- OpenStack-announce - lists.openstack.org

[OSSA 2014-016] Heat template URL information leakage (CVE-2014-3801)
by Tristan Cacqueray 23 May '14

23 May '14

OpenStack Security Advisory: 2014-016 CVE: CVE-2014-3801 Date: May 23, 2014 Title: Heat template URL information leakage Reporter: Jason Dunsmore (Rackspace) Products: Heat Versions: 2013.2 to 2013.2.3, and 2014.1 Description: Jason Dunsmore from Rackspace reported a vulnerability in Heat. An authenticated user may temporarily see the URL of a provider template used in another tenant by listing heat resources types. This may result in disclosure of additional information if the template itself can be accessed. The URL disappears from the listing after a certain point in the stack creation. All Heat setups are affected. Juno (development branch) fix: https://review.openstack.org/89695 Icehouse fix: https://review.openstack.org/94625 Havana fix: https://review.openstack.org/94644 Notes: This fix will be included in the juno-1 development milestone and in future 2013.2.4 and 2014.1.1 releases. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3801 https://launchpad.net/bugs/1311223 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

New release of python-swiftclient (now with py3 support)
by John Dickinson 23 May '14

23 May '14

I'm happy to announce that python-swiftclient 2.1.0 has just been released! https://pypi.python.org/pypi/python-swiftclient/ This release includes support for Python 3.3. I want to specifically thank Tristan Cacqueray, Chmouel Boudjnah, Alex Gaynor, and Christian Schwede for working on the py3 compatibility. --John

1 0

[OSSA 2014-015] Keystone user and group id mismatch (CVE-2014-0204)
by Tristan Cacqueray 22 May '14

22 May '14

OpenStack Security Advisory: 2014-015 CVE: CVE-2014-0204 Date: May 21, 2014 Title: Keystone user and group id mismatch Reporter: Michael Stancampiano (IBM) Products: Keystone Versions: 2014.1 Description: Michael Stancampiano from IBM reported a vulnerability in Keystone. Someone with write access to the user and group repository (such as the LDAP directory server) may willingly or unwillingly grant additional rights by picking the same IDs for users and groups, resulting in roles assigned to a group being assigned to the affected user even if he is not a member of this group. Only Keystone setups using LDAP for the Identity driver are affected. Juno (development branch) fixes: https://review.openstack.org/94396 https://review.openstack.org/94470 Icehouse fix: https://review.openstack.org/94397 Notes: This fix will be included in the juno-1 development milestone and in a future 2014.1.1 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0204 https://launchpad.net/bugs/1309228 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Apr 25 – May 2)
by Stefano Maffulli 03 May '14

03 May '14

DefCore Core Capabilities Selection Criteria SIMPLIFIED -> how we are picking Core <http://robhirschfeld.com/2014/05/01/defcore-capabilities-selection/> Rob Hirschfeld <http://robhirschfeld.com/> summarizes the status of discussions within OpenStack community of what is ‘Openstack’. The effort is now summarized in a diagram showing the 12 criterias grouped in 4 main categories. Better go read Rob’s post, it’ll all make sense. Announcing the O’Reilly OpenStack Operations Guide <http://www.openstack.org/blog/2014/04/announcing-the-oreilly-openstack-oper…> O’Reilly has completed the production of the /OpenStack Operations Guide: Set Up and Manage Your OpenStack Cloud/. You can get your bits-n-bytes copy at http://docs.openstack.org/ops/ or order a dead-tree version on the O’Reilly site <http://shop.oreilly.com/product/0636920032625.do>. What It Means To Be In The OpenStack Community (One Member’s Take) <http://cloudarchitectmusings.com/2014/04/28/what-it-means-to-be-in-the-open…> What is Kenneth Hui <http://cloudarchitectmusings.com/>, Rackspace Technology Evangelist, deeply committed member of OpenStack, doing at a CloudStack conference? Read his blog post to find out what it means to be a good citizen of a community. Results of the TC Election <http://lists.openstack.org/pipermail/openstack-announce/2014-April/000229.h…> Please join me in congratulating the 7 newly elected members of the TC: Thierry Carrez, Jay Pipes, Vishvananda Ishaya, Michael Still, Jim Blair, Mark McClain, Devananda van der Veen. Full results: Full results <http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_d34934c9fd1f6282>. The road to Juno Summit – Atlanta 2014 * Applying for Visa? Looking for accommodation in Atlanta? Visit http://openstack.org/summit * Check the official agenda <http://openstacksummitmay2014atlanta.sched.org/> Tips ‘n Tricks * By Assaf Muller <http://assafmuller.wordpress.com/>: Introduction to Neutron <http://assafmuller.wordpress.com/2014/05/02/introduction-to-neutron/> * By Ramon Acedo <http://trickycloud.wordpress.com/>: Multiple Private Networks with Open vSwitch GRE Tunnels and Libvirt <http://trickycloud.wordpress.com/2014/05/02/multiple-private-networks-with-…> * By dudo <http://blog.zhaw.ch/icclab/manage-instance-startup-order-in-openstack-heat-…>: Manage instance startup order in OpenStack Heat Templates <http://blog.zhaw.ch/icclab/manage-instance-startup-order-in-openstack-heat-…> * By Loïc Dachary <http://dachary.org/>: Two minor pitfalls when upgrading Havana stable <http://dachary.org/?p=2948> and Resetting an instance {power,vm,task}_state in Havana <http://dachary.org/?p=2939> * By Sean Dague <https://dague.net/>: Helpful Gerrit Queries (Gerrit 2.8 edition) <https://dague.net/2014/04/30/helpful-gerrit-queries-gerrit-2-8-edition/> * By Rob Hirschfeld <http://robhirschfeld.com/>: Success Factors of Operating Open Source Infrastructure [Series Intro] <http://robhirschfeld.com/2014/04/29/openops-success-factors/> and Reference Deployments are Critical [2/4 series on Operating Open Source Infrastructure] <http://robhirschfeld.com/2014/04/29/reference-deployments/> * By Piyush Harsh <http://blog.zhaw.ch/icclab/managing-hosts-in-a-running-openstack-environmen…>: Managing hosts in a running OpenStack environment <http://blog.zhaw.ch/icclab/managing-hosts-in-a-running-openstack-environmen…> * By Nathan Kinder <https://blog-nkinder.rhcloud.com/>: Secure messaging with Kite <https://blog-nkinder.rhcloud.com/?p=62> * By Andy Edmonds <http://blog.zhaw.ch/icclab/getting-started-with-openshift-and-openstack/>: Getting Started with OpenShift and OpenStack <http://blog.zhaw.ch/icclab/getting-started-with-openshift-and-openstack/> Reports from Previous Events * What’s new in the OpenStack Heat Icehouse release <https://plus.google.com/u/0/events/ckhqrki6iepg12vkqk5vnt7ijd0> * Asia Pacific: How to launch, run & grow OpenStack User Groups <https://www.youtube.com/watch?v=2XPa_d2XnWY> Upcoming Events * OpenStack Brasil User Group Meeting @ FISL15 <http://softwarelivre.org/fisl15> May 07 – 10, 2014 – Porto Alegre, Brasil Details <http://softwarelivre.org/fisl15> * OpenStack DACH Day at LinuxTag 2014 <http://www.linuxtag.org/2014/en/#openstack> May 09, 2014 – Berlin, Germany Details <http://www.linuxtag.org/2014/en/#openstack> * OpenStack Summit May 2014 <http://www.openstack.org/summit/openstack-summit-atlanta-2014/> May 12 – 16, 2014 – Atlanta, GA Details <http://www.openstack.org/summit/openstack-summit-atlanta-2014/> * SFBay OpenStack Hackathon #OSSFO <http://www.meetup.com/openstack/> May 15, 2014 – Details <http://www.meetup.com/openstack/> * Gartner IT Infrastructure Operations & Data Center Summit <http://www.gartner.com/technology/summits/apac/data-center/> May 21 – 22, 2014 – Sydney, Australia Details <http://www.gartner.com/technology/summits/apac/data-center/> * OpenStack Study Group <http://www.nycresistor.com/2014/04/17/openstack-study-group-may-21/> May 21, 2014 – Brooklyn, NY Details <http://www.nycresistor.com/2014/04/17/openstack-study-group-may-21/> * OpenStack in Action <http://www.openstackinaction.fr/en/> May 28, 2014 – Paris, France Details <http://www.openstackinaction.fr/en/> * OpenStack CEE Day <http://www.eventbrite.com/e/openstack-cee-day-2014-tickets-11161407069?aff=…> May 28, 2014 – Budapest, Hungary Details <http://www.eventbrite.com/e/openstack-cee-day-2014-tickets-11161407069?aff=…> * SFBay OpenStack Hackathon #OSSFO <http://www.meetup.com/openstack/> May 29, 2014 – Details <http://www.meetup.com/openstack/> * #1 OpenStack Day <http://www.meetup.com/OpenStack-User-Group-Italia/events/176817882/> May 30, 2014 – Milan, Italy Details <http://www.meetup.com/OpenStack-User-Group-Italia/events/176817882/> * OpenStack Israel Event <http://www.meetup.com/IGTCloud/events/157265772/> Jun 02, 2014 – Herzliya, Israel Details <http://www.meetup.com/IGTCloud/events/157265772/> * OpenStack UK Day in London <http://www.eventbooking.uk.com/openstack/index.php> Jun 04, 2014 – London, UK Details <http://www.eventbooking.uk.com/openstack/index.php> * SFBay Meetup – Beginner track <http://www.meetup.com/openstack/events/123227662/> Jun 05, 2014 – Sunnyvale, CA Details <http://www.meetup.com/openstack/events/123227662/> * SFBay OpenStack Hackathon #OSSFO <http://www.meetup.com/openstack/> Jun 12, 2014 – Details <http://www.meetup.com/openstack/> * Cloud World Forum <http://cloudwf.com/> Jun 17 – 18, 2014 – London, UK Details <http://cloudwf.com/> * Cloud World Forum <http://cloudwf.com/> Jun 17 – 18, 2014 – London, UK Details <http://cloudwf.com/> * SFBay Meetup – Beginner track <http://www.meetup.com/openstack/events/150932472/> Jul 03, 2014 – Sunnyvale, CA Details <http://www.meetup.com/openstack/events/150932472/> * OSCON <http://www.oscon.com/oscon2014> Jul 20 – 24, 2014 – Portland, Oregon Details <http://www.oscon.com/oscon2014> * SFBay Meetup – Beginner track <http://www.meetup.com/openstack/events/150932532/> Aug 07, 2014 – Sunnyvale, CA Details <http://www.meetup.com/openstack/events/150932532/> * OpenStack Summit November 2014 <http://openstack.org/summit> Nov 03 – 08, 2014 – Paris, France Details <http://openstack.org/summit> Other News * OpenStack, Icehouse and Red Hat Enterprise Linux 7 – Available Now <http://redhatstackblog.redhat.com/2014/05/02/openstack-icehouse-and-red-hat…> * Oracle adds OpenStack to updated Solaris <http://www.computerworld.com/s/article/9247998/Oracle_adds_OpenStack_to_upd…> * Updated: SUSE Cloud 3 Admin Appliance 1.2.0 available <http://blog.seader.us/2014/04/updated-suse-cloud-3-admin-appliance_25.html> * Project Solum Goes Full Steam Ahead To Milestone 1 <http://www.rackspace.com/blog/project-solum-goes-full-steam-ahead-to-milest…> * #OpenStack Israel Podcast – Episode 9 is out! <http://cloudifysource.tumblr.com/post/84132078901> * Nagios / Ceilometer integration: new plugin available <http://blog.zhaw.ch/icclab/nagios-ceilometer-integration-new-plugin-availab…> * Improving libvirt firewall performance <https://www.berrange.com/posts/2014/05/02/improving-libvirt-firewall-perfor…> * Why We Craft OpenStack (Featuring Rackspace Software Development Manager Glen Campbell) <http://www.rackspace.com/blog/why-we-craft-openstack-featuring-rackspace-so…> * Why We Craft OpenStack (Featuring Rackspace Principal Engineer Chuck Thier) <http://www.rackspace.com/blog/why-we-craft-openstack-featuring-rackspace-pr…> * Open Mic Spotlight: Lucas Gomes <http://www.openstack.org/blog/2014/05/5926/> * Networking in Cloud Environments, SDN, NFV, and why it matters [part 1 of 2] <http://robhirschfeld.com/2014/05/01/networking-in-cloud-1/> * KVM and Docker LXC Benchmarking with OpenStack <http://bodenr.blogspot.com/2014/05/kvm-and-docker-lxc-benchmarking-with.html> * OpenCrowbar.Anvil released – hammering out a gold standard in open bare metal provisioning <http://robhirschfeld.com/2014/04/30/opencrowbar-anvil/> * HP is running a survey for release at the Summit <https://www.surveymonkey.com/s/SM1OpenStack> * OpenStack Project Meeting: didn’t happen this week Got Answers? Ask OpenStack <https://ask.openstack.org/> is the go-to destination for OpenStack users. Interesting questions waiting for answers: * What causes ‘Namespace’ object has no attribute ‘volume’ restoring a Cinder backup? <https://ask.openstack.org/en/question/28362/what-causes-namespace-object-ha…> * How to use filtering queries in Ceilometer via CLI? <https://ask.openstack.org/en/question/28512/how-to-use-filtering-queries-in…> * Unable to load quantum from configuration file /etc/neutron/api-paste.ini – Icehouse <https://ask.openstack.org/en/question/28431/unable-to-load-quantum-from-con…> * Configure multiple External network <https://ask.openstack.org/en/question/28428/configure-multiple-external-net…> * Instance not taking IP form The DHCP and Gateway router external port down? <https://ask.openstack.org/en/question/28391/instance-not-taking-ip-form-the…> Welcome New Reviewers and Developers Christina Darretta <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Abhinav Agrawal <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Sam Hague <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Gabriel Assis Bezerra <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Obulapathi <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Michael Tupitsyn <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> yummy.bian <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Laurel Michaels <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Tushar Gohad <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Karin Levenstein <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Karin Levenstein <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Baohua Yang <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Andrew James <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Tushar Gohad <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Latest Activity In Projects Do you want to see at a glance the bugs filed and solved this week? Latest patches submitted for review? Check out the individual project pages on OpenStack Activity Board – Insights <http://activity.openstack.org/data/display/OPNSTK2/>. * Telemetry (Ceilometer) <http://activity.openstack.org/data/display/OPNSTK2/ceilometer> * Block Storage (Cinder) <http://activity.openstack.org/data/display/OPNSTK2/cinder> * Image Service (Glance) <http://activity.openstack.org/data/display/OPNSTK2/glance> * Orchestration API <http://activity.openstack.org/data/display/OPNSTK2/heat> (Heat) <http://activity.openstack.org/data/display/OPNSTK2/heat> * Dashboard (Horizon) <http://activity.openstack.org/data/display/OPNSTK2/horizon> * Bare Metal Provisioning (Ironic) <http://activity.openstack.org/data/display/OPNSTK2/ironic> * Identity (Keystone) <http://activity.openstack.org/data/display/OPNSTK2/keystone> * Manuals <http://activity.openstack.org/data/display/OPNSTK2/openstack-manuals> * Networking (Neutron) <http://activity.openstack.org/data/display/OPNSTK2/neutron> * Compute (Nova) <http://activity.openstack.org/data/display/OPNSTK2/nova> * Data Processing (Sahara) <http://stackalytics.com/?release=icehouse&metric=commits&project_type=opens…> * Object Storage (Swift) <http://activity.openstack.org/data/display/OPNSTK2/swift> * Database As A Service (Trove <http://activity.openstack.org/data/display/OPNSTK2/trove> /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

Results of the TC Election
by Anita Kuno 25 Apr '14

25 Apr '14

Please join me in congratulating the 7 newly elected members of the TC. * Thierry Carrez * Jay Pipes * Vishvananda Ishaya * Michael Still * Jim Blair * Mark McClain * Devananda van der Veen Full results: http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_d34934c9fd1f6282 Thank you to all candidates who stood for election, having a good group of candidates helps engage the community in our democratic process, Thank you to all who voted and who encouraged others to vote. We need to ensure your voice is heard. Thanks to my fellow election official, Tristan Cacqueray, I appreciate your help and perspective. Thank you for another great round. Here's to Juno, Anita.

1 0

OpenStack Community Weekly Newsletter (Apr 18 – 25)
by Stefano Maffulli 25 Apr '14

25 Apr '14

1 0

[OSSA 2014-014] Neutron security groups bypass through invalid CIDR (CVE-2014-0187)
by Tristan Cacqueray 22 Apr '14

22 Apr '14

OpenStack Security Advisory: 2014-014 CVE: CVE-2014-0187 Date: April 22, 2014 Title: Neutron security groups bypass through invalid CIDR Reporters: Stephen Ma (HP) and Christoph Thiel (Deutsche Telekom) Products: Neutron Versions: 2013.1 to 2013.2.3, and 2014.1 Description: Stephen Ma from Hewlett Packard and Christoph Thiel from Deutsche Telekom reported a vulnerability in Neutron security groups. By creating a security group rule with an invalid CIDR, an authenticated user may break openvswitch-agent process, preventing further rules from being applied on the host. Note: removal of the faulty rule is not enough, the openvswitch-agent must be restarted. All Neutron setups using Open vSwitch are affected. Juno (development branch) fix: https://review.openstack.org/59212 Icehouse fix: https://review.openstack.org/88674 Havana fix: https://review.openstack.org/88057 Notes: This fix will be included in the juno-1 development milestone and in future 2013.2.4 and 2014.1.1 releases. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0187 https://launchpad.net/bugs/1300785 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Apr 11 – 18)
by Stefano Maffulli 18 Apr '14

18 Apr '14

1 0

OpenStack 2014.1 ("Icehouse") is released !
by Thierry Carrez 17 Apr '14

17 Apr '14

Hi everyone, I'm proud to announce the final release of OpenStack 2014.1, code-named "Icehouse". This marks the completion of a 6-month journey which started at the Icehouse Design Summit in Hong-Kong. During this cycle we added a new integrated component (Trove), completed more than 350 feature blueprints and fixed almost 3000 reported bugs in integrated projects alone ! You can find source tarballs for each integrated project, together with complete lists of features and bugfixes, at the following links: Compute (Nova): https://launchpad.net/nova/icehouse/2014.1 Object Storage (Swift): https://launchpad.net/swift/icehouse/1.13.1 Image Service (Glance): https://launchpad.net/glance/icehouse/2014.1 Networking (Neutron): https://launchpad.net/neutron/icehouse/2014.1 Block Storage (Cinder): https://launchpad.net/cinder/icehouse/2014.1 Identity (Keystone): https://launchpad.net/keystone/icehouse/2014.1 Dashboard (Horizon): https://launchpad.net/horizon/icehouse/2014.1 Telemetry (Ceilometer): https://launchpad.net/ceilometer/icehouse/2014.1 Orchestration (Heat): https://launchpad.net/heat/icehouse/2014.1 Database Service (Trove): https://launchpad.net/trove/icehouse/2014.1 The Icehouse Release Notes contain an overview of the key features, as well as upgrade notes and current lists of known issues. You can access them at: https://wiki.openstack.org/wiki/ReleaseNotes/Icehouse Thanks to the hundreds of people who contributed to this development cycle and helped in making this release great ! -- Thierry Carrez (ttx)

1 0

PTL Election Conclusion and Results
by Anita Kuno 11 Apr '14

11 Apr '14

Thank you to the electorate, to all those who voted and to all candidates who put their name forward for PTL for this election. A healthy, open process breeds trust in our decision making capability - thank you to all those who make this process possible. Now for the results of the PTL election process, please join me in extending congratulations to the following PTLs: * Compute (Nova) ** Michael Still * Object Storage (Swift) ** John Dickinson * Image Service (Glance) ** Mark Washenberger * Identity (Keystone) ** Dolph Mathews * Dashboard (Horizon) ** David Lyle * Networking (Neutron) ** Kyle Mestery * Block Storage (Cinder) ** John Griffith * Metering/Monitoring (Ceilometer) ** Eoghan Glynn * Orchestration (Heat) ** Zane Bitter * Database Service (Trove) ** Nikhil Manchanda * Bare metal (Ironic) ** Devananda van der Veen * Common Libraries (Oslo) ** Doug Hellmann * Infrastructure ** Jim Blair * Documentation ** Anne Gentle * Quality Assurance (QA) ** Matt Treinish * Deployment (TripleO) ** Robert Collins * Devstack (DevStack) ** Dean Troyer * Release cycle management ** Thierry Carrez * Queue Service (Marconi) ** Kurt Griffiths * Data Processing Service (Sahara) ** Sergey Lukjanov * Key Management Service (Barbican) ** Jarret Raim Election Results: * Nova: http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_e295a4530c19f691 * Neutron: http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_230fb7953010b219 * Cinder: http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_cdc16bb61aacc74a * Ceilometer: http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_18b9e8d39c82df0b * Heat: http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_e0f670cec964fef8 * TripleO: http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_eeaa27c0de8c9a51 Shortly I will post the announcement opening TC nominations and then we are into the TC election process. Thank you to all involved in the PTL election process, Anita.

1 0