- OpenStack-announce - lists.openstack.org

[OSSA 2014-033] Cinder-volume host data leak to vm instance (CVE-2014-3641)
by Tristan Cacqueray 02 Oct '14

02 Oct '14

OpenStack Security Advisory: 2014-033 CVE: CVE-2014-3641 Date: October 02, 2014 Title: Cinder-volume host data leak to vm instance Reporter: Duncan Thomas (HP) Products: Cinder Versions: up to 2014.1.2 Description: Duncan Thomas from Hewlett Packard reported a vulnerability in Cinder GlusterFS and Linux Smbfs drivers. By overwriting a volume from within an instance with a malicious qcow2 header, an authenticated user may be able to clone and attach that corrupted volume resulting in affected drivers leaking an arbitrary file from the Cinder-volume host to the virtual instance. Note that the host file must be readable by the Cinder context to be exposed. Only Cinder setups using GlusterFS volume driver configured with glusterfs_qcow2_volumes=False (which is the default) or Cinder setups using Smbfs volume driver configured with smbfs_default_volume_format=raw (which is not the default) are affected. Juno (development branch) fix: https://review.openstack.org/125671 Icehouse fix: https://review.openstack.org/125710 Notes: This fix will be included in the Juno release 2014.2 and in the upcoming 2014.1.3 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3641 https://launchpad.net/bugs/1350504 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OSSA 2014-032] Nova VMware driver still leaks rescued images (CVE-2014-3608)
by Tristan Cacqueray 02 Oct '14

02 Oct '14

OpenStack Security Advisory: 2014-032 CVE: CVE-2014-3608 Date: October 2, 2014 Title: Nova VMware driver still leaks rescued images Reporter: Garth Mollett (Red Hat) Products: Nova Versions: up to 2014.1.2 Description: Garth Mollett from Red Hat reported an incomplete fix to OSSA-2014-017 (CVE-2014-2573), a vulnerability affecting Nova. If an authenticated user places an instance into rescue, and then issues a suspend command it will cause the instance to enter an ERROR state. Nova does not clean up an instance in this state correctly upon deletion. An attacker can use this to launch a denial of service attack. Only setups using the Nova VMware driver are affected by this flaw. Juno (development branch) fix: https://review.openstack.org/94281/ Icehouse fix: https://review.openstack.org/109624/ Notes: This fix will be included in the Juno release 2014.2.0 and in the upcoming 2014.1.3 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3608 https://launchpad.net/bugs/1338830 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Havana End of Upstream Support Lifetime
by Jeremy Stanley 29 Sep '14

29 Sep '14

This is intended to serve as a reminder that The OpenStack Havana 2013.2.4 integrated point release[1] last Tuesday, September 23, marks the end of stable support for OpenStack Havana. All open changes for stable/havana branches of official projects have been marked abandoned, upstream testing for these has ceased, and the tips of these branches have been tagged "havana-eol" in preparation for branch deletion. The list of affected Git repositories is as follows: openstack-dev/devstack openstack-dev/grenade openstack/ceilometer openstack/cinder openstack/designate openstack/glance openstack/heat openstack/horizon openstack/keystone openstack/neutron openstack/nova openstack/openstack-manuals openstack/oslo-incubator openstack/oslo.config openstack/requirements openstack/swift openstack/tempest openstack/trove [1] http://lists.openstack.org/pipermail/openstack-announce/2014-September/0002… -- Jeremy Stanley

1 0

[OSSA 2014-031] Admin-only network attributes may be reset to defaults by non-privileged users (CVE-2014-6414)
by Grant Murphy 29 Sep '14

29 Sep '14

OpenStack Security Advisory: OSSA-2014-031 CVE: CVE-2014-6414 Date: September 29, 2014 Title: Admin-only network attributes may be reset to defaults by non-privileged users Reporter: Elena Ezhova (Mirantis) Products: Neutron Versions: up to 2013.2.4 and 2014.1 versions up to 2014.1.2 Description: Elena Ezhova from Mirantis reported a vulnerability in Neutron. By updating a network attribute with a default value a non-privileged user may reset admin-only network attributes. This may lead to unexpected behavior with security implications for operators with a custom policy.json, or in some extreme cases network outages resulting in denial of service. All deployments using neutron networking are affected by this flaw. Juno (development branch) fix: https://review.openstack.org/114531 Icehouse fix: https://review.openstack.org/123849 Notes: This fix will be included in the Juno release 2014.2.0 and in future 2014.1.3 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6414 https://launchpad.net/bugs/1357379 -- Grant Murphy OpenStack Vulnerability Management Team

1 0

[OpenStack] [python-cinderclient] Release of python-cinderclient 1.1.1
by John Griffith 26 Sep '14

26 Sep '14

Hi Everyone, We had to push another release of python-cinderclient due to a bug that was discovered earlier this week [1]. New version is up on pypi. Thanks, John [1]: https://bugs.launchpad.net/python-cinderclient/+bug/1370152

1 0

OpenStack Community Weekly Newsletter (Sep 19 – 26)
by Stefano Maffulli 26 Sep '14

26 Sep '14

How is your OpenStack team organized? <http://maffulli.net/2014/09/25/how-is-your-openstack-team-organized/> I’ve been collecting a lot of good insights talking to directors and managers about how their companies are organized to contribute to OpenStack. For geographic reasons I have mostly gathered comments from people between San Francisco and Silicon Valley and I’d like to expand the research. Fill in this brief survey <https://docs.google.com/forms/d/15vX9pGlvBVftq4YlD6vE0rOMKq9e3U25Qh_9gJ6Ky_…> or contact Stefano Maffulli directly via email (replying to this message). Journey of IPv6 in OpenStack <http://techs.enovance.com/7199/journey-of-ipv6-in-openstack> With the exhaustion of IPv4 addresses, IPv6 is no longer a choice but is now a necessity, even more so in case of a cloud environment. Sridhar Gaddamat <http://techs.enovance.com/7199/journey-of-ipv6-in-openstack> shares his notes on how IPv6 support has evolved in OpenStack with references at appropriate places to where you will be able to find more information. Deploying Humanitarian Applications On OpenStack At Grace Hopper Open Source Day <http://www.rackspace.com/blog/deploying-humanitarian-applications-on-openst…> This year, Iccha Sethi, Egle Sigler and Dana Bauer, along with other Rackers and OpenStackers, will lead a workshop for developers on how to deploy humanitarian applications on OpenStack during the Grace Hopper Celebration of Women in Computing <http://gracehopper.org/>. Reports from Previous Events * Recording & Slides: Turning OpenStack Swift into a VM storage platform <http://rafstack.tumblr.com/post/98377222558> * Deploying OpenStack and Trove (DBaaS) at eBay <http://tesora.com/blog/deploying-openstack-and-trove-dbaas-ebay> * BootstrappingHour: Mock Best Practices <https://wiki.openstack.org/wiki/BootstrappingHour/Mock_Best_Practices> The Road To Paris 2014 – Deadlines and Resources During the Paris Summit there will be a working session for the Women of OpenStack to frame up more defined goals and line out a blueprint for the group moving forward. We encourage all women in the community to complete this very short survey <https://www.surveymonkey.com/s/V39BL7H> to provide input for the group. * Request an invitation letter for VISA <https://www.openstack.org/summit/openstack-paris-summit-2014/visa-informati…> * Reserve hotel rooms <https://www.openstack.org/summit/openstack-paris-summit-2014/hotels/> * Call for Proposals: Open Source Ecosystem Design Sessions at the Paris Summit <http://www.openstack.org/blog/2014/08/call-for-proposals-open-source-ecosys…> * Upstream Training in Paris: details and signup form <http://www.openstack.org/blog/2014/08/openstack-upstream-training-in-paris/> (use the waiting list, we go through it) * Student & Government/Nonprofit Employee Application for Discounted Registration <https://docs.google.com/forms/d/1tUhFJomL1aKjf1hg2P-y9T2lyPrhF2rXFGQTPedLfq…> * The official Schedule for the Paris Summit is available <https://openstacksummitnovember2014paris.sched.org/> Relevant Conversations * OpenStack as Layers but also a Big Tents but also a bunch of Cats <http://inaugust.com/post/108> and its follow ups via email <http://lists.openstack.org/pipermail/openstack-dev/2014-September/046437.ht…>and what-poles-for-the-tent <http://rbtcollins.wordpress.com/2014/09/24/what-poles-for-the-tent/> * An Open Letter to the OpenStack Foundation <https://draft.blogger.com/blogger.g?http://technodrone.blogspot.com/2014/09…> * PTLs and Project Success in OpenStack <http://blog.russellbryant.net/2014/09/26/ptls-and-project-success-in-openst…> * Some ideas for micro-version implementation <http://lists.openstack.org/pipermail/openstack-dev/2014-September/046482.ht…> * API standards working group (was: Some ideas for micro-version implementation) <http://lists.openstack.org/pipermail/openstack-dev/2014-September/046900.ht…> Tips ‘n Tricks * By Christian Huebner <https://www.mirantis.com/blog/openstack-swift-hash_path_suffix-can-go-wrong/>: OpenStack Swift and the hash_path_suffix – what can go wrong? <https://www.mirantis.com/blog/openstack-swift-hash_path_suffix-can-go-wrong/> * By Angus Salkeld <http://ahsalkeld.wordpress.com/>: Deap dive into using Heat Alarms <http://ahsalkeld.wordpress.com/2014/09/25/deap-dive-into-using-heat-alarms/> * By Flavio Percoco <http://blog.flaper87.com/>: Zaqar’s path going forward <http://blog.flaper87.com/post/54214181d987d2dbd7548dfc/> and Zaqar’s pools explained <http://blog.flaper87.com/post/5422728fd987d2bee0fc0c86/> * By Joe H. Rahme <http://dev.cloudwatt.com/en/blog/swiftpolicy-or-how-i-learned-to-stop-worry…>: Swiftpolicy, or how I learned to stop worrying and love the permissions <http://dev.cloudwatt.com/en/blog/swiftpolicy-or-how-i-learned-to-stop-worry…> * By Adalberto Medeiros <http://thoughtsoncloud.com/2014/09/creating-continuous-integration-environm…>: Creating your own continuous integration environment for OpenStack <http://thoughtsoncloud.com/2014/09/creating-continuous-integration-environm…> * By Alexis Lee: Heat dependency visualisation <http://lists.openstack.org/pipermail/openstack-dev/2014-September/046009.ht…> * By https://wiki.openstack.org/wiki/BootstrappingHour/Mock_Best_Practices Security Advisories and Notices * TLS cert verification option not honoured in paste configs (CVE-2014-7144) <http://lists.openstack.org/pipermail/openstack-announce/2014-September/0002…> * [OSSN 0029] Neutron FWaaS rules lack port restrictions when using protocol ‘any’ <http://lists.openstack.org/pipermail/openstack-dev/2014-September/047014.ht…> * [OSSN 0027] Neutron ARP cache poisoning vulnerability <http://lists.openstack.org/pipermail/openstack-dev/2014-September/046142.ht…> * [OSSN 0024] Sensitive data is exposed in log statements by python-keystoneclient <http://lists.openstack.org/pipermail/openstack-dev/2014-September/047215.ht…> Upcoming Events * DEVIEW <http://deview.kr/2014/callForSpeakers.nhn> Sep 29 – 30, 2014 – Seoul, South Korea Details <http://deview.kr/2014/callForSpeakers.nhn> * Cloud Connect Summit at Interop <http://www.interop.com/newyork/>Sep 29 – Oct 03, 2014 – New York, NY Details <http://www.interop.com/newyork/> * Primer meetup de OpenStack Spain <http://www.meetup.com/OpenStack-Spain/events/208206122/> Oct 01, 2014 – Madrid, ES Details <http://www.meetup.com/OpenStack-Spain/events/208206122/> * Gartner Symposium/ITexpo <http://www.gartner.com/technology/symposium/orlando/> Oct 05 – 09, 2014 – Orlando, FL Details <http://www.gartner.com/technology/symposium/orlando/> * Telco Cloud World Forum <http://northamerica.cloudworldseries.com/> Oct 07 – 09, 2014 – Dallas, TX Details <http://northamerica.cloudworldseries.com/> * CloudOpen / LinuxCon Europe <http://events.linuxfoundation.org/events/cloudopen-europe> Oct 13 – 15, 2014 – Düsseldorf, Germany Details <http://events.linuxfoundation.org/events/cloudopen-europe> * Futurecom <http://en.futurecom.com.br/index.php> Oct 13 – 16, 2014 – Sao Paolo, Brazil Details <http://en.futurecom.com.br/index.php> * ITPro Expo <http://expo.nikkeibp.co.jp/itpexpo/2014/english/> Oct 15 – 17, 2014 – Tokyo, Japan Details <http://expo.nikkeibp.co.jp/itpexpo/2014/english/> * Rakuten Technology Conference <http://tech.rakuten.co.jp/> Oct 25, 2014 – Tokyo, Japan Details <http://tech.rakuten.co.jp/> * Japan OpenStack User Group Meetup <http://openstack.jp/events/20141027.html> Oct 27, 2014 – Chiyoda-ku, Tokyo, JP Details <http://openstack.jp/events/20141027.html> * Open World Forum <http://www.openworldforum.org/en/> Oct 30 – Nov 01, 2014 – Paris, France Details <http://www.openworldforum.org/en/> * OpenStack Summit November 2014 <http://openstack.org/summit> Nov 03 – 07, 2014 – Paris, France Details <http://openstack.org/summit> * USENIX LISA <https://www.usenix.org/conference/lisa14> Nov 09 – 14, 2014 – Seattle, WA Details <https://www.usenix.org/conference/lisa14> * Japan OpenStack User Group Meetup <http://openstack.jp/events/20141201.html> Dec 01, 2014 – Chiyoda-ku, Tokyo, JP Details <http://openstack.jp/events/20141201.html> * Gartner Data Center Conference <http://www.gartner.com/technology/summits/na/data-center/> Dec 02 – 05, 2014 – Las Vegas, NV Details <http://www.gartner.com/technology/summits/na/data-center/> Other News * New Project -> Kolla: Deploy and Manage OpenStack using Kubernetes and Docker <http://lists.openstack.org/pipermail/openstack-dev/2014-September/046911.ht…> * OpenStack Speaking and Support Opportunities SAP TechEd && d-code Events <http://lists.openstack.org/pipermail/community/2014-September/000881.html> * Informal summary OpenStack Board Meeting <http://lists.openstack.org/pipermail/foundation/2014-September/001746.html> * more notes about Board Meeting – 2014-09-18 <http://blog.russellbryant.net/2014/09/26/openstack-board-meeting-2014-09-18/> * What’s new in OpenStack Juno <http://opensource.com/business/14/9/whats-new-openstack-juno> * python-heatclient 0.2.12 released <http://lists.openstack.org/pipermail/openstack-announce/2014-September/0002…> * Release of keystonemiddleware 1.2.0 <http://lists.openstack.org/pipermail/openstack-announce/2014-September/0002…> * Release of python-keystoneclient 0.11.1 <http://lists.openstack.org/pipermail/openstack-announce/2014-September/0002…> * [sahara] client releases 0.7.2 & 0.7.3 <http://lists.openstack.org/pipermail/openstack-dev/2014-September/046275.ht…> * OpenStack 2013.2.4 released <http://lists.openstack.org/pipermail/openstack-announce/2014-September/0002…> * OpenStack Project Meeting: Summary <http://eavesdrop.openstack.org/meetings/project/2014/project.2014-09-23-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2014/project.2014-09-23-21.…>. Got Answers? Ask OpenStack <https://ask.openstack.org/> is the go-to destination for OpenStack users. Interesting questions waiting for answers: * How to pass environment file|json via HEAT rest API <https://ask.openstack.org/en/question/48523/how-to-pass-environment-filejso…> * Should not “Recover from a UID/GID mismatch” adjust the kvm group and not the libvirtd group? <https://ask.openstack.org/en/question/48508/should-not-recover-from-a-uidgi…> * OpenStack Juno using RDO fails installation: AMQP server closed the connection <https://ask.openstack.org/en/question/48329/openstack-juno-using-rdo-fails-…> * Is it correct supporting only a subset of core OpenStack APIs in an OpenStack implementation? <https://ask.openstack.org/en/question/48140/is-it-correct-supporting-only-a…> * How to setup neutron flat network <https://ask.openstack.org/en/question/48198/how-to-setup-neutron-flat-netwo…> * Is there a utility to clean up orphaned resources? <https://ask.openstack.org/en/question/48258/is-there-a-utility-to-clean-up-…> * TripleO: Error in baremetal installation (permission denied) <https://ask.openstack.org/en/question/48293/tripleo-error-in-baremetal-inst…> Welcome New Reviewers, Developers and Core Reviewers Vinny Valdez <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Ionut-Madalin Balutoiu <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Steven Ren <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Victor Silva <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Kamil Rykowski <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Dustin Schoenbrun <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Victor Silva <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Noel Burton-Krahn <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Tetiana Lashchova <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> JC Smith <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Lena Novokshonova <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Tony Breeds <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> jazeltq <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Rushil Chugh <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Rafael Rivero <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Shivanand Tendulker <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Ian Govett <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Kamil Rykowski <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Johan Viklund <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Denise Hale <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

python-heatclient 0.2.12 released
by Steve Baker 25 Sep '14

25 Sep '14

The heat development community would like to announce the release of python-heatclient version 0.2.12. python-heatclient is a client library for Heat built on the Heat orchestration API. It provides a Python API (the heatclient module) and a command-line tool (heat). This release can be installed from the following locations: http://tarballs.openstack.org/python-heatclient https://pypi.python.org/pypi/python-heatclient Changes in this release: https://launchpad.net/python-heatclient/+milestone/v0.2.12

1 0

[OSSA 2014-030] TLS cert verification option not honoured in paste configs (CVE-2014-7144)
by Grant Murphy 25 Sep '14

25 Sep '14

OpenStack Security Advisory: 2014-030 CVE: CVE-2014-7144 Date: September 25, 2014 Title: TLS cert verification option not honoured in paste configs Reporter: Qin Zhao (IBM) Products: keystonemiddleware, python-keystoneclient Versions: versions up to 1.1.1 (keystonemiddleware), versions up to 0.10.1 (python-keystoneclient) Description: Qin Zhao from IBM reported a vulnerability in keystonemiddleware (formerly shipped as python-keystoneclient). When the 'insecure' option is set in a paste configuration file it is effectively ignored, regardless of its value. As a result certificate verification will be disabled, leaving TLS connections open to MITM attacks. All versions of keystonemiddleware with TLS settings configured via a paste.ini file are affected by this flaw. keystonemiddleware fix: https://review.openstack.org/113191 python-keystoneclient fix: https://review.openstack.org/112232 Notes: These fixes are included in the keystonemiddleware 1.2.0 release and in the python-keystoneclient 0.11.0 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7144 https://launchpad.net/bugs/1353315 -- Grant Murphy OpenStack Vulnerability Management Team

1 0

[OpenStack][keystonemiddleware] Release of keystonemiddleware 1.2.0
by Morgan Fainberg 25 Sep '14

25 Sep '14

The Keystone development community would like to announce the release of keystonemiddleware 1.2.0. This release can be installed from the following locations: * http://tarballs.openstack.org/keystonemiddleware * https://pypi.python.org/pypi/keystonemiddleware 1.2.0 features -------------- * Added support for service tokens in conjunction with the user auth-tokens Detailed changes in this release: https://launchpad.net/keystonemiddleware/+milestone/1.2.0

1 0

[OpenStack][python-keystoneclient] Release of python-keystoneclient 0.11.1
by Morgan Fainberg 23 Sep '14

23 Sep '14

The Keystone development community would like to announce the release of python-keystoneclient 0.11.1. The 0.11.1 version includes two fixes on top of the 0.11.0 release. This release can be installed from the following locations: * http://tarballs.openstack.org/python-keystoneclient * https://pypi.python.org/pypi/python-keystoneclient 0.11.x ------ * Added an authentication plugin to support ECP SAML2 workflow * Added support for Active Directory Federated Services (ADFS) SAML2 authentication workflow Detailed changes in this release: https://launchpad.net/python-keystoneclient/+milestone/0.11.0 https://launchpad.net/python-keystoneclient/+milestone/0.11.1

1 0