- OpenStack-announce - lists.openstack.org

Havana-1 development milestone available
by Thierry Carrez 30 May '13

30 May '13

Hi everyone, The first milestone of the Havana development cycle, "havana-1" is now available for Keystone, Glance, Nova, Horizon, Networking, Cinder, Ceilometer, and Heat. It contains all the new features that have been added since the Grizzly pre-release Feature Freeze in March. You can see the full list of new features and fixed bugs, as well as tarball downloads, at: https://launchpad.net/keystone/havana/havana-1 https://launchpad.net/glance/havana/havana-1 https://launchpad.net/nova/havana/havana-1 https://launchpad.net/horizon/havana/havana-1 https://launchpad.net/quantum/havana/havana-1 https://launchpad.net/cinder/havana/havana-1 https://launchpad.net/ceilometer/havana/havana-1 https://launchpad.net/heat/havana/havana-1 Including the oslo libraries, 63 blueprints were implemented and 671 bugs were fixed during this milestone. The next development milestone, havana-2, is scheduled for July 18th. Regards, -- Thierry Carrez (ttx) Release Manager, OpenStack

1 0

[OSSA 2013-014] Missing expiration check in Keystone PKI tokens validation (CVE-2013-2104)
by Thierry Carrez 29 May '13

29 May '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 OpenStack Security Advisory: 2013-014 CVE: CVE-2013-2104 Date: May 28, 2013 Title: Missing expiration check in Keystone PKI tokens validation Reporter: Eoghan Glynn (Red Hat), Alex Meade (Rackspace) Products/Affects: Keystone (Folsom only), python-keystoneclient (0.2.0+) Description: Eoghan Glynn from Red Hat and Alex Meade from Rackspace both reported a vulnerability in expiry checks for PKI tokens in the Keystone authentication middleware. Expired tokens for authenticated users could continue to be used, potentially resulting in the bypass of intended security policies. The effect of PKI token revocation is also reversed when the token expires, in the sense that a revoked token is once again treated as being valid. Only setups using PKI tokens are affected. Note: The affected code was added to Keystone in the Folsom release, but was moved to python-keystoneclient during the Grizzly development cycle. python-keystoneclient fix (will be included in upcoming 0.2.4 release): https://review.openstack.org/#/c/30742/ Keystone (Folsom) fix: https://review.openstack.org/#/c/30743/ References: https://bugs.launchpad.net/python-keystoneclient/+bug/1179615 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2013-2104 - -- Thierry Carrez (ttx) OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iQIcBAEBCAAGBQJRpRVGAAoJEFB6+JAlsQQjBRAP/iyScNAht67EMgGed4GWNKd3 2zHOgmqIq31S558ugul1e3qNgggnQ0qJvI1RjcgZuKoJEhH8SaPZBuykyycSvO9M L2Bex+GKAGAMuaz4ryPcnt7xJg+Mc0cksdCldeW1pXMrt8yITSQgXe0GqnGssoC+ 5TCk7JG8ADczbDGMa/nyc65tksbEI8hNJYyLLbCapvxfz4VqL2r5yp0vT0/jWDxy FLocAYnoKm9oxl0In5zioMQs0cSYAAa5EjwMLMMmUF/Axa7GskUOME8Q/GdgpMzJ h5AutinbpANSysz8pTB9bps7WSq33KfGKBN23caP43XvyMVA6CTsLUJH+U/9n+9u 0rTmKcumLXW9nkf5leki1u69VqRZFksrcEzJVtXdDyGGvFbZjPLcoA8lWifluSK/ vhu+T+RSnFWicki/Ifiz7c4tK6RYSB+a4G3/982GBxKp1sm3WLKd3ljsmpsqFeAY sz1o6p8zTgKIsYKrFEO6wMx37Qiga1RRB0As9msmAHJ6LXTO5ev8LcxXBjRjSIPs kTxoxHomRhbJAigvw+qSNSZz3DjrEywcqlNLLINQio21gzPMP4v1GVzwvroI8akf 6oz4DLDMcbdI1yQ7jjEhpnrcpFRHrJi2a45Tv6dlto34LvG7gLvgmLgnkJs0XMw7 BslUz5cGAucwXTz2vSHs =bu2N -----END PGP SIGNATURE-----

1 0

OpenStack Community Weekly Newsletter (May 17-24)
by Stefano Maffulli 25 May '13

25 May '13

The OpenStack Summit is coming to Hong Kong <http://www.openstack.org/summit/openstack-summit-hong-kong-2013/> It's official: we're going to Hong Kong on Nov 5-8. The Summit will take place at Asia World Expo, a large convention center near the airport with a connecting Marriott hotel. The Airport Express train stops within Asia World Expo, making it convenient to access from most parts of the city. Please check the VISA information page <http://www.openstack.org/summit/openstack-summit-hong-kong-2013/visa-inform…> and FAQ <http://www.openstack.org/summit/openstack-summit-hong-kong-2013/conference-…> for more information about your travel plans. We encourage you to book early! Connecting the dots: Dell stays course on OpenStack private <http://robhirschfeld.com/2013/05/23/dell-stays-course-on-openstack-private-…> OpenStack Foundation board member Rob Hirschfeld <http://robhirschfeld.com/> summarizes the /increasing level of investment/ in OpenStack-powered private cloud solutions (Dell <http://jobs.dell/>is hiring! <http://jobs.dell.com/search/openstack/ASCategory/-1/ASPostedDate/-1/ASCount…>). Among the things highlighted, the recent announcements are about increasing investment where Dell is already successful <http://en.community.dell.com/dell-blogs/direct2dell/b/direct2dell/archive/2…> plus accelerating with new features (such as leadership in HyperV enablement <http://www.serverwatch.com/server-news/dell-sets-the-stage-for-hyper-vs-ret…>). An introductory tour of OpenStack Cloud Messaging as a Service <http://www.openstack.org/blog/2013/05/an-introductory-tour-of-openstack-clo…> The need for an OpenStack Messaging Service was recognized by the San Diego Grizzly Summit, and in an unconference track design meeting on the last day, a crowd of interested people met, talked out some requirements, and from that the OpenStack Message Bus <https://wiki.openstack.org/wiki/Marconi> project was born. It was codenamed "Marconi", in honor of Guglielmo Marconi <http://en.wikipedia.org/wiki/Guglielmo_Marconi>, the inventor of wireless messaging. The Marconi team collaborates on Launchpad <https://launchpad.net/marconi>. Working with the OpenStack Code Review and CI system -- Chef Edition <http://www.joinfu.com/2013/05/working-with-the-openstack-code-review-and-ci…> For too long, the state of the OpenStack Chef world had been one of duplicative effort, endless forks of Chef cookbooks, and little integration with how many of the OpenStack projects choose to control source code and integration testing. Recently, however, the Chef + OpenStack community has been getting its proverbial act together. Folks from lots of companies have come together and pushed to align efforts to produce a set of well-documented, flexible, but focused Chef cookbooks that install and configure OpenStack services. StackForge now hosting a set of Chef cookbooks for OpenStack. Virtualizing legacy hardware in OpenStack <http://dachary.org/?p=1991> Loïc Dachary <http://dachary.org/> summarizes how the French non-profit organization April <http://april.org/> migrated the workload of a five years old hardware to OpenStack. Instead of migrating each of the fourteen vservers <http://linux-vserver.org/> on a Debian GNU/Linux lenny <http://www.debian.org/releases/lenny/> running a *2.6.26-2-vserver-686-bigmem* linux individually to an OpenStack instance, it was decided that the vserver host would be copied over to an OpenStack instance. Discussion lists available in non-English languages <https://wiki.openstack.org/wiki/Community#Mailing_lists_in_local_languages> In order to support our growing international communities the OpenStack Infrastructure and the Community team worked to allow groups to create mailing lists in languages other than English. People interested in discussions in Italian <http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-it> and Vietnamese <http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-vi> can join the lists already. A request for a list to discuss in Spanish is pending <https://pending/>review <https://review.openstack.org/#/c/30495/> and other can be created if necessary following the instructions <https://wiki.openstack.org/wiki/Community#Mailing_lists_in_local_languages>. Tips 'n Tricks * By Sébastien Han <http://sebastien-han.fr/>: Nova: archive deleted rows <http://sebastien-han.fr/blog/2013/05/23/nova-archive-deleted-rows/> * By eNovance <http://www.enovance.com/>: The absolute minimum to get you started with Vagrant <http://www.enovance.com/fr/blog/5685/the-absolute-minimum-to-get-you-starte…> * By eNovance <http://www.enovance.com/>: How to create specific Nova flavors for tenants <http://www.enovance.com/fr/blog/5670/how-to-create-specific-nova-flavors-fo…> * By Russell Bryant <http://russellbryantnet.wordpress.com/>: Availability Zones and Host Aggregates in OpenStack Compute (Nova) <http://russellbryantnet.wordpress.com/2013/05/21/availability-zones-and-hos…> * By Cloudscaling Engineering <http://engineering.cloudscaling.com/>: Stacker Voices: Mark McLoughlin, Red Hat <http://engineering.cloudscaling.com/stacker-voices-mark-mcloughlin-red-hat/> Security Issues * Keystone client local information disclosure (CVE-2013-2013) <http://lists.openstack.org/pipermail/openstack-announce/2013-May/000104.html> Upcoming Events * OpenStack India Meetup <http://www.meetup.com/Indian-OpenStack-User-Group/events/117132352/> May 26, 2013 -- Bangalore, India at Anuta Network Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/117132352/> * OpenStack Israel <http://www.openstack-israel.org/> May 27, 2013 -- Tel-Aviv, Israel Details <http://www.openstack-israel.org/> * Australian OpenStack User Group tri-city Meetup <http://aosug.openstack.org.au/> May 27, 2013 -- Australia Details <http://aosug.openstack.org.au/> * OpenStack at CeBit Australia <http://www.cebit.com.au/> May 28 -- 30, 2013 -- Sidney, Australia Booth in Hall 4 <http://www.cebit.com.au/> * OpenStack CEE Day <http://openstackceeday.com/> May 29, 2013 -- Budapest, Hungary Details <http://openstackceeday.com/> * 2013 Beijing Open Source Convention <http://bj-opensource.com/> May 29, 2013 -- Beijing, China Program <http://bj-opensource.com/> * Building an OpenStack Cloud <http://www.meetup.com/meetup-group-NjZdcegA/events/108731562/> May 30, 2013 -- Chicago, IL Details <http://www.meetup.com/meetup-group-NjZdcegA/events/108731562/> * OpenStack Rocks in Poland <http://www.meetup.com/OpenStack-User-Group-Poland/events/119500792/> Jun 06, 2013 -- Szczecin, Poland Details <http://www.meetup.com/OpenStack-User-Group-Poland/events/119500792/> * Cloud Expo East 2013 <http://www.cloudcomputingexpo.com/> Jun 10 -- 13, 2013 -- New York City, NY Details <http://www.cloudcomputingexpo.com/> * OpenStack meeting in Munich <http://www.meetup.com/openstack-de/events/109700562/> Jun 11, 2013 -- Munich, Germany Details <http://www.meetup.com/openstack-de/events/109700562/> * DatacenterDynamics Converged <http://www.datacenterdynamics.com/fr/conferences/2013/paris-2013> Jun 11, 2013 -- Paris, France Details <http://www.datacenterdynamics.com/fr/conferences/2013/paris-2013> * GigaOM Structure <http://event.gigaom.com/structure/> Jun 19 -- 20, 2013 -- San Francisco, CA Details <http://event.gigaom.com/structure/> * Openstack a mezza scala! <http://www.meetup.com/OpenStack-User-Group-Italia/events/101619052/> Jun 20, 2013 -- Milano, Italy Details <http://www.meetup.com/OpenStack-User-Group-Italia/events/101619052/> * OpenStack DevCamp Essen <https://wiki.openstack.org/wiki/DevCamp/EssenGermany2013> Jun 21 -- 23, 2013 -- Essen, Germany Details <https://wiki.openstack.org/wiki/DevCamp/EssenGermany2013> * PyCon Australia -- OpenStack Miniconf <http://2013.pycon-au.org/programme/schedule/friday> Jul 05, 2013 -- Hobart, Australia Details <http://2013.pycon-au.org/programme/schedule/friday> Other News * Interview with John Griffith at SolidFire <http://rafstack.tumblr.com/post/51219217031> * Interview with Anne Gentle, OpenStack Technical Writer <http://rafstack.tumblr.com/post/50989644005> * OpenStack Board of Directors Talks: Episode 10 with Joseph George, Director of Product Strategy of Dell's Revolutionary Solutions Team <http://rafstack.tumblr.com/post/51073919838> * OpenStack Project Meeting: Summary <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-05-21-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-05-21-21.…>. Welcome New Developers * Kanzhe Jiang, Big Switch * Marharyta Kislinska * Li Yingjun * Satyanarayana Patibandla, TCS * Ryan Moore, HP * Emanuele Rocca, VU University Amsterdam * Aditi Raveesh, Rackspace Got answers? Ask OpenStack <https://ask.openstack.org/> is the go-to destination for OpenStack users. Interesting questions waiting for answers: * How to add data to tables in horizon Dashboard <https://ask.openstack.org/question/1572/how-to-add-data-to-tables-in-horizo…> * Where should I install Dashboard on a 3 nodes architecture? <https://ask.openstack.org/question/1576/where-should-i-install-dashboard-on…> * Migrating from nova-network to quantum <https://ask.openstack.org/question/1565/migrating-from-nova-network-to-quan…> * How to setup security groups for IPv6 with nova-network? <https://ask.openstack.org/question/1520/how-to-setup-security-groups-for-ip…> * Recommended version of libvirt <https://ask.openstack.org/question/1388/recommended-version-of-libvirt/> * Snapshotting images and cloud-init <https://ask.openstack.org/question/1492/snapshotting-images-and-cloud-init/> * Are there any tuning methods in Openstack <https://ask.openstack.org/question/1306/are-there-any-tuning-methods-in-ope…> /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

[OSSA 2013-013] Keystone client local information disclosure (CVE-2013-2013)
by Jeremy Stanley 24 May '13

24 May '13

OpenStack Security Advisory: 2013-013 CVE: CVE-2013-2013 Date: May 23, 2013 Title: Keystone client local information disclosure Reporter: Jake Dahn (Nebula) Products: python-keystoneclient Affects: All versions Description: Jake Dahn from Nebula reported a vulnerability that the keystone client only allows passwords to be updated in a clear text command-line argument, which may enable other local users to obtain sensitive information by listing the process and potentially leaves a record of the password within the shell command history. Fix: https://review.openstack.org/28702 Notes: A fix has already been merged to the python-keystoneclient master branch on 2013-05-21 (commit f2e0818) which adds an interactive password prompt, and will appear in the next release of python-keystoneclient. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2013 https://bugs.launchpad.net/python-keystoneclient/+bug/938315 -- Jeremy Stanley (fungi) OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (May 10-17)
by Stefano Maffulli 18 May '13

18 May '13

OpenStack Compute (Nova) Roadmap for Havana <http://russellbryantnet.wordpress.com/2013/05/13/openstack-compute-nova-roa…> The Havana design summit was held mid-April. Since then the Nova team has been documenting the Havana roadmap and going full speed ahead on development of these features. The list of features that developers have committed to completing for the Havana release is tracked using blueprints on Launchpad <https://blueprints.launchpad.net/nova/havana>. At the time of writing, there are 74 blueprints listed that cover a wide range of development efforts. Russell Bryant <http://russellbryantnet.wordpress.com/>, Nova Tech Lead, highlights some of them. Stacker Voices: Thierry Carrez, OpenStack Foundation <http://engineering.cloudscaling.com/stacker-voices-thierry-carrez-openstack…> Thierry Carrez handles release management for the OpenStack Foundation and is chair of the project's Technical Committee. Thierry was involved with the earliest incarnations of OpenStack while at Rackspace. Cloudscaling's team caught up with him at the OpenStack Summit in Portland to get Thierry's insights into the release cycle, governance and his wish list for the project. Swiftsync -- A way to synchronize two swift clusters <http://www.enovance.com/fr/blog/5653/swiftsync-a-way-to-synchronize-two-swi…> Enovance was asked to migrate and synchronize two swift clusters in order to provide a customer a way to handle a swift migration easily. For that they started a project called swiftsync <https://github.com/enovance/swiftsync> hosted in github. Tips 'n Tricks * By Ceph <http://ceph.com/>: Incremental Snapshots with RBD <http://ceph.com/dev-notes/incremental-snapshots-with-rbd/> * By eNovance <http://www.enovance.com/>: Swiftsync -- A way to synchronize two swift clusters <http://www.enovance.com/fr/blog/5653/swiftsync-a-way-to-synchronize-two-swi…> * By Loïc Dachary <http://dachary.org/>: Disaster recovery on host failure in OpenStack <http://dachary.org/?p=1961> Security Issues * Nova fails to verify image virtual size (CVE-2013-2096) <http://lists.openstack.org/pipermail/openstack-announce/2013-May/000102.html> OpenStack In The Wild A new section of the weekly newsletter dedicated to users of OpenStack. If you want to showcase how OpenStack helps you (or you know somebody that uses OpenStack) please let us know: email <mailto:communitymngr@openstack.org>, twitter <http://twitter.com/openstack>, reddit <http://www.reddit.com/r/openstack/> or avian carrier <http://en.wikipedia.org/wiki/IP_over_Avian_Carriers> will do). * Canadian Web Hosting to Launch Public Cloud Built on OpenStack Software <http://www.dailyhostnews.com/canadian-web-hosting-to-launch-public-cloud-bu…> Upcoming Events * OpenStack Dublin Meetup <http://www.meetup.com/OpenStack-Ireland/events/116567022/> May 22, 2013 -- Dublin, Ireland Details <http://www.meetup.com/OpenStack-Ireland/events/116567022/> * 3rd London OpenStack Meetup <http://www.meetup.com/Openstack-London/events/116975682/> May 23, 2013 -- London, UK Details <http://www.meetup.com/Openstack-London/events/116975682/> * OpenStack DACH Day <http://www.prweb.com/releases/2013/3/prweb10526716.htm> May 24, 2013 -- Berlin Fairgrounds Details <http://www.prweb.com/releases/2013/3/prweb10526716.htm> * OpenStack India Meetup <http://www.meetup.com/Indian-OpenStack-User-Group/events/117132352/> May 26, 2013 -- Bangalore, India at Anuta Network Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/117132352/> * OpenStack Israel <http://www.openstack-israel.org/> May 27, 2013 -- Tel-Aviv, Israel Details <http://www.openstack-israel.org/> * Australian OpenStack User Group tri-city Meetup <http://aosug.openstack.org.au/> May 27, 2013 -- Australia Details <http://aosug.openstack.org.au/> * OpenStack at CeBit Australia <http://www.cebit.com.au/> May 28 -- 30, 2013 -- Sidney, Australia Booth in Hall 4 <http://www.cebit.com.au/> * OpenStack CEE Day <http://openstackceeday.com/> May 29, 2013 -- Budapest, Hungary Details <http://openstackceeday.com/> * Building an OpenStack Cloud <http://www.meetup.com/meetup-group-NjZdcegA/events/108731562/> May 30, 2013 -- Chicago, IL Details <http://www.meetup.com/meetup-group-NjZdcegA/events/108731562/> * OpenStack meeting in Munich <http://www.meetup.com/openstack-de/events/109700562/> Jun 11, 2013 -- Munich, Germany Details <http://www.meetup.com/openstack-de/events/109700562/> * DatacenterDynamics Converged <http://www.datacenterdynamics.com/fr/conferences/2013/paris-2013> Jun 11, 2013 -- Paris, France Details <http://www.datacenterdynamics.com/fr/conferences/2013/paris-2013> * GigaOM Structure <http://event.gigaom.com/structure/> Jun 19 -- 20, 2013 -- San Francisco, CA Details <http://event.gigaom.com/structure/> * OpenStack DevCamp Essen <https://wiki.openstack.org/wiki/DevCamp/EssenGermany2013> Jun 21 -- 23, 2013 -- Essen, Germany Details <https://wiki.openstack.org/wiki/DevCamp/EssenGermany2013> * PyCon Australia -- OpenStack Miniconf <http://2013.pycon-au.org/programme/schedule/friday> Jul 05, 2013 -- Hobart, Australia Details <http://2013.pycon-au.org/programme/schedule/friday> * OSCON 2013 <http://www.oscon.com/oscon2013> Jul 22 -- 26, 2013 -- Portland, OR Details <http://www.oscon.com/oscon2013> Other News * Crowbar cuts OpenStack Grizzly ("pebbles") branch & seeks community testing <http://robhirschfeld.com/2013/05/17/crowbar-cuts-openstack-grizzly/> * OpenStack Grizzly Webinar Preview: Availability Zones vs. Host Aggregates <http://www.mirantis.com/blog/segregation-in-grizzly-availability-zones-vers…> * Nested Virtualization --- KVM, Intel, with VMCS Shadowing <http://kashyapc.wordpress.com/2013/05/16/nested-virtualization-kvm-intel-wi…> * OpenStack Upstream University training <http://dachary.org/?p=1978> * A new (configurable) cgroups layout for libvirt with QEMU, KVM & LXC <https://www.berrange.com/posts/2013/05/13/a-new-configurable-cgroups-layout…> * How to guarantee success of the I Design Summit in HK <http://lists.openstack.org/pipermail/openstack-dev/2013-May/009048.html> * OpenStack Project Meeting:Summary <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-05-14-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-05-14-21.…>. Welcome New Developers * Hugh Saunders * Bruno Semperlotti * YAMAMOTO Takashi, VALinux * Fujioka Yuuichi, NEC Got answers? Ask OpenStack <https://ask.openstack.org/> is the go-to destination for OpenStack users. Interesting questions waiting for answers: * Trying to run pki_setup for keystone however the command doesn't exist <https://ask.openstack.org/question/1315/trying-to-run-pki_setup-for-keyston…> * Authentication credentials are being ignored <https://ask.openstack.org/question/1313/authentication-credentials-are-bein…> * Instance failed to start "qemu-img: Could not open...No such file or directory" <https://ask.openstack.org/question/1311/instance-failed-to-start-qemu-img-c…> * How to attach volume for instance (iso) on /dev/hda <https://ask.openstack.org/question/1302/how-to-attach-volume-for-instance-i…> * Can Openstack Choose the physical resources to boot a VM? <https://ask.openstack.org/question/1282/can-openstack-choose-the-physical-r…> * What causes "cloud-init-nonet gave up waiting for a network device"? <https://ask.openstack.org/question/1258/what-causes-cloud-init-nonet-gave-u…> /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

[OSSA 2013-012] Nova fails to verify image virtual size (CVE-2013-2096)
by Michael Still 16 May '13

16 May '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 OpenStack Security Advisory: 2013-012 CVE: CVE-2013-2096 Date: May 16, 2013 Title: Nova fails to verify image virtual size Reporter: Loganathan Parthipan Products: Nova Affects: All versions Description: Loganathan Parthipan publicly reported a vulnerability in Nova. Nova did not implement checking for the virtual size of a qcow2 image used as ephemeral storage for instances. It is therefore possible for a user to create an image which has a large virtual size, but little data. Once the instance is created, the user can then proceed to fill the virtual disk, and consume all available disk on the host node file system. Havana (development branch) fix: https://review.openstack.org/28717 Grizzly fix: https://review.openstack.org/28901 Folsom fix: https://review.openstack.org/29192 References: https://bugs.launchpad.net/nova/+bug/1177830 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2013-2096 Thanks, Michael Still OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlGUoRQACgkQlhS32Mrx3702BgCeKZUDDA/W6Nj/xgC1a1n9vHvP vvoAnRfIOXnuvJ01c7IxGyXON7LIh5kt =YfoG -----END PGP SIGNATURE-----

1 0

OpenStack Community Weekly Newsletter (May 3 – 10)
by Stefano Maffulli 11 May '13

11 May '13

OpenStack 2013.1.1 released <http://lists.openstack.org/pipermail/openstack-announce/2013-May/000100.html> 2013.1.1 release, the latest in the series of stable releases. These releases are bugfix updates to Grizzly and are intended to be relatively risk free with no intentional regressions or API changes. A total of 85 bugs have been fixed in this release. OpenStack Grizzly documentation released <http://lists.openstack.org/pipermail/openstack-announce/2013-May/000097.html> We have released a version of the OpenStack official documentation for grizzly and it is now available at http://docs.openstack.org/grizzly. We continue to update docs through our continuous publishing process so feedback is always welcome. If you have questions about how OpenStack documentation is maintained or would like to get involved, see http://wiki.openstack.org/Documentation/HowTo. We had nearly 80 contributors to the documentation for the Grizzly release. Thanks to everyone who helped create and maintain accurate information for OpenStack. Guidelines for answering question on Ask <http://lists.openstack.org/pipermail/community/2013-May/000252.html> It’s time we start collecting guidelines for the moderators so we keep having a very informative tool, with consistently good questions and answers. This wiki page hosts the draft of the Guidelines for Moderators https://wiki.openstack.org/wiki/Community/AskModerators. Comments welcome before they’re moved to their natural home on Ask OpenStack. Discussions at Breakfast with the Board – OpenStack April 2013 Summit <http://www.openstack.org/blog/2013/05/discussions-at-breakfast-with-the-boa…> The summary written by OpenStack Foundation’s Board of Directors of the things discussed during the Breakfast with the Bard in Portland, ranging from marketing to wifi, transparency to elections to what makes a contribution. A must read. Use existing RBD images and put it into Glance <http://sebastien-han.fr/blog/2013/05/07/use-existing-rbd-images-and-put-it-…> What if Glance, the OpenStack Image Service, was capable of converting images within its store, say from QCOW2 image to a RAW? Waiting for this capability to be added, Sébastien Han <http://sebastien-han.fr/> plays with a scenario where you have a KVM cluster backed by a Ceph Cluster and your CTO wants you to migrate the whole environment to OpenStack. Science fiction in action. Security Issues * Nova uses insecure keystone middleware tmpdir by default (CVE-2013-2030) <http://lists.openstack.org/pipermail/openstack-announce/2013-May/000098.html> * Keystone tokens not immediately invalidated when user is deleted (CVE-2013-2059) <http://lists.openstack.org/pipermail/openstack-announce/2013-May/000099.html> OpenStack In The Wild A new section of the weekly newsletter dedicated to users of OpenStack. If you want to showcase how OpenStack helps you (or you know somebody that uses OpenStack) please let us know: email <mailto:communitymngr@openstack.org>, twitter <http://twitter.com/openstack>, reddit <http://www.reddit.com/r/openstack/> or avian carrier <http://en.wikipedia.org/wiki/IP_over_Avian_Carriers> will do). More content from Portland Summit: * Using OpenStack In A Traditional Hosting Environment <http://www.openstack.org/summit/portland-2013/session-videos/presentation/u…> by EIG/Bluehost Upcoming Events * OpenStack Atlanta Meetup <http://www.meetup.com/openstack-atlanta/events/107062982/> May 16, 2013 – Atlanta, USA Details <http://www.meetup.com/openstack-atlanta/events/107062982/> * OpenStack Dublin Meetup <http://www.meetup.com/OpenStack-Ireland/events/116567022/> May 22, 2013 – Dublin, Ireland Details <http://www.meetup.com/OpenStack-Ireland/events/116567022/> * 3rd London OpenStack Meetup <http://www.meetup.com/Openstack-London/events/116975682/> May 23, 2013 – London, UK Details <http://www.meetup.com/Openstack-London/events/116975682/> * OpenStack DACH Day <http://www.prweb.com/releases/2013/3/prweb10526716.htm> May 24, 2013 – Berlin Fairgrounds Details <http://www.prweb.com/releases/2013/3/prweb10526716.htm> * OpenStack India Meetup <http://www.meetup.com/Indian-OpenStack-User-Group/events/117132352/> May 26, 2013 – Bangalore, India at Anuta Network Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/117132352/> * OpenStack Israel <http://www.openstack-israel.org/> May 27, 2013 – Tel-Aviv, Israel Details <http://www.openstack-israel.org/> * Australian OpenStack User Group tri-city Meetup <http://aosug.openstack.org.au/> May 27, 2013 – Australia Details <http://aosug.openstack.org.au/> * OpenStack at CeBit Australia <http://www.cebit.com.au/> May 28 – 30, 2013 – Sidney, Australia Booth in Hall 4 <http://www.cebit.com.au/> * OpenStack CEE Day <http://openstackceeday.com/> May 29, 2013 – Budapest, Hungary Details <http://openstackceeday.com/> * Building an OpenStack Cloud <http://www.meetup.com/meetup-group-NjZdcegA/events/108731562/> May 30, 2013 – Chicago, IL Details <http://www.meetup.com/meetup-group-NjZdcegA/events/108731562/> * OpenStack meeting in Munich <http://www.meetup.com/openstack-de/events/109700562/> Jun 11, 2013 – Munich, Germany Details <http://www.meetup.com/openstack-de/events/109700562/> * GigaOM Structure <http://event.gigaom.com/structure/> Jun 19 – 20, 2013 – San Francisco, CA Details <http://event.gigaom.com/structure/> * OpenStack DevCamp Essen <https://wiki.openstack.org/wiki/DevCamp/EssenGermany2013> Jun 21 – 23, 2013 – Essen, Germany Details <https://wiki.openstack.org/wiki/DevCamp/EssenGermany2013> * PyCon Australia – OpenStack Miniconf <http://2013.pycon-au.org/programme/schedule/friday> Jul 05, 2013 – Hobart, Australia Details <http://2013.pycon-au.org/programme/schedule/friday> * OSCON 2013 <http://www.oscon.com/oscon2013> Jul 22 – 26, 2013 – Portland, OR Details <http://www.oscon.com/oscon2013> Other News * Rant about Github pull-request workflow implementation <http://julien.danjou.info/blog/2013/rant-about-github-pull-request-workflow…> * Open Marketing Meeting – May 15 <http://lists.openstack.org/cgi-bin/mailman/private/marketing/2013-May/00005…> * Fixes and upgrades to Search on OpenStack Activity Board <http://markmail.org/message/h3k6tmoatgbfe5an> * OpenStack Project Meeting: Summary <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-05-07-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-05-07-21.…>. Welcome New Developers * Matt Wagner, Redhat Got answers? Ask OpenStack <https://ask.openstack.org/> is the go-to destination for OpenStack users. Interesting questions waiting for answers: * Can I still use nova-network in Grizzly? <https://ask.openstack.org/question/992/can-i-still-use-nova-network-in-griz…> * VM stops boot right after initializing tun <https://ask.openstack.org/question/261/vm-stops-boot-right-after-initializi…> * Why do I get “Could not find token” error using Swift with s3 API? <https://ask.openstack.org/question/661/why-do-i-get-could-not-find-token-er…> * How do I effectively disable/enable a tenant using the API? <https://ask.openstack.org/question/534/how-do-i-effectively-disableenable-a…> * How do I debug Nova service with eclipse and pydev <https://ask.openstack.org/question/815/how-do-i-debug-nova-service-with-ecl…> * What causes error “service n-net is not running” when running stack.sh? <https://ask.openstack.org/question/963/what-causes-error-service-n-net-is-n…> * How to list Server Id using python-novaclient Python API? <https://ask.openstack.org/question/989/how-to-list-server-id-using-python-n…> * Is it possible to modify a network while in use? <https://ask.openstack.org/question/947/is-it-possible-to-modify-a-network-w…> * How to set up metadata service on a flat network? <https://ask.openstack.org/question/945/how-to-set-up-metadata-service-on-a-…> * Keystone remove_user command removing ALL users not just the specified ones <https://ask.openstack.org/question/910/keystone-remove_user-command-removin…> * How do I debug Nova service with eclipse and pydev <https://ask.openstack.org/question/815/how-do-i-debug-nova-service-with-ecl…> * ENABLE_TENANT_TUNNELS, OVS Version check in Compute fails <https://ask.openstack.org/question/813/enable_tenant_tunnels-ovs-version-ch…> * How to make openstack_auth the default authentication backend for django admin? <https://ask.openstack.org/question/695/how-to-make-openstack_auth-the-defau…> /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

OpenStack 2013.1.1 released
by Alan Pevec 10 May '13

10 May '13

Hi everybody, In the time since the Grizzly release, we have been busy selectively back-porting bugfixes to the stable/grizzly branch according to our "safe source of high-impact fixes" criteria documented here: http://wiki.openstack.org/StableBranch We're happy to announce the 2013.1.1 release, the latest in the series of stable releases. These releases are bugfix updates to Grizzly and are intended to be relatively risk free with no intentional regressions or API changes. A total of 85 bugs have been fixed in this release. The list of bugs fixed can be seen here: https://launchpad.net/nova/grizzly/2013.1.1 https://launchpad.net/cinder/grizzly/2013.1.1 https://launchpad.net/quantum/grizzly/2013.1.1 https://launchpad.net/keystone/grizzly/2013.1.1 https://launchpad.net/horizon/grizzly/2013.1.1 Please read (and add to!) the release notes at: http://wiki.openstack.org/ReleaseNotes/2013.1.1 The work on Grizzly stable release series continues, next release 2013.1.2 is planned for June 6th and will be managed by Adam Gandelman. Enjoy! Alan

1 0

[OSSA 2013-011] Keystone tokens not immediately invalidated when user is deleted (CVE-2013-2059)
by Thierry Carrez 09 May '13

09 May '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 OpenStack Security Advisory: 2013-011 CVE: CVE-2013-2059 Date: May 9, 2013 Title: Keystone tokens not immediately invalidated when user is deleted Reporter: Sam Stoelinga Products: Keystone Affects: All versions Description: Sam Stoelinga reported a vulnerability in Keystone. When users are deleted through Keystone v2 API, existing tokens for those users are not immediately invalidated and remain valid for the duration of the token's life (by default, up to 24 hours). This may result in users retaining access when the administrator of the system thought them disabled. You can workaround this issue by disabling a user before deleting it: in that case the tokens belonging to the disabled user are immediately invalidated. Keystone setups using the v3 API call to delete users are unaffected. Havana (development branch) fix: https://review.openstack.org/#/c/28677/ Grizzly fix: https://review.openstack.org/#/c/28678/ Folsom fix: https://review.openstack.org/#/c/28679/ References: https://bugs.launchpad.net/keystone/+bug/1166670 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2013-2059 - -- Thierry Carrez (ttx) OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iQIcBAEBCAAGBQJRi8UUAAoJEFB6+JAlsQQjarMQAL64x2OlW3SbgOoCUDhi91lv JdBStMO6/6H1Njjv0cLEAOE/50rAJSFLsdLlzSkXHimD9NWnXogpbaKj+gWd/Jbm xDOgVtRDa8IgmaXVgA88tAO0/C6QHTQMBwBce8hVzMRRDZZ6zW7SAvofTBjdjmEj tC8nwhxF/QAx/lHwIyWHQsGCip+z9JQxT+UCQ5ytQQbSnYI/wmRWMHCCcst7XFqn H6Y9LQ8cLQAOZk0fHZx7wsFFVJ9XIiQcZxYSGPDn5/aRXlbbF6cWTy4UPB3jmMkp wJ7XSjpXzPLsTCimXwYT9CkhUYjvC7Y9Yu2XF3VycFL+bifobIfPQ2ABNBqkd/U1 2iIMq8rCTIG+GEhgBMHyrBdXJclsdzY/mFOHZhOdCsLH2pO6EPCUjO3Zs6BPtYfk zBNPRzrUXAnay+xjJhjQqxCOuskx/gxt2kOF00G1c/jZTytqzx7M4yf5GL9DYD6g LLUZpb+Ia5voocBpK2484fXlouVoQY+encQopnSZb5GarsMgO1hRK8qtExeeR3+o NPxeat15YaSvVaCgSL2msqnjIr6g3wXI1vLGdvmGny4hvNnLd+UeeQ9eT0Nc7LN9 aotaXRhDeYz71aFd8ZCYpUtoZ6I50/XnRT9+FrQ2QZ7cEKSVZjUv+mcEn0mCvZpC hqKVwOK6strcPXDlQwZr =e4jK -----END PGP SIGNATURE-----

1 0

[OSSA 2013-010] Nova uses insecure keystone middleware tmpdir by default (CVE-2013-2030)
by Thierry Carrez 09 May '13

09 May '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 OpenStack Security Advisory: 2013-010 CVE: CVE-2013-2030 Date: May 9, 2013 Title: Nova uses insecure keystone middleware tmpdir by default Reporter: Grant Murphy (Red Hat), Anton Lundin Products: Nova Affects: Folsom, Grizzly Description: Grant Murphy from Red Hat and Anton Lundin both independently reported a vulnerability in Nova's default location for the Keystone middleware signing directory (signing_dir). By previously setting up a malicious directory structure, an attacker with local shell access on the Nova node could potentially issue forged tokens that would be accepted by the middleware. Only setups that use the default value for signing_dir are affected. Note that future versions of the Keystone middleware will issue a warning if an insecure signing directory is used. Havana (development branch) fix: https://review.openstack.org/#/c/28568/ Grizzly fix: https://review.openstack.org/#/c/28569/ Folsom fix: https://review.openstack.org/#/c/28570/ References: https://bugs.launchpad.net/nova/+bug/1174608 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2013-2030 - -- Thierry Carrez (ttx) OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iQIcBAEBCAAGBQJRi72dAAoJEFB6+JAlsQQjJZAQAJ5w/+BoBD4em8YklBsxU6wU Bn1wWu3W5ngCNuHwr4ydWzC3U1TT1zWtogWJpv/+87m2KPESWhs7YGCkTIE9tLpA sNOniOG9hGUsWwRgtUqjA8/8QzLgbNJ/PDJx0lrNPNkvMbHwP/jxotx353edhelQ QAPJwVPBqu0vn2VZOeFWYNO/AnWNcjTXE0po92qaFvw3HWL3ykMd30w4Ejxv9clC VjBjaNkReSkmcd/BaArtr1IenyYyVqM7nv/VWl5O5Up02+uvAozDmy6Cyc1O5VOW 6m9nRH2WKE/bFXcTEG4rpH+/BZxG2RuyklUBvVtSaEAQOWYFSwQKzjxGM3rItsWt iuQYrakl6H69tRS3HS9pAXWdxSikSb8CqmVJauf3RG1/EQ7GtCO0kXVPi8fYBaTX GpLmpY8bj6o2iY1Kh1bozZ2oYVLgPrhP2R4oj+4iaSN++gy2qs0d3AvIK0BzBKT+ fd7wAUpdxltM9eZS82VEQxIaOGUDqnGompEu3nPRv9KD5kZqgz/L/jp5I+PR3y1D Uaj8W+FfF/AZtMRLJHl3I0kUHRhfuIusir5zja7UCoR6UEeipLvBzbi/DSGfBCRY /VbBv9ZZBeQ+Kw4EwS4/7G5nw1RX4/bKGSi0zcwwmD2unB7Plm9MjI65yR4oFidl uOpCYFwNk6PqCFED/mCz =wjZ/ -----END PGP SIGNATURE-----

1 0