- OpenStack-announce - lists.openstack.org

[OSSA 2014-018] Keystone privilege escalation through trust chained delegation (CVE-2014-3476)
by Tristan Cacqueray 13 Jun '14

13 Jun '14

OpenStack Security Advisory: 2014-018 CVE: CVE-2014-3476 Date: June 12, 2014 Title: Keystone privilege escalation through trust chained delegation Reporter: Steven Hardy (Red Hat) Products: Keystone Versions: up to 2013.2.3, and 2014.1 to 2014.1.1 Description: Steven Hardy from Red Hat reported a vulnerability in Keystone chained delegation. By creating a delegation from a trust or OAuth token, a trustee may abuse the identity impersonation against keystone and circumvent the enforced scope, resulting in potential elevated privileges to any of the trustor's projects and or roles. All Keystone deployments configured to enable trusts are affected, which has been the default since Grizzly. Juno (development branch) fix: https://review.openstack.org/99687 Icehouse fix: https://review.openstack.org/99700 Havana fix: https://review.openstack.org/99703 Notes: This fix will be included in the Juno-2 development milestone and in future 2013.2.4 and 2014.1.2 releases. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3476 https://launchpad.net/bugs/1324592 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

Juno-1 development milestone available
by Thierry Carrez 13 Jun '14

13 Jun '14

Hi everyone, The first milestone of the Juno development cycle, "juno-1" is now available for Keystone, Glance, Nova, Horizon, Neutron, Cinder, Ceilometer, Heat, Trove, and Sahara. It contains all the new features that have been added since the Icehouse Feature Freeze in March. You can find the full list of new features and fixed bugs, as well as tarball downloads, at: https://launchpad.net/keystone/juno/juno-1 https://launchpad.net/glance/juno/juno-1 https://launchpad.net/nova/juno/juno-1 https://launchpad.net/horizon/juno/juno-1 https://launchpad.net/neutron/juno/juno-1 https://launchpad.net/cinder/juno/juno-1 https://launchpad.net/ceilometer/juno/juno-1 https://launchpad.net/heat/juno/juno-1 https://launchpad.net/trove/juno/juno-1 https://launchpad.net/sahara/juno/juno-1 Including the oslo libraries, 51 blueprints were implemented and no less than 910 bugs were fixed during this milestone. The relatively-low number of features implemented in this milestone can be explained by the recent switch, for most of our integrated projects, to a more formal upfront review of feature design. The next development milestone, juno-2, is scheduled for July 24th. You can further track upcoming features and Juno release cycle status at: http://status.openstack.org/release/ Regards, -- Thierry Carrez (ttx)

1 0

OpenStack 2014.1.1 released
by Alan Pevec 09 Jun '14

09 Jun '14

Hello everyone, The OpenStack Stable Maintenance team is happy to announce the release of the 2014.1.1 stable Icehouse release. We have been busy reviewing and accepting backported bugfixes to the stable/icehouse branches according to the criteria set at: https://wiki.openstack.org/wiki/StableBranch A total of 79 bugs have been fixed across all projects. These updates to Icehouse are intended to be low risk with no intentional regressions or API changes. The list of bugs, tarballs and other milestone information for each project may be found on Launchpad: https://launchpad.net/ceilometer/icehouse/2014.1.1 https://launchpad.net/cinder/icehouse/2014.1.1 https://launchpad.net/glance/icehouse/2014.1.1 https://launchpad.net/heat/icehouse/2014.1.1 https://launchpad.net/horizon/icehouse/2014.1.1 https://launchpad.net/keystone/icehouse/2014.1.1 https://launchpad.net/neutron/icehouse/2014.1.1 https://launchpad.net/nova/icehouse/2014.1.1 OpenStack Database Service (Trove) did not have stable/icehouse fixes at this time and will skip 2014.1.1 release. Release notes may be found on the wiki: https://wiki.openstack.org/wiki/ReleaseNotes/2014.1.1 The freeze on the stable/icehouse branches will be lifted today as we begin working toward the 2014.1.2 release, planned for Aug 7 release and managed by Chuck Short. Thanks, Alan

1 0

OpenStack Community Weekly Newsletter (May 30 – June 6)
by Stefano Maffulli 07 Jun '14

07 Jun '14

1 0

OpenStack Community Weekly Newsletter (May 23 – 30)
by Stefano Maffulli 31 May '14

31 May '14

1 0

[OSSA 2014-017] Nova VMWare driver leaks rescued images (CVE-2014-2573)
by Jeremy Stanley 30 May '14

30 May '14

OpenStack Security Advisory: 2014-017 CVE: CVE-2014-2573 Date: May 29, 2014 Title: Nova VMWare driver leaks rescued images Reporter: Jaroslav Henner (Red Hat) Products: Nova Versions: from 2013.2 to 2013.2.3, and 2014.1 Description: Jaroslav Henner from Red Hat reported a vulnerability in Nova. By requesting Nova place an image into rescue, then deleting the image, an authenticated user my exceed their quota. This can result in a denial of service via excessive resource consumption. Only setups using the Nova VMWare driver are affected. Juno (development branch) fix: https://review.openstack.org/75788 https://review.openstack.org/80284 Icehouse fix: https://review.openstack.org/88514 https://review.openstack.org/89217 Havana fix: https://review.openstack.org/89762 https://review.openstack.org/89768 Notes: This fix will be included in the juno-1 development milestone and in future 2013.2.4 and 2014.1.1 releases. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2573 https://launchpad.net/bugs/1269418 -- Jeremy Stanley OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (May 2 – 23)
by Stefano Maffulli 24 May '14

24 May '14

1 0

[OSSA 2014-016] Heat template URL information leakage (CVE-2014-3801)
by Tristan Cacqueray 24 May '14

24 May '14

OpenStack Security Advisory: 2014-016 CVE: CVE-2014-3801 Date: May 23, 2014 Title: Heat template URL information leakage Reporter: Jason Dunsmore (Rackspace) Products: Heat Versions: 2013.2 to 2013.2.3, and 2014.1 Description: Jason Dunsmore from Rackspace reported a vulnerability in Heat. An authenticated user may temporarily see the URL of a provider template used in another tenant by listing heat resources types. This may result in disclosure of additional information if the template itself can be accessed. The URL disappears from the listing after a certain point in the stack creation. All Heat setups are affected. Juno (development branch) fix: https://review.openstack.org/89695 Icehouse fix: https://review.openstack.org/94625 Havana fix: https://review.openstack.org/94644 Notes: This fix will be included in the juno-1 development milestone and in future 2013.2.4 and 2014.1.1 releases. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3801 https://launchpad.net/bugs/1311223 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

New release of python-swiftclient (now with py3 support)
by John Dickinson 24 May '14

24 May '14

I'm happy to announce that python-swiftclient 2.1.0 has just been released! https://pypi.python.org/pypi/python-swiftclient/ This release includes support for Python 3.3. I want to specifically thank Tristan Cacqueray, Chmouel Boudjnah, Alex Gaynor, and Christian Schwede for working on the py3 compatibility. --John

1 0

[OSSA 2014-015] Keystone user and group id mismatch (CVE-2014-0204)
by Tristan Cacqueray 22 May '14

22 May '14

OpenStack Security Advisory: 2014-015 CVE: CVE-2014-0204 Date: May 21, 2014 Title: Keystone user and group id mismatch Reporter: Michael Stancampiano (IBM) Products: Keystone Versions: 2014.1 Description: Michael Stancampiano from IBM reported a vulnerability in Keystone. Someone with write access to the user and group repository (such as the LDAP directory server) may willingly or unwillingly grant additional rights by picking the same IDs for users and groups, resulting in roles assigned to a group being assigned to the affected user even if he is not a member of this group. Only Keystone setups using LDAP for the Identity driver are affected. Juno (development branch) fixes: https://review.openstack.org/94396 https://review.openstack.org/94470 Icehouse fix: https://review.openstack.org/94397 Notes: This fix will be included in the juno-1 development milestone and in a future 2014.1.1 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0204 https://launchpad.net/bugs/1309228 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0