- OpenStack-announce - lists.openstack.org

[OSSA 2014-026] Multiple vulnerabilities in Keystone revocation events (CVE-2014-5251, CVE-2014-5252, CVE-2014-5253)
by Tristan Cacqueray 15 Aug '14

15 Aug '14

OpenStack Security Advisory: 2014-026 CVE: CVE-2014-5251, CVE-2014-5252, CVE-2014-5253 Date: August 15, 2014 Title: Multiple vulnerabilities in Keystone revocation events Reporter: Lance Bragstad (Rackspace) - CVE-2014-5252 Brant Knudson (IBM) - CVE-2014-5251, CVE-2014-5253 Products: Keystone Versions: 2014.1 versions up to 2014.1.1 Description: Lance Bragstad from Rackspace and Brant Knudson from IBM reported 3 vulnerabilities in Keystone revocation events. Lance Bragstad discovered that UUID v2 tokens processed by the V3 API are incorrectly updated and get their "issued_at" time regenerated (CVE-2014-5252). Brant Knudson discovered that the MySQL token driver stores expiration dates incorrectly which prevents manual revocation (CVE-2014-5251) and that domain-scoped tokens don't get revoked when the domain is disabled (CVE-2014-5253). Tokens impacted by one of these bugs may allow a user to evade token revocation. Only Keystone setups configured to use revocation events are affected. Juno (development branch) fix: https://review.openstack.org/111106 https://review.openstack.org/109747 https://review.openstack.org/109819 https://review.openstack.org/109820 Icehouse fix: https://review.openstack.org/112087 https://review.openstack.org/111772 https://review.openstack.org/112083 https://review.openstack.org/112084 Notes: These fixes will be included in the Juno-3 development milestone and are already included in the 2014.1.2.1 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5251 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5252 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5253 https://launchpad.net/bugs/1347961 https://launchpad.net/bugs/1348820 https://launchpad.net/bugs/1349597 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Aug 1 – 8)
by Stefano Maffulli 09 Aug '14

09 Aug '14

1 0

Keystone 2014.1.2
by Chuck Short 09 Aug '14

09 Aug '14

An issue was discovered with Keystone 2014.1.2 stable release tarball shortly after it was uploaded on the release page at: https://launchpad.net/keystone/icehouse/2014.1.2 A new tarball corresponding to 2014.1.2 code was generated and uploaded: md5sum: c8a85fc2ac76679eb1b674e0c2c65e36 keystone-2014.1.2.tar.gz sha1sum: c1d481d8b330e50da5ace19c23e5909c04fa1cba keystone-2014.1.2.tar.gz Please double-check that you got the right one. Regards chuck

2 1

OpenStack 2014.1.2 released
by Chuck Short 08 Aug '14

08 Aug '14

Hello everyone, The OpenStack Stable Maintenance team is happy to announce the release of the 2014.1.2 stable Icehouse release. We have been busy reviewing and accepting backported bugfixes to the stable/icehouse branches according to the criteria set at: https://wiki.openstack.org/wiki/StableBranch A total of 157 bugs have been fixed across all projects. These updates to Icehouse are intended to be low risk with no intentional regressions or API changes. The list of bugs, tarballs and other milestone information for each project may be found on Launchpad: https://launchpad.net/ceilometer/icehouse/2014.1.2https://launchpad.net/cin… Release notes may be found on the wiki: https://wiki.openstack.org/wiki/ReleaseNotes/2014.1.2 The freeze on the stable/icehouse branches will be lifted today as we begin working toward the 2014.1.3 release, planned for Oct 2 release and managed by Adam Gandelman. Thanks, chuck

1 0

OpenStack Community Weekly Newsletter (July 25 - Aug 1)
by Stefano Maffulli 02 Aug '14

02 Aug '14

1 0

OpenStack Community Weekly Newsletter (July 18 – 25)
by Stefano Maffulli 25 Jul '14

25 Jul '14

1 0

Juno-2 development milestone available
by Russell Bryant 24 Jul '14

24 Jul '14

Hello everyone, The second milestone of the Juno development cycle, "juno-2" is now available for Keystone, Glance, Nova, Horizon, Neutron, Cinder, Ceilometer, Heat, Trove, and Sahara. It contains features and bug fixes that have been implemented since the first milestone, "juno-1". You can find the full list of new features, fixed bugs, and tarball downloads at: https://launchpad.net/keystone/juno/juno-2 https://launchpad.net/glance/juno/juno-2 https://launchpad.net/nova/juno/juno-2 https://launchpad.net/horizon/juno/juno-2 https://launchpad.net/neutron/juno/juno-2 https://launchpad.net/cinder/juno/juno-2 https://launchpad.net/ceilometer/juno/juno-2 https://launchpad.net/heat/juno/juno-2 https://launchpad.net/trove/juno/juno-2 https://launchpad.net/sahara/juno/juno-2 Including the oslo libraries, 68 blueprints were implemented and more than 650 bugs were fixed during this milestone. The next development milestone, juno-3, is scheduled for September 4th. You can further track upcoming features and Juno release cycle status at: http://status.openstack.org/release/ Regards, -- Russell Bryant

1 0

python-swiftclient 2.2.0 release
by John Dickinson 22 Jul '14

22 Jul '14

I'm happy to announce that python-swiftclient 2.2.0 has been released. This release has the following significant features: * Ability to set a storage policy on container and object upload * Ability to generate Swift temporary URLs from the CLI and SDK * Added context-sensitive help to the CLI commands This release is available on PyPI at https://pypi.python.org/pypi/python-swiftclient/2.2.0 --John

1 0

[OSSA 2014-025] Denial of Service in Neutron allowed address pair (CVE-2014-3555)
by Tristan Cacqueray 21 Jul '14

21 Jul '14

OpenStack Security Advisory: 2014-025 CVE: CVE-2014-3555 Date: July 17, 2014 Title: Denial of Service in Neutron allowed address pair Reporter: Liping Mao (Cisco) Products: Neutron Versions: up to 2013.2.3, and 2014.1 versions up to 2014.1.1 Description: Liping Mao from Cisco reported a denial of service vulnerability in Neutron's handling of allowed address pair. By creating a large number of allowed address pairs, an authenticated user may overwhelm neutron firewall rules and render compute nodes unusable. All Neutron setups are affected. Juno (development branch) fix: https://review.openstack.org/107734 Icehouse fix: https://review.openstack.org/107733 Havana fix: https://review.openstack.org/107731 Notes: This fix will be included in the Juno-2 development milestone and in future 2013.2.4 and 2014.1.2 releases. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3555 https://launchpad.net/bugs/1336207 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (July 11 – 18)
by Stefano Maffulli 19 Jul '14

19 Jul '14

DefCore Update: Input Request for Havana Capabilities <http://www.openstack.org/blog/2014/07/defcore-update-input-request-for-hava…> As part of our community’s commitment to interoperability, the OpenStack Board of Directors has been working to make sure that “downstream” OpenStack-branded commercial products offer the same baseline functionality and include the same upstream, community-developed code. The work to define these required core capabilities and code has been led by the DefCore Committee co-chaired by Rob Hirschfeld (his DefCore blog <http://robhirschfeld.com/?s=defcore&submit=Search>) and Joshua McKenty (his post <http://www.pistoncloud.com/2014/05/openstack-defcore-review-time/>). You can read more about the committee history and rationale in Mark Collier’s blog post <http://www.openstack.org/blog/2014/01/openstack-commitment-to-interoperabil…>. The next deadlines are: OSCON on July 21, 11:30 am PDT <http://www.oscon.com/oscon2014/public/schedule/detail/37014> and the Board Meeting on July 22nd. And the K cycle will be named… Kilo ! <http://lists.openstack.org/pipermail/openstack/2014-July/008447.html> The results of the poll are just in, and the winner proposal is “Kilo”. “k” is the unit symbol for “kilo”, a SI unit prefix (derived from the Greek word ?????? which means “thousand”). “Kilo” is often used as a shorthand for “kilogram”, and the kilogram is the last SI base unit to be tied to a reference artifact (stored near Paris in the Pavillon de Breteuil in Sèvres). Five Days + Twelve Writers + One Book Sprint = One Excellent Book on OpenStack Architecture <http://www.openstack.org/blog/2014/07/five-days-twelve-writers-one-book-spr…> Adozen OpenStack experts and writers from companies across the OpenStack ecosystem gathered at VMware’s Palo Alto campus for the OpenStack Architecture Design Guide book sprint. The intent was to deliver a completed book aimed architects and evaluators, on designing OpenStack clouds — in just five days. Only developers should file specifications and blueprints <http://maffulli.net/2014/07/14/only-developers-should-file-specifications-a…> If you try to solve a problem with the wrong tool you’re likely going to have a frustrating experience. OpenStack developersuse blueprints define the roadmap for the various projects, the specifications attached to a blueprint are used to discuss the implementation details before code is submitted for review. Operators and users in general don’t need to dive in the details of how OpenStack developers organize their work and definitely should never be asked to use tools designed for and by developers. Third Party CI group formation and minutes At this week’s meeting the Third-Party group continues to discuss documentation patches, including a new terminology proposal, as well as CI system naming, logging and test timing. There was also a summary review of the current state of Neutron driver CI rollout. Anyone deploying a third-party test system or interested in easing third-party involvement is welcome to attend the meetings. Minutes of ThirdParty meetings <https://wiki.openstack.org/wiki/Meetings/ThirdParty>are carefully logged. The Road To Paris 2014 – Deadlines and Resources * Call for Speakers now OPEN – November Summit in Paris <http://www.openstack.org/blog/2014/07/call-for-speakers-now-open-november-s…> * Applications for Travel Support Program are open until August 18th <https://wiki.openstack.org/wiki/Travel_Support_Program> * Request an invitation letter for VISA <https://www.openstack.org/summit/openstack-paris-summit-2014/visa-informati…> * Reserve hotel rooms <https://www.openstack.org/summit/openstack-paris-summit-2014/hotels/> Security Advisories and Notices * [OSSA 2014-024] Use of non-constant time comparison operation (CVE-2014-3517) <http://lists.openstack.org/pipermail/openstack-announce/2014-July/000253.ht…> Tips ‘n Tricks * By Cody Bunch <http://openstack.prov12n.com/>: USB Key Duplication on OSX on the Cheap <http://openstack.prov12n.com/usb-key-duplication-on-osx-on-the-cheap/> (only marginally about OpenStack but neat) * By Manishanker Talusani <http://manishankert.blogspot.com/search/label/openstack>: How to contribute to Openstack <http://manishankert.blogspot.com/2014/05/how-to-contribute-to-openstack.html> * By Kevin Jackson <http://www.rackspace.com/blog/inside-my-home-rackspace-private-cloud-openst…>: Inside My Home Rackspace Private Cloud, OpenStack Lab, Part 7: LBaaS <http://www.rackspace.com/blog/inside-my-home-rackspace-private-cloud-openst…> Upcoming Events * 4th Birthday OpenStack Beijing <http://www.meetup.com/China-OpenStack-User-Group/events/191144122/> Jul 19, 2014 – Beijing, Beijing, CN Details <http://www.meetup.com/China-OpenStack-User-Group/events/191144122/> * OpenStack 4th Birthday Party <http://www.meetup.com/OpenStack-Russia/events/190197102/> Jul 19, 2014 – Moscow, Russia Details <http://www.meetup.com/OpenStack-Russia/events/190197102/> * OpenStack 4th Birthday Party <https://www.eventbrite.com/e/4to-aniversario-de-openstack-y-3er-encuentro-d…> Jul 19, 2014 – Caracas, Venezuela Details <https://www.eventbrite.com/e/4to-aniversario-de-openstack-y-3er-encuentro-d…> * OSCON <http://www.oscon.com/oscon2014> Jul 20 – 24, 2014 – Portland, Oregon Details <http://www.oscon.com/oscon2014> * OpenStack 4th Birthday Party <http://www.meetup.com/Indian-OpenStack-User-Group/events/188059912/> Jul 20, 2014 – Mumbai, India Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/188059912/> * Minnesota OpenStack Meetup <http://www.meetup.com/Minnesota-OpenStack-Meetup/> Jul 21, 2014 – MinneapolisSt. Paul, Minnesota, US Details <http://www.meetup.com/Minnesota-OpenStack-Meetup/> * OpenStack Tutorial and 4th Birthday Party <http://sciencecloud-community.cs.tu.ac.th/?p=102> Jul 21 – 23, 2014 – Thailand Details <http://sciencecloud-community.cs.tu.ac.th/?p=102> * The Fifth Elephant 2014 <https://fifthelephant.in/2014> Jul 23 – 26, 2014 – Bangalore, Karnataka, IN Details <https://fifthelephant.in/2014> * OpenStack 4th Anniversary – Munich <http://www.meetup.com/openstack-de/events/187306792/> Jul 23, 2014 – Munich, DE Details <http://www.meetup.com/openstack-de/events/187306792/> * OpenStack 4th Birthday Party <http://www.meetup.com/OpenStack-Seattle/events/173809092/> Jul 24, 2014 – Seattle, WA Details <http://www.meetup.com/OpenStack-Seattle/events/173809092/> * OpenStack 4th Birthday Party <http://www.meetup.com/Triangle-OpenStack-Meetup/events/188128342/> Jul 24, 2014 – Triangle, North Carolina Details <http://www.meetup.com/Triangle-OpenStack-Meetup/events/188128342/> * Openstack Brazil Day / 4th Birthday <http://openstackbr.com.br/eventos/openstack-brasil-day/> Jul 26, 2014 – Porto Alegre, RS, BR Details <http://openstackbr.com.br/eventos/openstack-brasil-day/> * OpenStack 4th Anniversary-Frankfurt <http://www.meetup.com/openstack-de/events/187307832/> Jul 28, 2014 – Frankfurt, DE Details <http://www.meetup.com/openstack-de/events/187307832/> * OpenStack 4th Anniversary – Berlin <http://www.meetup.com/openstack-de/events/187308322/> Jul 29, 2014 – Berlin, DE Details <http://www.meetup.com/openstack-de/events/187308322/> * OpenStack 4th BIrthday Party <http://www.meetup.com/OpenStack-Nairobi/events/184903312/> Jul 29, 2014 – Nairobi, Kenya Details <http://www.meetup.com/OpenStack-Nairobi/events/184903312/> * OpenStack miniconf at PyCon AU <http://openstack.pycon-au.org/> Aug 01 – 05, 2014 – Brisbane, Queensland, AU Details <http://openstack.pycon-au.org/> * SFBay Meetup – Beginner track <http://www.meetup.com/openstack/events/150932532/> Aug 07, 2014 – Sunnyvale, CA Details <http://www.meetup.com/openstack/events/150932532/> * OpenStack workshop at Fedora Flock <http://flock2014.sched.org/event/1d4b19e447ef9c55207791db8e8b1307#.U4_kH66V…> Aug 09, 2014 – Prague, Czech Republic, CZ Details <http://flock2014.sched.org/event/1d4b19e447ef9c55207791db8e8b1307#.U4_kH66V…> * Serviceability, Swift and OpenStack <http://www.meetup.com/Openstack-Boston/events/189349082/> Aug 14, 2014 – Boston, MA, US Details <http://www.meetup.com/Openstack-Boston/events/189349082/> * OpenStack Trove Day <http://www.tesora.com/event/openstack-trove-day> Aug 19, 2014 – Cambridge, MA, US Details <http://www.tesora.com/event/openstack-trove-day> * CloudOpen North America <http://events.linuxfoundation.org/events/cloudopen-north-america> Aug 20 – 22, 2014 – Chicago, IL Details <http://events.linuxfoundation.org/events/cloudopen-north-america> * OpenStack Silicon Valley <http://openstacksv.com/> Sep 16, 2014 – Mountain View, CA, US Details <http://openstacksv.com/> * OpenStack Conference Benelux 2014 <http://www.openstack.nl/OpenStack_Benelux_2014> Sep 19, 2014 – Bussum, The Netherlands Details <http://www.openstack.nl/OpenStack_Benelux_2014> * OpenStack Summit November 2014 <http://openstack.org/summit> Nov 03 – 07, 2014 – Paris, France Details <http://openstack.org/summit> Other News * OpenStack DefCore Review [interview by Jason Baker] <http://robhirschfeld.com/2014/07/16/openstack-defcore-review-interview-by-j…> * How DreamHost is reinventing itself with OpenStack <http://www.dreamhost.com/dreamscape/2014/07/16/how-dreamhost-is-reinventing…> * Widening the Engagement of the Hidden OpenStack Influencers <http://sarob.com/2014/07/widening-the-engagement-of-the-hidden-openstack-in…> * OpenStack Project Meeting: Summary <http://eavesdrop.openstack.org/meetings/project/2014/project.2014-07-01-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2014/project.2014-07-01-21.…>. Got Answers? Ask OpenStack <https://ask.openstack.org/> is the go-to destination for OpenStack users. Interesting questions waiting for answers: * User role association to tenant fails from dashboard with LDAP backend? <https://ask.openstack.org/en/question/43020/user-role-association-to-tenant…> * Deleting Network with Python httplib2 doesn’t work? <https://ask.openstack.org/en/question/42881/deleting-network-with-python-ht…> * Neutron floating IPs bounded to specific hosts <https://ask.openstack.org/en/question/42882/neutron-floating-ips-bounded-to…> * Icehouse: How to create a bootable snapshot from a running instance <https://ask.openstack.org/en/question/42804/icehouse-how-to-create-a-bootab…> Welcome New Reviewers and Developers Will Foster <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> zhangtralon <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Walter Heck <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Gael Chamoulaud <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Mithil Arun <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Fabrizio Fresco <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Kieran Forde <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> badveli_vishnuus <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> JJ Asghar <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Ryan Lucio <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Gilles Dubreuil <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Martin Falatic <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Emily Hugenbruch <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Bryan Jones <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Christian Hofstädtler <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Tri Hoang Vo <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Steven Hillman <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Ryan Rossiter <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Rajesh Tailor <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Mohit <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> akash <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Tushar Katarki <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Rajini Ram <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Pawel Skowron <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Pawel Skowron <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Karthik Natarajan <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Abhishek L <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Ryan Brown <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> takehirokaneko <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Keith Basil <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Kate Coyne <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Ju Lim <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Latest Activity In Projects Do you want to see at a glance the bugs filed and solved this week? Latest patches submitted for review? Check out the individual project pages on OpenStack Activity Board – Insights <http://activity.openstack.org/data/display/OPNSTK2/>. * Telemetry (Ceilometer) <http://activity.openstack.org/data/display/OPNSTK2/ceilometer> * Block Storage (Cinder) <http://activity.openstack.org/data/display/OPNSTK2/cinder> * Image Service (Glance) <http://activity.openstack.org/data/display/OPNSTK2/glance> * Orchestration API <http://activity.openstack.org/data/display/OPNSTK2/heat> (Heat) <http://activity.openstack.org/data/display/OPNSTK2/heat> * Dashboard (Horizon) <http://activity.openstack.org/data/display/OPNSTK2/horizon> * Bare Metal Provisioning (Ironic) <http://activity.openstack.org/data/display/OPNSTK2/ironic> * Identity (Keystone) <http://activity.openstack.org/data/display/OPNSTK2/keystone> * Manuals <http://activity.openstack.org/data/display/OPNSTK2/openstack-manuals> * Networking (Neutron) <http://activity.openstack.org/data/display/OPNSTK2/neutron> * Compute (Nova) <http://activity.openstack.org/data/display/OPNSTK2/nova> * Data Processing (Sahara) <http://activity.openstack.org/data/display/OPNSTK2/swift> * Object Storage (Swift) <http://activity.openstack.org/data/display/OPNSTK2/swift> * Database As A Service (Trove) <http://activity.openstack.org/data/display/OPNSTK2/trove> /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment/

1 0