- OpenStack-announce - lists.openstack.org

OpenStack Community Weekly Newsletter (Apr 4 – 11)
by Stefano Maffulli 11 Apr '14

11 Apr '14

Take the OpenStack User Survey and Change the (OpenStack) World <http://openstack.org/user-survey> Still a few more hours to fill in the OpenStack User Survey. Heartbleed <http://blogs.gnome.org/markmc/2014/04/10/heartbleed/> The bug discovered affecting OpenSSL and “breaking” internet doesn’t directly touch OpenStack but can lead to OpenStack compromise <http://lists.openstack.org/pipermail/openstack/2014-April/006539.html>. The width of the problem discovered this week is extremely wide though and I think it’s worth spending some more time learning about it. Mark McLoughlin <http://blogs.gnome.org/markmc> has collected an impressive amount of links where you can learn more. Security auditing of OpenStack releases <https://blog-nkinder.rhcloud.com/?p=51> Nathan Kinder <https://blog-nkinder.rhcloud.com/> started a conversation about how to deal with high-level security related questions about OpenStack. How to govern a project on the scale of OpenStack <http://opensource.com/business/14/4/governance-openstack> How an open source project is governed can matter just as much as the features it supports, the speed at which it runs, or the code that underlies it. Some open source projects have what I call a “benevolent dictator for life <http://www.theatlantic.com/technology/archive/2014/01/on-the-reign-of-benev…>.” Others are outgrowths of corporate projects that, while open, still have their goals and code led by the company that manages it. And of course, there are thousands of projects out there that are written and managed by a single person or a small group of people for whom governance is less of an issue than insuring project sustainability <http://opensource.com/life/14/1/evaluate-sustainability-open-source-project>. Introducing the OpenStack SDK for PHP <http://engineeredweb.com/blog/2014/openstack-sdk-php-intro/> Marrying OpenStack with one of the most popular programming languages on the planet. Write applications to interact with OpenStack public and private clouds, using the APIs. The OpenStack SDK for PHP <https://wiki.openstack.org/wiki/OpenStack-SDK-PHP> is meant to be by the community and for the community. It will be able to work with clouds from a variety of vendors or vanilla OpenStack setups. Tearing down obstacles to OpenStack documentation contributions <http://justwriteclick.com/2014/04/10/tearing-down-obstacles-to-openstack-do…> Rip. Shred. Tear. Let’s gather up the obstacles to documentation contribution and tear them down one by one. I’ve designed a survey <https://docs.google.com/forms/d/136-BssH-OxjVo8vNoOD-gW4x8fDFpvixbgCfeV1w_d…> with the help of the OpenStack docs team to determine blockers for docs contributions. If you’ve contributed to OpenStack, pleasefill it out <https://docs.google.com/forms/d/136-BssH-OxjVo8vNoOD-gW4x8fDFpvixbgCfeV1w_d…>. The road to Juno Summit – Atlanta 2014 * Applying for Visa? Looking for accommodation in Atlanta? Visit http://openstack.org/summit * Check the official agenda <http://openstacksummitmay2014atlanta.sched.org/> * Call for Proposals Open Source @ OpenStack Summit <http://www.openstack.org/blog/2014/03/call-for-proposals-open-source-openst…> Security Advisories and Notices * XSS in Horizon orchestration dashboard (CVE-2014-0157) <http://lists.openstack.org/pipermail/openstack-announce/2014-April/000218.h…> * RBAC policy not properly enforced in Nova EC2 API (CVE-2014-0167) <http://lists.openstack.org/pipermail/openstack-announce/2014-April/000219.h…> * Remote code execution in Glance Sheepdog backend (CVE-2014-0162) <http://lists.openstack.org/pipermail/openstack-announce/2014-April/000220.h…> * Keystone DoS through V3 API authentication chaining (CVE-2014-2828) <http://lists.openstack.org/pipermail/openstack-announce/2014-April/000221.h…> * Heat templates with invalid references allows unintended network access <http://lists.openstack.org/pipermail/openstack/2014-April/006428.html> * OpenSSL Heartbleed vulnerability can lead to OpenStack compromise <http://lists.openstack.org/pipermail/openstack/2014-April/006539.html> Tips ‘n Tricks * By Steve Hardy <http://hardysteven.blogspot.com/search/label/openstack>: Heat auth model updates – part 1 Trusts <http://hardysteven.blogspot.com/2014/04/heat-auth-model-updates-part-1-trus…> * By Adam Young <http://adam.younglogic.com/>: Teaching Horizon to Share <http://adam.younglogic.com/2014/04/teaching-horizon-to-share/> * By Christian Berendt <http://www.cberendt.de/>: An other Vagrant box with Devstack and Ubuntu 14.04 <http://www.cberendt.de/2014/04/an-other-vagrant-box-with-devstack-and-ubunt…> * By How To Store Incremental Backups On The Cloudwatt Object Store Using Duplicity <http://dev.cloudwatt.com/en/blog/how-to-store-incremental-backups-on-the-cl…> * By Cameron Seader <http://blog.seader.us/search/label/OpenStack>: Quickly Setting-up an OpenStack Cloud with the SUSE Cloud 3 Admin Appliance <http://blog.seader.us/2014/04/quickly-setting-up-openstack-cloud-with.html> * By Sean Dague <https://dague.net/>: Devstack Vagrant <https://dague.net/2014/04/06/devstack-vagrant/> * By Cody Bunch <http://openstack.prov12n.com/>: How to Make A LOT of Devstack with Vagrant <http://openstack.prov12n.com/how-to-make-a-lot-of-devstack-with-vagrant/> Reports from Previous Events * OpenStack Meetup, Coimbatore – 31 March 2014 <http://aptira.com/blog/98-openstack-meetup-coimbatore-31-march-2014> * Nordic OpenStack meetup 3 April – hosted by Elastx and Solidfire <http://elastx.com/our-blog/openstack-meetup-hosted-by-elastx-and-solidfire> Upcoming Events * PyCon <https://us.pycon.org/2014/> Apr 09 – 17, 2014 – Montreal, Canada Details <https://us.pycon.org/2014/> * OpenStack India Meeting <http://www.meetup.com/Indian-OpenStack-User-Group/events/173478572/> Apr 12, 2014 – Mumbai, India Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/173478572/> * San Antonio OpenStack Meeting <http://www.meetup.com/SA-Open-Stackers/events/175211322/> Apr 16, 2014 – San Antonio, TC Details <http://www.meetup.com/SA-Open-Stackers/events/175211322/> * SFBay OpenStack Hackathon #OSSFO <http://www.meetup.com/openstack/> Apr 17, 2014 – Details <http://www.meetup.com/openstack/> * Icehouse Release Party! <http://www.meetup.com/Openstack-Amsterdam/events/174447942/> Apr 17, 2014 – Amsterdam, Netherlands Details <http://www.meetup.com/Openstack-Amsterdam/events/174447942/> * Running OpenStack User Groups <http://www.meetup.com/OpenStack-Online-Meetup/events/174880782/> Apr 17, 2014 – Online Details <http://www.meetup.com/OpenStack-Online-Meetup/events/174880782/> * SAFNOG <http://www.safnog.org/meetings-future/agenda-2014-safnog-1.html>Apr 22 – 23, 2014 – Johannesburg, South Africa Details <http://www.safnog.org/meetings-future/agenda-2014-safnog-1.html> * Philly OpenStack Meeting <http://www.meetup.com/Philly-OpenStack-Meetup-Group/events/157769942/> Apr 24, 2014 – Philadelphia, PA Details <http://www.meetup.com/Philly-OpenStack-Meetup-Group/events/157769942/> * OpenStack India Meeting <http://www.meetup.com/Indian-OpenStack-User-Group/events/173701902/> Apr 26, 2014 – Bangalore, India Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/173701902/> * OpenStack Day Mexico <https://openstackdaylatam.com/?lang=en> Apr 29, 2014 – Mexico City, Mexico Details <https://openstackdaylatam.com/?lang=en> * OpenStack Paris Meeting <http://www.meetup.com/OpenStack-France/events/172754772/> Apr 29, 2014 – Paris, France Details <http://www.meetup.com/OpenStack-France/events/172754772/> * SFBay Meetup – Beginner track <http://www.meetup.com/openstack/events/123227622/> May 01, 2014 – Sunnyvale, CA Details <http://www.meetup.com/openstack/events/123227622/> * SFBay OpenStack Hackathon #OSSFO <http://www.meetup.com/openstack/> May 01, 2014 – Details <http://www.meetup.com/openstack/> * OpenStack Brasil User Group Meeting @ FISL15 <http://softwarelivre.org/fisl15> May 07 – 10, 2014 – Porto Alegre, Brasil Details <http://softwarelivre.org/fisl15> * OpenStack DACH Day at LinuxTag 2014 <http://www.linuxtag.org/2014/en/#openstack> May 09, 2014 – Berlin, Germany Details <http://www.linuxtag.org/2014/en/#openstack> * OpenStack Summit May 2014 <http://www.openstack.org/summit/openstack-summit-atlanta-2014/> May 12 – 16, 2014 – Atlanta, GA Details <http://www.openstack.org/summit/openstack-summit-atlanta-2014/> Other News * Why We Craft OpenStack (Featuring Rackspace Principal Architect Kurt Griffiths) <http://www.rackspace.com/blog/why-we-craft-openstack-featuring-rackspace-pr…> * OpenStack Israel Podcast, Episode 7 <http://cloudifysource.tumblr.com/post/82113910247> * MongoDB 2.6 is out, Marconi will benefit from it <http://blog.flaper87.com/post/53440a53d987d2dc534d4530/> * Why I Support Mark McClain for OpenStack Neutron PTL <http://sarob.com/2014/04/why-i-support-mark-mcclain-for-openstack-neutron-p…> * OpenStack Day Events April – May – June 2014 <http://www.openstack.org/blog/2014/04/openstack-day-events-april-may-june-2…> * Take the OpenStack User Survey and Change the (OpenStack) World <https://www.suse.com/communities/conversations/take-openstack-user-survey-c…> * OpenStack Project Meeting: Summary <http://eavesdrop.openstack.org/meetings/project/2014/project.2014-04-08-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2014/project.2014-04-08-21.…> Welcome New Reviewers and Developers Jason Kincl <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Manish Godara <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Choe, Cheng-Dae <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Jason Ni <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Juan Antonio Osorio Robles <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> vishal yadav <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Peter Jönsson <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Amrith <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> vaibhav <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Doug Shelley <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Victor Boivie <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Aimon Bustardo <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Marc Abramowitz <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Igor Duarte Cardoso <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Latest Activity In Projects Do you want to see at a glance the bugs filed and solved this week? Latest patches submitted for review? Check out the individual project pages on OpenStack Activity Board – Insights <http://activity.openstack.org/data/display/OPNSTK2/>. * Telemetry (Ceilometer) <http://activity.openstack.org/data/display/OPNSTK2/ceilometer> * Block Storage (Cinder) <http://activity.openstack.org/data/display/OPNSTK2/cinder> * Image Service (Glance) <http://activity.openstack.org/data/display/OPNSTK2/glance> * Orchestration API <http://activity.openstack.org/data/display/OPNSTK2/heat> (Heat) <http://activity.openstack.org/data/display/OPNSTK2/heat> * Dashboard (Horizon) <http://activity.openstack.org/data/display/OPNSTK2/horizon> * Bare Metal Provisioning (Ironic) <http://activity.openstack.org/data/display/OPNSTK2/ironic> * Identity (Keystone) <http://activity.openstack.org/data/display/OPNSTK2/keystone> * Manuals <http://activity.openstack.org/data/display/OPNSTK2/openstack-manuals> * Networking (Neutron) <http://activity.openstack.org/data/display/OPNSTK2/neutron> * Compute (Nova) <http://activity.openstack.org/data/display/OPNSTK2/nova> * Data Processing (Sahara) <http://stackalytics.com/?release=icehouse&metric=commits&project_type=opens…> * Object Storage (Swift) <http://activity.openstack.org/data/display/OPNSTK2/swift> * Database As A Service (Trove) <http://activity.openstack.org/data/display/OPNSTK2/trove> /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

[OSSA 2014-013] Keystone DoS through V3 API authentication chaining (CVE-2014-2828)
by Tristan Cacqueray 11 Apr '14

11 Apr '14

OpenStack Security Advisory: 2014-013 CVE: CVE-2014-2828 Date: April 10, 2014 Title: Keystone DoS through V3 API authentication chaining Reporter: Abu Shohel Ahmed (Ericsson) Products: Keystone Versions: from 2013.1 to 2013.2.3 Description: Abu Shohel Ahmed from Ericsson reported a vulnerability in Keystone V3 API authentication. By sending a single request with the same authentication method multiple times, a remote attacker may generate unwanted load on the Keystone host, potentially resulting in a Denial of Service against a Keystone service. Only Keystone setups enabling V3 API are affected. Juno (development branch) fix: https://review.openstack.org/84425 Icehouse (milestone-proposed branch) fix: https://review.openstack.org/84735 Havana fix: https://review.openstack.org/86024 Notes: This fix is included in the icehouse-rc2 development milestone and will be included in a future 2013.2.4 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2828 https://launchpad.net/bugs/1300274 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OSSA 2014-012] Remote code execution in Glance Sheepdog backend (CVE-2014-0162)
by Tristan Cacqueray 10 Apr '14

10 Apr '14

OpenStack Security Advisory: 2014-012 CVE: CVE-2014-0162 Date: April 10, 2014 Title: Remote code execution in Glance Sheepdog backend Reporter: Paul McMillan (Nebula) Products: Glance Versions: from 2013.2 to 2013.2.3 Description: Paul McMillan from Nebula reported a vulnerability in Glance Sheepdog backend. By using a specially crafted location, a user allowed to insert or modify Glance image metadata may trigger code execution on the Glance host as the user the Glance service runs under. This may result in Glance host unauthorized access and further compromise of the Glance service. All setups using Glance server with the (enabled by default) sheepdog backend are affected. Juno (development branch) fix: https://review.openstack.org/86622 Icehouse (milestone-proposed branch) fix: https://review.openstack.org/86625 Havana fix: https://review.openstack.org/86626 Notes: This fix will be included in the icehouse-rc2 development milestone and in a future 2013.2.4 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0162 https://launchpad.net/bugs/1298698 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OSSA 2014-011] RBAC policy not properly enforced in Nova EC2 API (CVE-2014-0167)
by Tristan Cacqueray 09 Apr '14

09 Apr '14

OpenStack Security Advisory: 2014-011 CVE: CVE-2014-0167 Date: April 09, 2014 Title: RBAC policy not properly enforced in Nova EC2 API Reporter: Marc Heckmann (Ubisoft) Products: Nova Versions: from 2013.1 to 2013.2.3 Description: Marc Heckmann from Ubisoft reported a vulnerability in the Nova EC2 API security group implementation. RBAC policies are not enforced when using the EC2 API, in particular the add_rules, remove_rules and destroy methods. A restricted user may overcome his limitation by using EC2 API resulting in unauthorized action on security groups. Only setups using non-default RBAC rules for Nova may be affected. Juno (development branch) fix: https://review.openstack.org/86358 Icehouse (milestone-proposed branch) fix: https://review.openstack.org/86360 Havana fix: https://review.openstack.org/86361 Notes: This fix will be included in the icehouse-rc2 development milestone and in a future 2013.2.4 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0167 https://launchpad.net/bugs/1290537 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OSSA 2014-010] XSS in Horizon orchestration dashboard (CVE-2014-0157)
by Tristan Cacqueray 08 Apr '14

08 Apr '14

OpenStack Security Advisory: 2014-010 CVE: CVE-2014-0157 Date: April 08, 2014 Title: XSS in Horizon orchestration dashboard Reporter: Cristian Fiorentino (Intel) Products: Horizon Versions: 2013.2 version up to 2013.2.3 Description: Cristian Fiorentino from Intel reported a vulnerability in Horizon Orchestration dashboard. By tricking a Horizon user into using a malicious template in the Orchestration/Stack section of Horizon, a remote attacker may trigger a cross-site-scripting vulnerability. It may result in potential assets theft (Horizon user/admin access credentials, tenants confidential information, etc.). Only setups exposing the orchestration dashboard in Horizon are affected. Juno (development branch) fix: https://review.openstack.org/86059 Icehouse (milestone-proposed branch) fix: https://review.openstack.org/86054 Havana fix: https://review.openstack.org/86056 Notes: This fix will be included in the icehouse-rc2 development milestone and in a future 2013.2.4 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0157 https://launchpad.net/bugs/1289033 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Mar 28 – Apr 4)
by Stefano Maffulli 05 Apr '14

05 Apr '14

1 0

OpenStack 2013.2.3 released
by Adam Gandelman 04 Apr '14

04 Apr '14

Hello everyone, The OpenStack Stable Maintenance team is happy to announce the release of the 2013.2.3 stable Havana release. We have been busy reviewing and accepting backported bugfixes to the stable/havana branches according to the criteria set at: https://wiki.openstack.org/wiki/StableBranch A total of 106 bugs have been fixed across all projects. These updates to Havana are intended to be low risk with no intentional regressions or API changes. The list of bugs, tarballs and other milestone information for each project may be found on Launchpad: https://launchpad.net/ceilometer/havana/2013.2.3 https://launchpad.net/cinder/havana/2013.2.3 https://launchpad.net/glance/havana/2013.2.3 https://launchpad.net/heat/havana/2013.2.3 https://launchpad.net/horizon/havana/2013.2.3 https://launchpad.net/keystone/havana/2013.2.3 https://launchpad.net/neutron/havana/2013.2.3 https://launchpad.net/nova/havana/2013.2.3 Release notes may be found on the wiki: https://wiki.openstack.org/wiki/ReleaseNotes/2013.2.3 The freeze on the stable/havana branches will be lifted today as we begin working toward the 2013.3.4 release, to be released by Alan Pevec at a TBD date after the Icehouse release has wrapped up. Thanks, Adam Gandelman

1 0

Old stable/grizzly branches removed as of March 30, 2014
by Jeremy Stanley 02 Apr '14

02 Apr '14

Based on discussion[1] at the Icehouse Summit in Hong Kong, official support for stable/grizzly branches of OpenStack projects reached end of life and was frozen on March 6, 2014 (coincident with the icehouse-3 milestone). We kept these branches around for the scheduled 2013.1.5 stable point release[2] on March 20, 2014, and then tagged them "grizzly-eol" and deleted them from official Git repositories on March 30, 2014. At that time, all related provisions within our testing infrastructure for these branches were removed in preparation for upcoming stable/icehouse branch testing. My apologies for the delayed notice on the branch deletion, in case anyone was caught off guard by it. [1] https://etherpad.openstack.org/p/stable-havana-ideas [2] http://lists.openstack.org/pipermail/openstack-announce/2014-March/000209.h… -- Jeremy Stanley

1 0

OpenStack Community Weekly Newsletter (Mar 21 – 28)
by Stefano Maffulli 29 Mar '14

29 Mar '14

1 0

[OSSA 2014-009] Nova host data leak to vm instance in rescue mode (CVE-2014-0134)
by Tristan Cacqueray 27 Mar '14

27 Mar '14

OpenStack Security Advisory: 2014-009 CVE: CVE-2014-0134 Date: March 27, 2014 Title: Nova host data leak to vm instance in rescue mode. Reporter: Stanislaw Pitucha (HP) Products: Nova Versions: 2013.2 versions up to 2013.2.2 Description: Stanislaw Pitucha from Hewlett Packard reported a vulnerability in the Nova instance rescue mode. By overwriting the disk inside an instance with a malicious image and switching the instance to rescue mode, an authenticated user would be able to leak an arbitrary file from the compute host to the virtual instance. Note that the host file must be readable by the libvirt/kvm context to be exposed. Only setups using libvirt to spawn instance, and having "use_cow_images = False" in Nova configuration are affected. Icehouse (development branch) fix: https://review.openstack.org/82840 Havana fix: https://review.openstack.org/82841 Notes: This fix will be included in the icehouse-rc1 development milestone and in a future 2013.2.3 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0134 https://launchpad.net/bugs/1221190 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0