- OpenStack-announce - lists.openstack.org

[OSSA 2014-036] Potential leak of passwords into log files (CVE-2014-7230, CVE-2014-7231)
by Tristan Cacqueray 15 Oct '14

15 Oct '14

OpenStack Security Advisory: 2014-036 CVE: CVE-2014-7230, CVE-2014-7231 Date: October 15, 2014 Title: Potential leak of passwords into log files Reporter: Amrith Kumar (Tesora) Products: Cinder and Nova (versions up to 2014.1.3) Trove (versions up to 2014.1.2) Description: Amrith Kumar from Tesora reported two vulnerabilities in the processutils.execute() and strutils.mask_password() functions available from oslo-incubator that are copied into each project's code. An attacker with read access to the services' logs may obtain passwords used as a parameter of a command that has failed (CVE-2014-7230) or when mask_password did not mask passwords properly (CVE-2014-7231). All Cinder, Nova and Trove setups are affected. Kilo (development branch) fixes: https://review.openstack.org/116927 (Cinder) https://review.openstack.org/126052 (Cinder ssh_execute) https://review.openstack.org/116982 (Nova) https://review.openstack.org/126047 (Nova ssh_execute) https://review.openstack.org/121417 (Trove) Juno (proposed branch) fixes: https://review.openstack.org/126594 (Nova ssh_execute) https://review.openstack.org/126592 (Cinder ssh_execute) Icehouse fixes: https://review.openstack.org/121382 (Cinder) https://review.openstack.org/126665 (Cinder ssh_execute) https://review.openstack.org/121096 (Nova) https://review.openstack.org/126699 (Nova ssh_execute) https://review.openstack.org/121416 (Trove) Notes: The former patch did not cover the ssh_execute method used in Nova and Cinder, thus two more patches are required for these projects. Nova and Cinder fixes are included in the 2014.2rc2 release candidate and will appear in a future 2014.1.4 release. Trove fix was included in the 2014.2rc1 release candidate and 2014.1.3 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7230 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7231 https://launchpad.net/bugs/1377981 https://launchpad.net/bugs/1343604 https://launchpad.net/bugs/1345233 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OSSA 2014-035] Nova VMware driver may connect VNC to another tenant's console (CVE-2014-8750)
by Jeremy Stanley 14 Oct '14

14 Oct '14

OpenStack Security Advisory: 2014-035 CVE: CVE-2014-8750 Date: October 14, 2014 Title: Nova VMware driver may connect VNC to another tenant's console Reporter: Marcio Roberto Starke Products: Nova Versions: up to 2014.1.3 Description: Marcio Roberto Starke reported a vulnerability in the Nova VMware driver. A race condition in its VNC port allocation may cause it to connect the wrong console if instances are created concurrently. By repeatedly spawning new instances, an authenticated user may be able to gain unauthorized console access to instances belonging to other tenants. Only Nova setups using the VMware driver and the VNC proxy service are affected. Juno (development branch) fix: https://review.openstack.org/114548 Icehouse fix: https://review.openstack.org/126425 Notes: This fix was included in the 2014.2rc1 release candidate and will appear in a future 2014.1.4 stable point release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8750 https://launchpad.net/bugs/1357372 -- Jeremy Stanley OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Oct 3 - 10)
by Stefano Maffulli 10 Oct '14

10 Oct '14

1 0

[OSSA 2014-034] Swift metadata constraints are not correctly enforced (CVE-2014-7960)
by Thierry Carrez 09 Oct '14

09 Oct '14

OpenStack Security Advisory: 2014-034 CVE: CVE-2014-7960 Date: October 09, 2014 Title: Swift metadata constraints are not correctly enforced Reporter: Rajaneesh Singh Products: Swift Versions: up to 2.1.0 Description: Rajaneesh Singh reported a vulnerability in the way Swift enforces metadata constraints. By adding metadata in several separate calls, an authenticated attacker can bypass the max_meta_count constraint, potentially resulting in the storage of more metadata than allowed in configuration. Juno (development branch) fix: https://review.openstack.org/125360 Icehouse fix: https://review.openstack.org/126645 Notes: This fix will be included in the upcoming 2.2.0 Juno release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7960 https://launchpad.net/bugs/1365350 -- Thierry Carrez OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Sep 26 - Oct 3)
by Stefano Maffulli 04 Oct '14

04 Oct '14

1 0

OpenStack 2014.1.3 released
by Adam Gandelman 03 Oct '14

03 Oct '14

Hello everyone, The OpenStack Stable Maintenance team is happy to announce the 2014.1.3 stable Icehouse release. We have been busy reviewing and accepting backported bugfixes to the stable/icehouse branches according to the criteria set at: https://wiki.openstack.org/wiki/StableBranch A total of 131 bugs have been fixed across all projects since 2014.1.2. These updates to Icehouse are intended to be low risk with no intentional regressions or API changes. The list of bugs, tarballs and other milestone information for each project may be found on Launchpad: https://launchpad.net/ceilometer/icehouse/2014.1.3 https://launchpad.net/cinder/icehouse/2014.1.3 https://launchpad.net/glance/icehouse/2014.1.3 https://launchpad.net/heat/icehouse/2014.1.3 https://launchpad.net/horizon/icehouse/2014.1.3 https://launchpad.net/keystone/icehouse/2014.1.3 https://launchpad.net/neutron/icehouse/2014.1.3 https://launchpad.net/nova/icehouse/2014.1.3 https://launchpad.net/trove/icehouse/2014.1.3 Release notes may be found on the wiki: https://wiki.openstack.org/wiki/ReleaseNotes/2014.1.3 The freeze on the stable/icehouse branches will be lifted today as we begin working toward 2014.1.4, which will be released on a TBD date after the Kilo-3 release. Thanks, Adam

1 0

[OSSA 2014-033] Cinder-volume host data leak to vm instance (CVE-2014-3641)
by Tristan Cacqueray 03 Oct '14

03 Oct '14

OpenStack Security Advisory: 2014-033 CVE: CVE-2014-3641 Date: October 02, 2014 Title: Cinder-volume host data leak to vm instance Reporter: Duncan Thomas (HP) Products: Cinder Versions: up to 2014.1.2 Description: Duncan Thomas from Hewlett Packard reported a vulnerability in Cinder GlusterFS and Linux Smbfs drivers. By overwriting a volume from within an instance with a malicious qcow2 header, an authenticated user may be able to clone and attach that corrupted volume resulting in affected drivers leaking an arbitrary file from the Cinder-volume host to the virtual instance. Note that the host file must be readable by the Cinder context to be exposed. Only Cinder setups using GlusterFS volume driver configured with glusterfs_qcow2_volumes=False (which is the default) or Cinder setups using Smbfs volume driver configured with smbfs_default_volume_format=raw (which is not the default) are affected. Juno (development branch) fix: https://review.openstack.org/125671 Icehouse fix: https://review.openstack.org/125710 Notes: This fix will be included in the Juno release 2014.2 and in the upcoming 2014.1.3 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3641 https://launchpad.net/bugs/1350504 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OSSA 2014-032] Nova VMware driver still leaks rescued images (CVE-2014-3608)
by Tristan Cacqueray 02 Oct '14

02 Oct '14

OpenStack Security Advisory: 2014-032 CVE: CVE-2014-3608 Date: October 2, 2014 Title: Nova VMware driver still leaks rescued images Reporter: Garth Mollett (Red Hat) Products: Nova Versions: up to 2014.1.2 Description: Garth Mollett from Red Hat reported an incomplete fix to OSSA-2014-017 (CVE-2014-2573), a vulnerability affecting Nova. If an authenticated user places an instance into rescue, and then issues a suspend command it will cause the instance to enter an ERROR state. Nova does not clean up an instance in this state correctly upon deletion. An attacker can use this to launch a denial of service attack. Only setups using the Nova VMware driver are affected by this flaw. Juno (development branch) fix: https://review.openstack.org/94281/ Icehouse fix: https://review.openstack.org/109624/ Notes: This fix will be included in the Juno release 2014.2.0 and in the upcoming 2014.1.3 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3608 https://launchpad.net/bugs/1338830 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Havana End of Upstream Support Lifetime
by Jeremy Stanley 30 Sep '14

30 Sep '14

This is intended to serve as a reminder that The OpenStack Havana 2013.2.4 integrated point release[1] last Tuesday, September 23, marks the end of stable support for OpenStack Havana. All open changes for stable/havana branches of official projects have been marked abandoned, upstream testing for these has ceased, and the tips of these branches have been tagged "havana-eol" in preparation for branch deletion. The list of affected Git repositories is as follows: openstack-dev/devstack openstack-dev/grenade openstack/ceilometer openstack/cinder openstack/designate openstack/glance openstack/heat openstack/horizon openstack/keystone openstack/neutron openstack/nova openstack/openstack-manuals openstack/oslo-incubator openstack/oslo.config openstack/requirements openstack/swift openstack/tempest openstack/trove [1] http://lists.openstack.org/pipermail/openstack-announce/2014-September/0002… -- Jeremy Stanley

1 0

[OSSA 2014-031] Admin-only network attributes may be reset to defaults by non-privileged users (CVE-2014-6414)
by Grant Murphy 29 Sep '14

29 Sep '14

OpenStack Security Advisory: OSSA-2014-031 CVE: CVE-2014-6414 Date: September 29, 2014 Title: Admin-only network attributes may be reset to defaults by non-privileged users Reporter: Elena Ezhova (Mirantis) Products: Neutron Versions: up to 2013.2.4 and 2014.1 versions up to 2014.1.2 Description: Elena Ezhova from Mirantis reported a vulnerability in Neutron. By updating a network attribute with a default value a non-privileged user may reset admin-only network attributes. This may lead to unexpected behavior with security implications for operators with a custom policy.json, or in some extreme cases network outages resulting in denial of service. All deployments using neutron networking are affected by this flaw. Juno (development branch) fix: https://review.openstack.org/114531 Icehouse fix: https://review.openstack.org/123849 Notes: This fix will be included in the Juno release 2014.2.0 and in future 2014.1.3 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6414 https://launchpad.net/bugs/1357379 -- Grant Murphy OpenStack Vulnerability Management Team

1 0