oct '14

PTL Election Results: * Compute (Nova) ** Michael Still * Object Storage (Swift) ** John Dickinson * Image Service (Glance) ** Nikhil Komawar * Identity (Keystone) ** Morgan Fainberg * Dashboard (Horizon) ** David Lyle * Networking (Neutron) ** Kyle Mestery * Block Storage (Cinder) ** Mike Perez * Metering/Monitoring (Ceilometer) ** Eoghan Glynn * Orchestration (Heat) ** Angus Salkeld * Database Service (Trove) ** Nikhil Manchanda * Bare metal (Ironic) ** Devananda van der Veen * Common Libraries (Oslo) ** Doug Hellmann * Infrastructure ** James E. Blair * Documentation ** Anne Gentle * Quality Assurance (QA) ** Matthew Treinish * Deployment (TripleO) ** Clint Byrum * Release cycle management ** Thierry Carrez * Data Processing Service (Sahara) ** Sergey Lukjanov * Message Service (Zaqar) ** Flavio Percoco * Key Management Service (Barbican) ** Douglas Mendizabal * DNS Services (Designate) ** Kiall Mac Innes * Shared File Systems (Manila) ** Ben Swartzlander Full Election Results: * Cinder: http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_3bc8db78251af391 * TripleO: http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_d8d7335f4de67d94 TC Election Results: * Monty Taylor * Sean Dague * Doug Hellmann * Russell Bryant * Anne Gentle * John Griffith Full results: http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_c105db929e6c11f4 Stay up to date on Election activity by following our Governance page: https://wiki.openstack.org/wiki/Governance Thanks to my fellow election official, Tristan Cacqueray, I appreciate your help and perspective. Thank you, Anita

1 0

OpenStack 2014.2 ("Juno") is released !
by Thierry Carrez 16 Oct '14

16 Oct '14

Hello everyone, It is my great pleasure to announce the final release of OpenStack 2014.2, code-named "Juno". This concludes the 6-month Juno development cycle, which saw the completion of more than 340 features and the fixing of more than 3200 bugs in integrated projects and common libraries alone. Juno is also the first OpenStack release to officially include the Data Processing Service (Sahara). You can find source tarballs for each integrated project, together with complete lists of features and bugfixes, at the following links: Compute (Nova): https://launchpad.net/nova/juno/2014.2 Object Storage (Swift): https://launchpad.net/swift/juno/2.2.0 Image Service (Glance): https://launchpad.net/glance/juno/2014.2 Networking (Neutron): https://launchpad.net/neutron/juno/2014.2 Block Storage (Cinder): https://launchpad.net/cinder/juno/2014.2 Identity (Keystone): https://launchpad.net/keystone/juno/2014.2 Dashboard (Horizon): https://launchpad.net/horizon/juno/2014.2 Telemetry (Ceilometer): https://launchpad.net/ceilometer/juno/2014.2 Orchestration (Heat): https://launchpad.net/heat/juno/2014.2 Database Service (Trove): https://launchpad.net/trove/juno/2014.2 Data Processing (Sahara): https://launchpad.net/sahara/juno/2014.2 The Juno Release Notes wikipage contains an overview of the key features, as well as upgrade notes and current lists of known issues. You can access them at: https://wiki.openstack.org/wiki/ReleaseNotes/Juno Congratulations and thanks to the 1400+ individuals who contributed to this development cycle and helped in making this release a success. -- Thierry Carrez (ttx)

1 0