- OpenStack-announce - lists.openstack.org

[OSSA 2014-029] Configuration option leak through Keystone catalog (CVE-2014-3621)
by Tristan Cacqueray 17 Sep '14

17 Sep '14

OpenStack Security Advisory: 2014-029 CVE: CVE-2014-3621 Date: September 16, 2014 Title: Configuration option leak through Keystone catalog Reporter: Brant Knudson (IBM) Products: Keystone Versions: up to 2013.2.3 and 2014.1 versions up to 2014.1.2.1 Description: Brant Knudson from IBM reported a vulnerability in Keystone catalog url replacement. By creating a malicious endpoint a privileged user may reveal configuration options resulting in sensitive information, like master admin_token, being exposed through the service url. All Keystone setups that allow non-admin users to create endpoints are affected. Juno (development branch) fix: https://review.openstack.org/121889 Icehouse fix: https://review.openstack.org/121890 Havana fix: https://review.openstack.org/121891 Notes: This fix will be included in the Juno release 2014.2.0 and in future stable 2013.2.4 and 2014.1.3 releases. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3621 https://launchpad.net/bugs/1354208 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OpenStack] [python-cinderclient] Release of python-cinderclient 1.1.0
by John Griffith 13 Sep '14

13 Sep '14

Hello, I'd like to announce the release of python-cinderclient 1.1.0. A brief summary of the changes are included below. Thanks, John 1.1.0 ------ * Add support for ConsistencyGroups * Use Adapter from keystoneclient * Add support for Replication feature * Add pagination for Volume List .. _1325773 http://bugs.launchpad.net/python-cinderclient/+bug/1325773 .. _1333257 http://bugs.launchpad.net/python-cinderclient/+bug/1333257 .. _1268480 http://bugs.launchpad.net/python-cinderclient/+bug/1268480 .. _1275025 http://bugs.launchpad.net/python-cinderclient/+bug/1275025 .. _1258489 http://bugs.launchpad.net/python-cinderclient/+bug/1258489 .. _1241682 http://bugs.launchpad.net/python-cinderclient/+bug/1241682 .. _1203471 http://bugs.launchpad.net/python-cinderclient/+bug/1203471 .. _1210874 http://bugs.launchpad.net/python-cinderclient/+bug/1210874 .. _1200214 http://bugs.launchpad.net/python-cinderclient/+bug/1200214 .. _1130572 http://bugs.launchpad.net/python-cinderclient/+bug/1130572 .. _1156994 http://bugs.launchpad.net/python-cinderclient/+bug/1156994 ** Note Connection refused --> Connection error commit: c9e7818f3f90ce761ad8ccd09181c705880a4266 ** Note Mask Passwords in log output commit: 80582f2b860b2dadef7ae07bdbd8395bf03848b1

1 0

OpenStack Community Weekly Newsletter (Sep 5 – 12)
by Stefano Maffulli 13 Sep '14

13 Sep '14

1 0

OpenStack Community Weekly Newsletter (Aug 29 – Sep 5)
by Stefano Maffulli 06 Sep '14

06 Sep '14

1 0

[Swift] Swift 2.1.0 released
by John Dickinson 01 Sep '14

01 Sep '14

I'm happy to announce that Swift 2.1.0 has been released. This release includes several useful features that I'd like to highlight. First, Swift's data placement algorithm was slightly changed to improve adding capacity. Specifically, now when you add a new region to an existing Swift cluster, there will not be a massive migration of data. If you've been wanting to expand your Swift cluster into another region, you can now do it painlessly. Second, we've updated some of the logging and metrics tracking. We removed some needless log spam (cleaner logs!), added the process PID to the storage node log lines, and no count user errors as errors in StatsD metrics reporting. We've also improved the object auditing process to allow for multiple processes at once. Using the new "concurrency" config value can speed up the overall auditor cycle time. The tempurl middleware default allowed methods has been updated to allow POST and DELETE. This means that with no additional configuration, users can create tempURLs against any supported verb. Finally, the list_endpoints middleware now has a v2 response that supports storage policies. Please take a look at the full changelog to see what else has changed. I'd encourage everyone to upgrade to this new version of Swift. As always, you can upgrade with no end-user downtime. Changelog: http://git.openstack.org/cgit/openstack/swift/tree/CHANGELOG Tarball: http://tarballs.openstack.org/swift/swift-2.1.0.tar.gz Launchpad: https://launchpad.net/swift/+milestone/2.1.0 This release is the result of 28 contributors, including 7 new contributors. The first-time contributors to Swift are: Jing Liuqing Steve Martinelli Matthew Oliver Pawel Palucki Thiago da Silva Nirmal Thacker Lin Yang Thank you to everyone who contributed to this release, both as a dev and as the sysadmins who keep Swift running every day at massive scale around the world. My vision for Swift is that everyone uses it every day, even if they don't realize it. We're well on our way to that goal. Thank you. --John

1 0

OpenStack Community Weekly Newsletter (Aug 22 – 29)
by Stefano Maffulli 30 Aug '14

30 Aug '14

1 0

heat-cfntools 1.2.8 released
by Steve Baker 29 Aug '14

29 Aug '14

The heat development community would like to announce the release of heat-cfntools version 1.2.8. heat-cfntools contains the tools that can be installed on Heat provisioned cloud instances to implement portions of CloudFormation compatibility. This release can be installed from the following locations: http://tarballs.openstack.org/heat-cfntools <http://tarballs.openstack.org/heat-cfntools> https://pypi.python.org/pypi/heat-cfntools <https://pypi.python.org/pypi/heat-cfntools> Bugs fixed in this release: https://launchpad.net/heat-cfntools/+milestone/v1.2.8

1 0

OpenStack Community Weekly Newsletter (Aug 15 – 22)
by Stefano Maffulli 23 Aug '14

23 Aug '14

1 0

[OSSA 2014-028] Glance store DoS through disk space exhaustion (CVE-2014-5356)
by Tristan Cacqueray 21 Aug '14

21 Aug '14

OpenStack Security Advisory: 2014-028 CVE: CVE-2014-5356 Date: August 21, 2014 Title: Glance store DoS through disk space exhaustion Reporter: Thomas Leaman (HP), Stuart McLaren (HP) Products: Glance Versions: up to 2013.2.3 and 2014.1 versions up to 2014.1.2 Description: Thomas Leaman and Stuart McLaren from Hewlett Packard reported a vulnerability in Glance. By uploading a large enough image to a Glance store, an authenticated user may fill the store space because the image_size_cap configuration option is not honored. This may prevent further image upload and/or cause service disruption. Note that the import method is not affected. All Glance setups using API v2 are affected (unless you use a policy to restrict/disable image upload). Juno (development branch) fix: https://review.openstack.org/91764 Icehouse fix: https://review.openstack.org/115280 Havana fix: https://review.openstack.org/115289 Notes: This fix will be included in the Juno-3 development milestone and in future 2013.2.4 and 2014.1.3 releases. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5356 https://launchpad.net/bugs/1315321 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OSSA 2014-027] Persistent XSS in Horizon Host Aggregates interface (CVE-2014-3594)
by Tristan Cacqueray 20 Aug '14

20 Aug '14

OpenStack Security Advisory: 2014-027 CVE: CVE-2014-3594 Date: August 19, 2014 Title: Persistent XSS in Horizon Host Aggregates interface Reporters: Dennis Felsch and Mario Heiderich (Ruhr-University Bochum) Products: Horizon Versions: up to 2013.2.3, and 2014.1 versions up to 2014.1.2 Description: Dennis Felsch and Mario Heiderich from the Horst Görtz Institute for IT-Security, Ruhr-University Bochum reported a persistent XSS in Horizon. A malicious administrator may conduct a persistent XSS attack by registering a malicious host aggregate in Horizon Host Aggregate interface. Once executed in a legitimate context this attack may reveal another admin token, potentially resulting in a lateral privilege escalation. All Horizon setups are affected. Juno (development branch) fix: https://review.openstack.org/115310 Icehouse fix: https://review.openstack.org/115311 Havana fix: https://review.openstack.org/115313 Notes: This fix will be included in the Juno-3 development milestone and in future 2013.2.4 and 2014.1.3 releases. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3594 https://launchpad.net/bugs/1349491 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0