- OpenStack-announce - lists.openstack.org

[OSSA 2013-009] Keystone PKI tokens online validation bypasses revocation check (CVE-2013-1865)
by Thierry Carrez 20 Mar '13

20 Mar '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 OpenStack Security Advisory: 2013-009 CVE: CVE-2013-1865 Date: March 20, 2013 Title: Keystone PKI tokens online validation bypasses revocation check Reporter: Guang Yee (HP) Products: Keystone Affects: Folsom Description: Guang Yee from HP reported a vulnerability in the revocation check for Keystone PKI tokens. Those tokens are supposed to be validated locally using cryptographic checks, but the user also has the option of asking the server to validate them. In that case, the online verification of PKI tokens would bypass the revocation check, potentially affirming revocated tokens are still valid. Only Folsom setups making use of online verification of PKI tokens are affected. Folsom fix: https://review.openstack.org/#/c/24906/ References: https://bugs.launchpad.net/keystone/folsom/+bug/1129713 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2013-1865 - -- Thierry Carrez (ttx) OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iQIcBAEBCAAGBQJRSdTdAAoJEFB6+JAlsQQj9sUQAL0y9zV5xWHDhAFpfaUGobq6 n5TVeEEf3kb1CIYuVhX6vHuPl2CtoekMSX7MOLehiwmbxGw3B4G7DONZrWuxmzOT J9B9kwMew3K5lE3X4oYH3cHjkTC+ZsnlUBzNiJIXEAkBFaGLmCwbt2eCREBcKvU8 glaPKncO226Y85wMV+Sbe12qDX/82o6TydkcJglhdGF3AYI4813yGb/U41rkKUnq zlsg4Zaea4IFUe23fc9EchRDcgR1N+yfZf04+CKRymhvOcYzSLZDNxJpYN+jwzLy UcB3Jqak8FR0+w3k28bz41COUWtynrTy5FAoDgvGtLM2m1GedMygNKdMb1yERC9z ELWb0P1Z6qt5zZa6BORM185PJ9Dy5zQkOOOH1I7nWjnIa9wFzvbQBKHv5WPARWDu rdAM2I55JmGxo6qFJWK6QnpYI6o6PQjQ2s0FC/H2kCMgXPygURD/X101Y2lOFSZ7 P8OhTKoVYqZf5pImpKCbtm1GHWIpev7BkzWvsFpPhVz4ExHSTsmc1Mk2ugDGQrgO tCcF7Eo0eABepY4qVrSUi4euZvpFsWcjl7GzQ0WLCWyMUdPo9271ZfsgxfPxId7l CMgn2hgpGv5+yTDDg4p8NSqmUp5hSMo/i6zgDrL9XEn4qx5Rr8pNqV/vUhmYQmzV qQqwB3DR57T1eFMlGL7y =9dar -----END PGP SIGNATURE-----

1 0

[OSSA 2013-008] Nova DoS by allocating all Fixed IPs (CVE-2013-1838)
by Thierry Carrez 14 Mar '13

14 Mar '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 OpenStack Security Advisory: 2013-008 CVE: CVE-2013-1838 Date: March 14, 2013 Title: Nova DoS by allocating all Fixed IPs Reporter: Vish Ishaya (Nebula) Products: Nova Affects: All versions Description: Vish Ishaya reported a vulnerability in Nova where there is no quota for Fixed IPs. Previously the instance quota acted as a proxy for a Fixed IP quota, but if your configuration allows an instance to consume more than one Fixed IP via an extension such as multinic then this is no longer true. Running out of Fixed IPs would result in not being able to spawn new instances. Grizzly (development branch) fix: https://review.openstack.org/#/c/24451/ Folsom fix: https://review.openstack.org/#/c/24452/ Essex fix: https://review.openstack.org/#/c/24453/ References: https://bugs.launchpad.net/nova/+bug/1125468 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2013-1838 - -- Thierry Carrez (ttx) OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iQIcBAEBCAAGBQJRQgtEAAoJEFB6+JAlsQQjf6gP/0Ao3Hq5MSChlbwtjMiUPPlC ralE6V5l3/V/jPJ/XiHrSJo2qbwgil4SSrwj6mDx00bwj3lLyYKV9KjRx9FJjwl0 YuUm/AY1R4/miED8HyjhhteC0xAisqciwZQLrN6DwAdP3YEDZZk0Cfxp3Xw6XxAM SAb2Gp0Ranu0lc7jLBNsp0G4idZvF232kXRDEMgpAwcsjmxh1sl97IBUqq87UJax RDnI2p/bpPahZXBZK4RPZR92IbdVZ4SE+piC0b4ITESdxAh9NadWfUBIkf4fOdvM yVKWFvRMhIFqTFEnpaX/091mOzkHJ8bWRpKImrw3qSLvXzyzlBwuuT0NyL6qDTPQ 0cY9gkiyqOtlvsAxF7tNDHxnIlq/zy86Tvi3KVoyJcUenGPjZwWNINhyvvFWs03t n0W58XQOnXPxYLSI3CG5gUcJUWTbJQKQAapkoMGUASc7kcVCNv334z45Ui4n51o4 5WUOQTzgWJRskqolull7wpScaNoZtQgnnSTHwtAXt4Pykum4N3FEOEo4C/gHa1uz nW8YkZRgoHbGYNypNDDWE6UdPZT/WOO/+RbMQwRVitFJtHzG1FuLa1fNP6mKxDPn vpHnp9jBZlW9OjBZgp7/YqFv586l/xrT1hG3i+I6fq2w5G7Gru5PeRhUElzq4qHF k+FvT1+nkHkvTbMb8z1z =gipy -----END PGP SIGNATURE-----

1 0

[OSSA 2013-007] Backend credentials leak in Glance v1 API (CVE-2013-1840)
by Thierry Carrez 14 Mar '13

14 Mar '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 OpenStack Security Advisory: 2013-007 CVE: CVE-2013-1840 Date: March 14, 2013 Title: Backend credentials leak in Glance v1 API Reporter: Stuart McLaren (HP) Products: Glance Affects: All versions Description: Stuart McLaren from HP reported a vulnerability in the information potentially returned to the user in Glance v1 API. If an authenticated user requests, through the v1 API, an image that is already cached, the headers returned may disclose the Glance operator's backend credentials for that endpoint. Only setups accepting the Glance v1 API and using either the single-tenant Swift store or S3 store are affected. Grizzly (development branch) fix: https://review.openstack.org/24437 Folsom fix: https://review.openstack.org/24438 Essex fix: https://review.openstack.org/24439 References: https://bugs.launchpad.net/glance/+bug/1135541 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2013-1840 - -- Thierry Carrez (ttx) OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iQIcBAEBCAAGBQJRQfdoAAoJEFB6+JAlsQQj0g4QAL+tmSjDHukvwPZ1D72ClLIR NKV9ceVNT+qus1W5Og2GOKjnrib8X4qkoR/P/Wp+nEoWYosch4YTMvpxc8hamm9P OohMdT4RFxQut//ZR6sn/TC2qLgErovlZRMxBKA43sFqHNbirprF5b9A4fF7glp6 atPAAM7rIHTJDXHvE+a8Qe8qOPKJKP1pOXrSZDL94ZMPq6uAy/0M0v/r/++aAUHy Qr7p2ITuVepJ3IM9/sZ+RQ1PXFya0BGBpLBEgaotBmmOMI/FNbthS3PT8W1ywX0S gpgcBLiXMXoNsMZCmsLeYirzldaT+ZtqjOxYqZYiAjn5cIQ5XXjFPq8w9vlh83An 8IVnanVl4C1M4hnYo3sCeFsCnh5sLdM/LVnd19Wz1k1PHTCM7vrNtU0wqAMQFj2C BQqNMMcQvFZdEjvzYymlm365DP07DHOi/jgK59EWCfeaEHx4Vs4fL0a9nnoxs/fV 8SysPv4A3iAaXDOan+0s+T0dac2/KU2FBio0+cuvV4qASYWN5CHAR9/6icWJQ2qh InUWIqcgwcOqR6azhQHg/ARw7iNZtv+omVvVOYZu6HOiK4BDj8RkQmPyWsis/ekU 4Ez6AyKSDmRHtoR9w7GcM14xCrHyqFfbaGUp+qDI73NNGmbXXtXlVEO8/g2ywbKc F0k3S2Z5fLOPFeo9ll4C =BmKh -----END PGP SIGNATURE-----

1 0

OpenStack Community Weekly Newsletter (Mar 1 -8)
by Stefano Maffulli 09 Mar '13

09 Mar '13

Highlights of the week We Wrote an OpenStack Operations Guide in 5 Days! <http://blog.phymata.com/2013/03/07/we-wrote-openstack-ops-guide-5-days/> OpenStack Operations Guide <http://www.openstack.org/blog/wp-content/uploads/2013/03/OpenStackOpsGuide.…>And here it is...the OpenStack Operations Guide <http://docs.openstack.org/ops/>. You can read it in EPUB, MOBI, PDF, or print <http://www.lulu.com/content/paperback-book/openstack-operations-guide/13692…>. The electronic formats are free to download so click away. The print version costs $29.90 and all proceeds go to the OpenStack Foundation to support more book sprints like the one that produced this book. Read from the protagonists how they did it: Lorin <http://Lorin/>Hochstein <http://lorinhochstein.wordpress.com/2013/03/05/open-source-documentation-in…>, Everett <http://blog.phymata.com/2013/03/07/we-wrote-openstack-ops-guide-5-daysEvere…>Toews <http://blog.phymata.com/2013/03/07/we-wrote-openstack-ops-guide-5-days/>, Anne Gentle <http://www.openstack.org/blog/2013/03/we-did-it-zero-to-book-in-five-days/>. Case Study on OpenStack Cloud in Health Care <http://www.mirantis.com/blog/case-study-on-openstack-cloud-in-health-care/> Computing for health care and life sciences is rapidly adapting to opportunities created by new technologies for scalable data storage, elastic compute service resources, and data analytics. Given the powerful forces changing the economics of the overall health care marketplace, technologies that can address security and compliance at reduced cost are getting a lot of attention. OpenStack Object Storage and quotas in upcoming 1.8.0 (Grizzly) release. <http://www.enovance.com/fr/blog/5458/swift-and-quotas-in-upcoming-1-8-0-gri…> OpenStack Object Storage (codename Swift) will have two new middleware for managing quotas: container_quotas and account_quotas. The first, container_quotas, allows users to specify a limit on one of their containers. The account_quotas is more the typical quota implementation. A «super user» with the reselleradmin group/role can set a byte limit for an account and the account will not be able to have new objects/containers until someone cleanups his account to get under the limited quotas. OpenStack Updated Individual Contributor License Agreements <http://anteaya.info/blog/2013/03/08/openstack-updated-individual-contributo…> Last weekend we updated the OpenStack Individual Contributor License Agreement and all OpenStack contributors needed to sign a new individual agreement. We graphed the data of the rate of signups: almost 400 developers signed in less than a week. Tips and Tricks * By Loïc Dachary <http://dachary.org/>: nova-network debugging tips <http://dachary.org/?p=1929> * ByAdam Young <http://adam.younglogic.com/>: Keystone, MySQL and Fedora 18 <http://adam.younglogic.com/2013/03/keystone-mysql-and-fedora-18/> * By John Bresnahan <https://tropicaldevel.wordpress.com/>: A Look At Performance When Glance Is Backed By Gluster <https://tropicaldevel.wordpress.com/2013/03/06/a-look-at-performance-when-g…> * By Kashyap Chamarthy <http://kashyapc.wordpress.com/>: OpenStack nova --- dealing with unused base images <http://kashyapc.wordpress.com/2013/03/03/openstack-nova-dealing-with-unused…> Upcoming Events * OpenStack Day Tokyo 2013 <http://openstackdays.com/en/> Mar 12, 2013 -- Tokyo, Japan Details <http://openstackdays.com/en/> * OpenStack Italia User Group <http://www.meetup.com/OpenStack-User-Group-Italia/events/102481022/> Mar 14, 2013 -- Milano, Italy Details <http://www.meetup.com/OpenStack-User-Group-Italia/events/102481022/> * PyCon 2013 & Job Fair <https://us.pycon.org/2013/> Mar 14 -- 17, 2013 -- Santa Clara, CA Details <https://us.pycon.org/2013/> * OpenStack Meetup <http://www.meetup.com/Indian-OpenStack-User-Group/events/105831232/> Mar 17, 2013 -- Bangalore, India Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/105831232/> * OpenStack Object Storage (Swift) API Sprint at PyCon 2013 <https://us.pycon.org/2013/community/sprints/swift/> Mar 18, 2013 -- Santa Clara, CA Details <https://us.pycon.org/2013/community/sprints/swift/> * OpenStack Paris Meetup <http://www.meetup.com/OpenStack-France/events/104394682/> Mar 19, 2013 -- Paris, France Details <http://www.meetup.com/OpenStack-France/events/104394682/> * World Hosting Days 2013 <http://www.worldhostingdays.com/eng/index.php> Mar 19 -- 21, 2013 -- Rust, Germany Details <http://www.worldhostingdays.com/eng/index.php> * OpenStack Presentation at BALUG <http://www.balug.org/#2013-03-19>Mar 19, 2013 -- San Francisco, CA RSVP <http://www.balug.org/#2013-03-19> * OpenStack Developers Meetup <http://www.meetup.com/openstack-atlanta/> Mar 21, 2013 -- Atlanta, GA Details <http://www.meetup.com/openstack-atlanta/> * 1st OpenStack User Group Nordics meetup <http://www.meetup.com/OpenStack-User-Group-Nordics/events/95258382/> Apr 03, 2013 -- Kista, Sweden Details <http://www.meetup.com/OpenStack-User-Group-Nordics/events/95258382/> * OpenStack Summit April 2013 <http://www.openstack.org/summit/portland-2013/> Apr 15 -- 18, 2013 -- Portland, OR Details <http://www.openstack.org/summit/portland-2013/> * OpenStack Israel <http://www.openstack.org/> May 27, 2013 -- Tel-Aviv, Israel Coming Soon <http://www.openstack.org/> * GigaOM Structure <http://event.gigaom.com/structure/> Jun 19 -- 20, 2013 -- San Francisco, CA Details <http://event.gigaom.com/structure/> Reports from past events * OpenStack at Linux.conf.au 2013 -- Videos posted and some pics <http://www.openstack.org/blog/2013/03/openstack-at-linux-conf-au-2013-video…> Other News * Important CLA changes to the way we handle the CLA <http://markmail.org/message/azrdwianmnt2j5oc> * Internship is 2/3 Complete -- How Am I Doing? <http://anteaya.info/blog/2013/03/08/internship-is-2-slash-3-complete-how-am…> * Scalr multi-cloud capabilities extended: OpenStack (Folsom release) now supported <http://scalr.com/blog/multi-cloud-capabilities-extended-openstack-folsom-re…> * Kwapi: an energy efficiency architecture <http://xlcloud.org/bin/view/Blog/Kwapi+an+energy+efficiency+architecture?la…> * Ceilometer bug squash day #2 <http://julien.danjou.info/blog/2013/ceilometer-bug-squash-day-2> * OpenStack Project Meeting: Summary <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-03-05-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-03-05-21.…>. Welcome New Contributors Celebrating the first patches submitted this week by: * Bob Ball, Citrix * Stas Maksimov, Dell * Fei Long Wang, IBM * Avinash Prasad, NTT Data * KC Wang, Bigswitch * Divakar Padiyar Nandavar, HP /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

OpenStack Community Weekly Newsletter (Feb 22 - Mar 1)
by Stefano Maffulli 02 Mar '13

02 Mar '13

Highlights of the week Important CLA changes coming this weekend (2nd try) <http://markmail.org/message/azrdwianmnt2j5oc> Last weekend the change was blocked at the last minute by a request to amend the CLA text. We're trying again this weekend. Starting on March 3, 2013 1700UTC all contributors MUST review and agree to the new OpenStack Individual Contributor License Agreement and provide updated contact information at https://review.openstack.org/#/settings/agreements. On that day the Gerrit interface will be changing to present the new CLA text referring to the OpenStack Foundation, and will prompt you to agree to it there. Any previous agreement with OpenStack LLC will be marked expired at that time. The text of the new agreement is available for your convenience <https://review.openstack.org/static/cla.html>. You must also sign up for an OpenStack Foundation Individual Membership with the same E-mail address as used for your Gerrit contact information: http://openstack.org/register/. What's new in OpenStack Grizzly ? <http://www.enovance.com/%25postname> Folsom brought us two new core projects : Quantum <https://wiki.openstack.org/wiki/Quantum> (Networking) and Cinder <https://wiki.openstack.org/wiki/Cinder> (Volumes). Two new projects have been incubated : Ceilometer <https://wiki.openstack.org/wiki/Ceilometer> (metering) led by Nicolas Barcet <http://fr.linkedin.com/in/nbarcet> (VP Products at eNovance), and Heat <https://wiki.openstack.org/wiki/Heat> (Cloud Orchestration). Oslo <https://wiki.openstack.org/wiki/Oslo> is a new incubated project which produces a set of python libraries containing infrastructure code shared by all OpenStack projects. More details for each OpenStack project on this post by eNovance. OpenStack Ceilometer and Heat projects graduated <http://julien.danjou.info/blog/2013/openstack-ceilometer-head-graduated> The OpenStack Technical Committee <http://www.openstack.org/foundation/technical-committee/> have voted these last weeks about graduation of Heat <https://launchpad.net/heat> and Ceilometer <http://launchpad.net/ceilometer>, to change their status from /incubation/ to /integrated/*. *Heat and Ceilometer will be released as part as OpenStack for the next release cycle /Havana/, due in October 2013. **Raspberry Pi as a transparent squid caching proxy* <http://blog.stevebaker.org/2013/02/raspberry-pi-as-transparent-squid.html>* How does a hacker improve build times when he has a slow Internet connection? A fascinating use of a tiny sub-$50 computer (RaspberryPi) to build cloud images for OpenStack. By Steve Baker <http://blog.stevebaker.org/search/label/openstack> **Data placement in OpenStack Object Storage Swift* <http://swiftstack.com/blog/2013/02/25/data-placement-in-swift/>* Technical deep dive in how OpenStack Object Storage solves one of the hard problems of all distributed storage system: how to effectively place the data within the storage cluster. Swift has a "unique-as-possible" placement algorithm which ensures that the data is placed efficiently and with as much protection from hardware failure as possible. **The life of an OpenStack libvirt image* <http://www.pixelbeat.org/docs/openstack_libvirt_images/#1361764412>* The main stages of a Virtual Machine disk image as it transfers through OpenStack to be booted under libvirt explained by Pádraig Brady <http://www.pixelbeat.org/>. Security Advisories * OSSA-2013-006] VNC proxy can connect to the wrong VM (CVE-2013-0335) <http://lists.openstack.org/pipermail/openstack-announce/2013-February/00008…> Tips and Tricks * By Daniel P. Berrangé <https://www.berrange.com/>: Installing a 4 node Fedora 18 OpenStack Folsom cluster with PackStack <https://www.berrange.com/posts/2013/03/01/installing-a-4-node-fedora-18-ope…> * By Victoria Martínez de la Cruz <http://vmartinezdelacruz.com/>: Attention newcomers! #openstack-101 is now open at Freenode <http://vmartinezdelacruz.com/attention-newcomers-openstack-101-is-now-open-…> * By Anita Kuno <http://anteaya.info/>: The Structure and Habits of Git <http://anteaya.info/blog/2013/02/26/the-structure-and-habits-of-git/> * By Andreas Jaeger <http://jaegerandi.blogspot.com/search/label/OpenStack>: Coordinating efforts to create OpenStack packages for openSUSE and SUSE Linux Enterprise Server <http://jaegerandi.blogspot.com/2013/02/coordinating-efforts-to-create.html> Upcoming Events * OpenStack Sessions @ Barcamp Bangalore13 <http://barcampbangalore.org/bcb/event/bcb13> Mar 02, 2013 -- Bangalore, India Details <http://barcampbangalore.org/bcb/event/bcb13> * Pulse Open Cloud Summit <http://www.ibmpulseblog.com/new-pulse-open-cloud-summit-arrive-early-on-sun…>Mar 03, 2013 -- MGM Grand in Las Vegas, NV Details <http://www.ibmpulseblog.com/new-pulse-open-cloud-summit-arrive-early-on-sun…> * Pulse 2013 <https://www-01.ibm.com/software/tivoli/pulse/agenda/index.html> Mar 04 -- 06, 2013 -- Las Vegas, NV Details <https://www-01.ibm.com/software/tivoli/pulse/agenda/index.html> * OpenStack Day Tokyo 2013 <http://openstackdays.com/en/> Mar 12, 2013 -- Tokyo, Japan Details <http://openstackdays.com/en/> * OpenStack Italia User Group: ...dove eravamo rimasti? <http://www.meetup.com/OpenStack-User-Group-Italia/events/102481022/> Mar 14, 2013 -- Milano, Italy Details <http://www.meetup.com/OpenStack-User-Group-Italia/events/102481022/> * PyCon 2013 & Job Fair <https://us.pycon.org/2013/> Mar 14 -- 17, 2013 -- Santa Clara, CA Details <https://us.pycon.org/2013/> * OpenStack Meetup <http://www.meetup.com/Indian-OpenStack-User-Group/events/105831232/> Mar 17, 2013 -- Bangalore, India Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/105831232/> * OpenStack Object Storage (Swift) API Sprint at PyCon 2013 <https://us.pycon.org/2013/community/sprints/swift/> Mar 18, 2013 -- Santa Clara, CA Details <https://us.pycon.org/2013/community/sprints/swift/> * OpenStack Paris Meetup <http://www.meetup.com/OpenStack-France/events/104394682/> Mar 19, 2013 -- Paris, France Details <http://www.meetup.com/OpenStack-France/events/104394682/> * World Hosting Days 2013 <http://www.worldhostingdays.com/eng/index.php> Mar 19 -- 21, 2013 -- Rust, Germany Details <http://www.worldhostingdays.com/eng/index.php> * OpenStack Developers Meetup <http://www.meetup.com/openstack-atlanta/> Mar 21, 2013 -- Atlanta, GA Details <http://www.meetup.com/openstack-atlanta/> * 1st OpenStack User Group Nordics meetup <http://www.meetup.com/OpenStack-User-Group-Nordics/events/95258382/> Apr 03, 2013 -- Kista, Sweden Details <http://www.meetup.com/OpenStack-User-Group-Nordics/events/95258382/> * OpenStack Summit April 2013 <http://www.openstack.org/summit/portland-2013/> Apr 15 -- 18, 2013 -- Portland, OR Details <http://www.openstack.org/summit/portland-2013/> * OpenStack Israel <http://www.openstack.org/> May 27, 2013 -- Tel-Aviv, Israel Coming Soon <http://www.openstack.org/> * GigaOM Structure <http://event.gigaom.com/structure/> Jun 19 -- 20, 2013 -- San Francisco, CA Details <http://event.gigaom.com/structure/> Reports from past events * OpenStack Delhi Meetup <http://www.hastexo.com/blogs/syed/2013/02/25/openstack-delhi-meetup> Other News * The path to Ask OpenStack <http://lists.openstack.org/pipermail/community/2013-February/000153.html> * OpenStack Unit Testing: a Long Journey Starts With a Small Step <http://openstackgd.wordpress.com/2013/02/23/openstack-unit-testing-a-long-j…> * Session proposals for the Havana Design Summit now open <http://lists.openstack.org/pipermail/openstack-dev/2013-February/005664.html> * OpenStack Project Meeting: Summary <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-02-26-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-02-26-21.…>. Welcome New Contributors Celebrating the first patches submitted this week by: * Jian Zhang, Intel * Dae S. Kim * Robert van Leeuwen, Spilgames /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

[OSSA-2013-006] VNC proxy can connect to the wrong VM (CVE-2013-0335)
by Russell Bryant 26 Feb '13

26 Feb '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 OpenStack Security Advisory: 2013-006 CVE: CVE-2013-0335 Date: February 26, 2013 Title: VNC proxy can connect to the wrong VM Reporter: Loganathan Parthipan (HP), Rohit Karajgi (NTT Data) Products: Nova Affects: All versions Description: Loganathan Parthipan (HP) and Rohit Karajgi (NTT Data) independently reported a vulnerability in Nova. If a user requests a console and then deletes the VM, it is possible that the console token could allow connectivity to a different VM before the console token expires if the VNC port gets reused in that time period. This issue can be worked around by disabling VNC support. Fixes: master (grizzly): https://review.openstack.org/#/c/22086/ stable/folsom: https://review.openstack.org/#/c/22758 stable/essex: https://review.openstack.org/#/c/22872/ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2013-0335 https://bugs.launchpad.net/nova/+bug/1125378 - -- Russell Bryant OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlEtAE4ACgkQFg9ft4s9SAZKLwCePGfNZAYdx2mjM2hWHt26Kff6 2HAAn38YuA93O4wg7SDUtcXar1Yr0d9q =sVp/ -----END PGP SIGNATURE-----

1 0

OpenStack Community Weekly Newsletter (Feb 15 – 22)
by Stefano Maffulli 23 Feb '13

23 Feb '13

Highlights of the week Important CLA changes coming this weekend <http://markmail.org/message/azrdwianmnt2j5oc> Starting on February 24, 2013 all contributors MUST review and agree to the new OpenStack Individual Contributor License Agreement and provide updated contact information at https://review.openstack.org/#/settings/agreements. On that day the Gerrit interface will be changing to present the new CLA text referring to the OpenStack Foundation, and will prompt you to agree to it there. Any previous agreement with OpenStack LLC will be marked expired at that time. The text of the new agreement is available for your convenience <https://review.openstack.org/static/cla.html> (changes “LLC” to “Foundation”, restores a sentence from ASF <https://review.openstack.org/#/c/22396/2/modules/openstack_project/files/ge…> and corrects a few typographical errors). You must also sign up for an OpenStack Foundation Individual Membership with the same E-mail address as used for your Gerrit contact information: http://openstack.org/register/. OpenStack outpaces Amazon, at least by hype <http://www.mirantis.com/blog/openstack-outpaces-amazon-at-least-by-hype/> A study conducted by TrendKite shows that at this point OpenStack has more media mentions than Amazon EC2, Eucalyptus, CloudStack and OpenNebula combined. If that is not enough, another chart from the same study appears to show that “OpenStack” media mentions are on par with that of “Cloud Computing.” CloudEnvy: Development in the cloud! <http://jake.ai/cloudenvy-development-in-the-cloud> Jake Dahn is working on a project called CloudEnvy which has potential to change the development patterns of web developers everywhere: it allows you to configure and distribute reproducible development environments in the cloud. Bring on the Crazy: Zero to Book in Five Days <http://www.openstack.org/blog/2013/02/bring-on-the-crazy-zero-to-book-in-fi…> Anne Gentle is leading a “crazy” project: a large, highly focused documentation sprint to write that operator’s guide — for operators by operators. Anne promised to pluck operators out of their day jobs, put them in a room, fuel them with coffee, BBQ, and TexMex, and get to writing. Sounds awesome to me: I’m voting for their panel On Writing the OpenStack Operations Manual in 5 Days <http://www.openstack.org/summit/portland-2013/vote-for-speakers/presentatio…> at the upcoming OpenStack Summit. The OpenStack Gate <http://dague.net/2013/02/21/the-openstack-gate/> The OpenStack project has a really impressive continuous integration system, which is one of its core strengths as a project. Every proposed change to our gerrit review <https://review.openstack.org/#/> system is subjected to a battery of tests on each commit, which has grown dramatically with time, and after formal review by core contributors, we run them all again before the merge. How can this gate merge hundreds of changes per day? Learn about Zuul, the OpenStack gatekeeper. Security Advisories * OSSA 2013-005] Keystone EC2-style authentication accepts disabled user/tenants (CVE-2013-0282) <http://lists.openstack.org/pipermail/openstack-announce/2013-February/00007…> * OSSA 2013-004] Information leak and Denial of Service using XML entities (CVE-2013-1664, CVE-2013-1665) <http://lists.openstack.org/pipermail/openstack-announce/2013-February/00007…> Tips and Tricks * By Victoria Martínez de la Cruz <http://vmartinezdelacruz.com/>: How to work with blueprints without losing your mind <http://vmartinezdelacruz.com/how-to-work-with-blueprints-without-losing-you…> * By Anita Kuno <http://anteaya.info/>: OpenStack Release Cycle – n00b’s Eyeview <http://anteaya.info/blog/2013/02/20/openstack-release-cycle-n00bs-eyeview/> * By Daniel P. Berrangé <https://www.berrange.com/>: A reminder why you should never mount guest disk images on the host OS <https://www.berrange.com/posts/2013/02/20/a-reminder-why-you-should-never-m…> * By Everett Toews <http://blog.phymata.com/>: Swift Only with OpenStack DevStack on the Rackspace Cloud <http://blog.phymata.com/2013/02/18/swift-only-with-openstack-devstack-on-th…> * By Laura Alves <http://ladquin.dreamwidth.org/>: Doc for code and Doc as code – Part I <http://ladquin.dreamwidth.org/1207.html> * By Russell Bryant <http://russellbryantnet.wordpress.com/>: Deployment Considerations for nova-conductor Service in OpenStack Grizzly <http://russellbryantnet.wordpress.com/2013/02/19/deployment-considerations-…> * By Sébastien Han <http://sebastien-han.fr/>:override DHCP information sent by DNSMASQ to a VM <http://sebastien-han.fr/blog/2013/02/18/openstack-override-dhcp-information…> Upcoming Events * SCALE 11x <https://www.socallinuxexpo.org/scale11x/> Feb 22 – 24, 2013 – Los Angeles, CA Details <https://www.socallinuxexpo.org/scale11x/> * OpenStack in Production at Scale <http://www.meetup.com/meetup-group-NjZdcegA/events/103564202/> Feb 28, 2013 – Chicago, IL Details <http://www.meetup.com/meetup-group-NjZdcegA/events/103564202/> * Pulse Open Cloud Summit <http://www.ibmpulseblog.com/new-pulse-open-cloud-summit-arrive-early-on-sun…>Mar 03, 2013 – MGM Grand in Las Vegas, NV Details <http://www.ibmpulseblog.com/new-pulse-open-cloud-summit-arrive-early-on-sun…> * Pulse 2013 <https://www-01.ibm.com/software/tivoli/pulse/agenda/index.html> Mar 04 – 06, 2013 – Las Vegas, NV Details <https://www-01.ibm.com/software/tivoli/pulse/agenda/index.html> * OpenStack Day Tokyo 2013 <http://openstackdays.com/en/> Mar 12, 2013 – Tokyo, Japan Details <http://openstackdays.com/en/> * OpenStack Italia User Group: …dove eravamo rimasti? <http://www.meetup.com/OpenStack-User-Group-Italia/events/102481022/> Mar 14, 2013 – Milano, Italy Details <http://www.meetup.com/OpenStack-User-Group-Italia/events/102481022/> * OpenStack Object Storage (Swift) API Sprint at PyCon 2013 <https://us.pycon.org/2013/community/sprints/swift/> Mar 18, 2013 – Santa Clara, CA Details <https://us.pycon.org/2013/community/sprints/swift/> * OpenStack Paris Meetup <http://www.meetup.com/OpenStack-France/events/104394682/> Mar 19, 2013 – Paris, France Details <http://www.meetup.com/OpenStack-France/events/104394682/> * World Hosting Days 2013 <http://www.worldhostingdays.com/eng/index.php> Mar 19 – 21, 2013 – Rust, Germany Details <http://www.worldhostingdays.com/eng/index.php> * OpenStack Developers Meetup <http://www.meetup.com/openstack-atlanta/> Mar 21, 2013 – Atlanta, GA Details <http://www.meetup.com/openstack-atlanta/> * 1st OpenStack User Group Nordics meetup <http://www.meetup.com/OpenStack-User-Group-Nordics/events/95258382/> Apr 03, 2013 – Kista, Sweden Details <http://www.meetup.com/OpenStack-User-Group-Nordics/events/95258382/> * OpenStack Summit April 2013 <http://www.openstack.org/summit/portland-2013/> Apr 15 – 18, 2013 – Portland, OR Details <http://www.openstack.org/summit/portland-2013/> * OpenStack Israel <http://www.openstack.org/> May 27, 2013 – Tel-Aviv, Israel Coming Soon <http://www.openstack.org/> * GigaOM Structure <http://event.gigaom.com/structure/> Jun 19 – 20, 2013 – San Francisco, CA Details <http://event.gigaom.com/structure/> Reports from previous events * OpenStack mini conference @gnunify.in <http://www.hastexo.com/blogs/syed/2013/02/21/openstack-mini-conference-gnun…> * 2nd Swiss OpenStack User Group <http://www.openstack.org/blog/2013/02/2nd-swiss-openstack-user-group/> * TryStack.cn Community 2nd Meetup – 19th February 2013 <http://www.openstack.org/blog/2013/02/trystack-2nd-meetup-2013/> Other News * OpenStack wiki migration <http://ryandlane.com/blog/2013/02/19/openstack-wiki-migration/> * OpenStack newcomers channel opening in Freenode <http://markmail.org/message/ftdky3n6xstn3355> * Grizzly-3 development milestone available (Keystone, Glance, Nova, Horizon, Quantum, Cinder) <http://lists.openstack.org/pipermail/openstack-announce/2013-February/00008…> * OpenStack Project Meeting: Summary <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-02-19-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-02-19-21.…> Welcome New Contributors Celebrating the first patches submitted this week by: * Toshiyuki Hayashi, NTT * Joe Topjian * David Höppner * Erik Zaadi, IBM * Nathanael Burton * alatynskaya, Mirantis * David Peraza, IBM * Brant Knudson, IBM /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

Grizzly-3 development milestone available (Keystone, Glance, Nova, Horizon, Quantum, Cinder)
by Thierry Carrez 22 Feb '13

22 Feb '13

Hi everyone, The last milestone of the Grizzly development cycle, "grizzly-3" is now available for testing. This milestone contains almost all of the features that will be shipped in the final 2013.1 ("Grizzly") release on April 4, 2013. This was an extremely busy milestone, with 100 blueprints implemented and more than 450 bugfixes overall. You can find the full list of new features and fixed bugs, as well as tarball downloads, at: https://launchpad.net/keystone/grizzly/grizzly-3 https://launchpad.net/glance/grizzly/grizzly-3 https://launchpad.net/nova/grizzly/grizzly-3 https://launchpad.net/horizon/grizzly/grizzly-3 https://launchpad.net/quantum/grizzly/grizzly-3 https://launchpad.net/cinder/grizzly/grizzly-3 Those projects are now temporarily feature-frozen (apart from already-granted exceptions) as we switch to testing and bugfixing mode in preparation for our first release candidates. Please test, try the new features, report bugs and help fix them ! Regards, -- Thierry Carrez (ttx) Release Manager, OpenStack

1 0

[OSSA 2013-005] Keystone EC2-style authentication accepts disabled user/tenants (CVE-2013-0282)
by Thierry Carrez 19 Feb '13

19 Feb '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 OpenStack Security Advisory: 2013-005 CVE: CVE-2013-0282 Date: February 19, 2013 Keystone EC2-style authentication accepts disabled user/tenants Reporter: Nathanael Burton (National Security Agency) Products: Keystone Affects: All versions Description: Nathanael Burton reported a vulnerability in EC2-style authentication in Keystone. Keystone fails to check whether a user, tenant, or domain is enabled before authenticating a user using the EC2 api. Authenticated, but disabled users (or authenticated users in disabled tenants or domains) could therefore retain access rights that were thought removed. Only setups enabling EC2-style authentication are affected. To disable EC2-style authentication to work around the issue, remove the EC2 extension (keystone.contrib.ec2:Ec2Extension.factory) from the keystone API pipeline in keystone.conf. Grizzly (development branch) fix: https://review.openstack.org/#/c/22319/ Folsom fix: https://review.openstack.org/#/c/22320/ Essex fix: https://review.openstack.org/#/c/22321/ References: https://bugs.launchpad.net/keystone/+bug/1121494 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2013-0282 - -- Thierry Carrez (ttx) OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iQIcBAEBCAAGBQJRI7nbAAoJEFB6+JAlsQQjGHgP/2yHBH4Yvzl3Q0P4oMr2Vskb 9xroi6sEQTgP/KaidIiV2lORdgSqYZZlylW3EbHnR1Io9natqCLfYkkEdpagTUxM WcYXAJtBHbHN+hpeGiYojPsV1LmgIX81UrausX1k5U1ZtFkvOhrfhcXWPOozREkM WwhYjaGl14dmIusE7h0uY7VNTiQMI9LAft18OfJMNFTwA/FmkxlPO/Jea8CUwDIl LSLv+MRFw2M01TnsAYlnFsa9O7175q2DpNPCqXYjh38ewNBJHuArtuASkA7hHrMA wYUzAS3lho9WuGVG/GwZk1V//GQhpzn/VWxRCmuOS3tpwTksbkXF36kwOnP5Vu5N uo9jLBAovHIqfr0QGXGYMXA9Bu9jW5geUIuDNvpKkAFIiQVS3JcDWsqsu7otgjHY HKUKmYF66BAJmmaM7aXPswGs61B6F3SLIZCneOp9N8PnT3PCR57++zMEjEWBYuLw E4BDKPa1k2Q822hxWizhXAmkfc5t+AVk2kKPa9a5sMY2oNNrqtRR4+jMjXiS9CmU gQs9VbXrmMy577zcCkzj7ci7fY0iFUtHW7PhFKUpHf2Mpr2/vLwc4p8g5da8bTwU 2swDuJ/KPsd66oEYjQW0CGBymMTkmbZWUX4InAj1ZynESW46cb/CAaS8oGk2I6dC F3MMfAjNkfhO9srLLNoC =fWOa -----END PGP SIGNATURE-----

1 0

[OSSA 2013-004] Information leak and Denial of Service using XML entities (CVE-2013-1664, CVE-2013-1665)
by Thierry Carrez 19 Feb '13

19 Feb '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 OpenStack Security Advisory: 2013-004 CVE: CVE-2013-1664, CVE-2013-1665 Date: February 19, 2013 Title: Information leak and Denial of Service using XML entities Reporter: Jonathan Murray (NCC Group), Joshua Harlow (Yahoo!), Stuart Stent Products: Keystone, Nova, Cinder (see note) Affects: All versions Description: Jonathan Murray from NCC Group, Joshua Harlow from Yahoo! and Stuart Stent independently reported a vulnerabilities in the parsing of XML requests in Python XML libraries used in Keystone, Nova and Cinder. By using entities in XML requests, an unauthenticated attacker may consume excessive resources on the Keystone, Nova or Cinder API servers, resulting in a denial of service and potentially a crash (CVE-2013-1664). Authenticated attackers may also leverage XML entities to read the content of a local file on the Keystone API server (CVE-2013-1665). This only affects servers with XML support enabled. Note: The vulnerabilities are actually in the various affected Python XML libraries, but we provide OpenStack patches working around the issues. Grizzly (development branch) fixes: Nova: https://review.openstack.org/#/c/22309/ Cinder: https://review.openstack.org/#/c/22310/ Keystone: https://review.openstack.org/#/c/22315/ Folsom fixes: Nova: https://review.openstack.org/#/c/22312/ Cinder: https://review.openstack.org/#/c/22311/ Keystone: https://review.openstack.org/#/c/22314/ Essex fixes: Nova: https://review.openstack.org/#/c/22313/ Keystone: https://review.openstack.org/#/c/22316/ References: https://bugs.launchpad.net/nova/+bug/1100282 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2013-1664 https://bugs.launchpad.net/keystone/+bug/1100279 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2013-1665 - -- Thierry Carrez (ttx) OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iQIcBAEBCAAGBQJRI5+DAAoJEFB6+JAlsQQj2fQQALLE9GEOIRGcj9gXXQ5mDS3l /CWI6ljTlVWxXy143lAUbkpvW0AHx0S6wVU38Hh/wS6D3u4JpxC2lERcI6KB7XyF R6F7qWzdwulh+0GX9n+8rO0qLVkqhB6hn3bCVUKu20N+cromJHsSgzDU6lvVlUAU dwc9eFWmg2d7bpESUdltDo9yEnz0jXxzOpCseC5/zfSo5RnJU1Oi4ZaiXPzbRqqb bQzKRGevLddHAMKJnKrYvpg5471LQ8bC7rMYwq44c4HH0+ZhwQVgwyBxdeyNGISI kJ1LhTGlDdTN1SBV3QDc0//pai2tQtcY96sQJ+1FWl9wrAMft+hSyCmRlsX2O4O1 zbN/iUEVmZRP1/JuD8tk+TDUlBdTSZai3pV9bVlRQ7GWUKSreDI38T87d+ZZe0Uz f63hafBSKGqQ/GD8s5HnJopvGK1vY2zgiNuORJc5PH8iPo/75YVRM3Ct6lFwooIe uPow6AbydISEVUbsK1AcLESQ6Uq4CufsNUColi1o+2PRlc2/Jt/ZXaFx2LfsE6ka m6cXJMIZZ6Mrz6ogtYnEYDkzPPQ7/oLXzVxoS3NCoh/LLxs838eqiAZ+mVVboAaO LOARFrqYw8wfg45JLqQ2mb/Oe10hPZdMwc+lQa2ccDYLBJXkrMKz7vHW8W47bM1H i5g9RJ8pkA5wFKxBgfKj =pNuW -----END PGP SIGNATURE-----

1 0