- OpenStack-announce - lists.openstack.org

[OSSA 2015-009] Persistent XSS in Horizon metadata dashboard (CVE-2015-3988)
by Tristan Cacqueray 25 May '15

25 May '15

=========================================================== OSSA-2015-009: Persistent XSS in Horizon metadata dashboard =========================================================== :Date: May 25, 2015 :CVE: CVE-2015-3988 Affects ~~~~~~~ - Horizon: 2014.2 versions through 2014.2.3 and version 2015.1.0 Description ~~~~~~~~~~~ Sunil Yadav from IBM Security Services reported a persistent XSS in Horizon. An authenticated user may conduct a persistent XSS attack by setting a malicious metadata to a Glance image, a Nova flavor or a Host Aggregate and tricking an administrator to load the update metadata page. Once executed in a legitimate context this attack may result in a privilege escalation. All Horizon setups are affected. Patches ~~~~~~~ - https://review.openstack.org/183659 (Juno) - https://review.openstack.org/183656 (Kilo) - https://review.openstack.org/179429 (Liberty) Credits ~~~~~~~ - Sunil Yadav from IBM (CVE-2015-3988) References ~~~~~~~~~~ - https://launchpad.net/bugs/1449260 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3988 Notes ~~~~~ - This fix will be included in future 2014.2.4 (juno) and 2015.1.1 (kilo) releases. -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (May 1 - 8)
by Stefano Maffulli 08 May '15

08 May '15

1 0

[OSSA 2015-008] Potential Keystone cache backend password leak in log (CVE-2015-3646)
by Tristan Cacqueray 05 May '15

05 May '15

==================================================================== OSSA-2015-008: Potential Keystone cache backend password leak in log ==================================================================== :Date: May 04, 2015 :CVE: CVE-2015-3646 Affects ~~~~~~~ - Keystone: versions through 2014.1.4, and 2014.2 versions through 2014.2.3 Description ~~~~~~~~~~~ Eric Brown from VMware reported a vulnerability in Keystone. The backend_argument configuration option content is being logged, and it may contain sensitive information for specific backends (like a password for MongoDB). An attacker with read access to Keystone logs may therefore obtain sensitive data about certain backends. All Keystone setups are potentially impacted. Patches ~~~~~~~ - https://review.openstack.org/175519 (Icehouse) - https://review.openstack.org/173116 (Juno) Credits ~~~~~~~ - Eric Brown from VMware (CVE-2015-3646) References ~~~~~~~~~~ - https://launchpad.net/bugs/1443598 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3646 Notes ~~~~~ - This fix will be included in future 2014.1.5 (icehouse) and 2014.2.4 (juno) releases. - The 2015.1.0 (kilo) release is not affected.

1 0

OpenStack Community Weekly Newsletter (Apr 24 - May 1)
by Stefano Maffulli 01 May '15

01 May '15

Kilo Logo Superuser Awards final faceoff: your vote counts Four great finalists, but only one can win: it’s a close call as the voting deadline approaches for this edition of the Superuser Awards. Snapshot of the OpenStack community behind Kilo The OpenStack community that helped create the Kilo release has done some seriously heavy lifting. For the 11th release, there were more contributors, more companies involved and more work across time zones than ever before. The Road to Vancouver * Canada Visa Information * Official Hotel Room Blocks * Preparation to Design summit * What's a Design Summit? * (Unofficial) Social activities: Geocaching in Vancover Relevant Conversations * Results of the TC Election * Go! Swift! * API working group liaisons and responsibilities Deadlines and Development Priorities * Relax for a day :) Reports from Previous Events * OpenStack superusers deliver the goods at CONNECT Security Advisories and Notices * [OSSN 0048] Glance method filtering does not work under certain conditions Tips ‘n Tricks * By Adam Young: Creating Hierarchical Projects in Keystone * By Spencer Smith: Image Creation - Packer and OpenStack * By Ronald Bradford: Running openstack tests with tox and Understanding the different Openstack tox configs * By Nir Yechiel: SR-IOV Networking – Part II: Walking Through the Implementation * By Craige McWhirter: Rebuilding An OpenStack Instance and Keeping the Same Fixed IP * By Daisy.Guo: reStructuredText markups in manuals and the translation tips * By Kyle Mestery: Subnetpools in Neutron * By Robert Collins: Dealing with deps in OpenStack * By Joe Topjian: introducing and using Terraform * By Swapnil Kulkarni: OpenStack oslo packages not available in devstack? * By Steve Martinelli: Debugging keystone tests and live deployments Upcoming Events OpenStack Israel CFP Voting is Open PyCon-AU Openstack miniconf CFP closes May 8th * May 04, 2015 [ONLINE MEETUP] OpenStack & Beyond Podcast: Talking NFV + SDN in the Cloud with * May 05, 2015 London OpenStack May Meetup London, GB * May 05, 2015 May Sydney Meetup - Midokura presents "I Can Haz Moar Networks?" * May 05 - 07, 2015 CeBIT AU 2015 Sydney, NSW, AU * May 06 - 07, 2015 OpenStack Meetup May - Ceilometer Telemetry Presentation Richardson, TX, US * May 07, 2015 Online Meetup: How StackStorm builds and Operates StackStorm Software Itself Mountain View, CA, US * May 07, 2015 OpenStack Seattle Meetup: The Ins and Outs of Deploying OpenStack Seattle, WA, US * May 07, 2015 Open...House. Community. Stack. Sunnyvale, CA, US * May 08, 2015 Open... House. Community. Stack. Sunnyvale, CA, US * May 09, 2015 OpenStack Meetup Hanoi Hanoi, Hanoi, VN * May 12, 2015 OpenStack Munich Meetup Munich, DE * May 18 - 22, 2015 OpenStack Summit May 2015 Vancouver, BC * Jun 02, 2015 OpenStack Day LATAM Mexico City, MX * Jun 04, 2015 OpenStack Days Istanbul – 2015 Istanbul, TR * Jun 06, 2015 OpenStack Meetup, Bangalore Bangalore, Karnataka, IN * Jun 08, 2015 OpenStack CEE Day 2015 Budapest, HU * Jun 11, 2015 OpenStack DACH Day 2015 Berlin, DE * Jun 11, 2015 OpenStack DACH Day 2015 Berlin, DE * Jun 15, 2015 OpenStack Israel 2015 Tev Aviv, IL * Jul 20 - 24, 2015 OSCON 2015 Portland, OR, US * Jul 30 - 31, 2015 DCD INTERNET San Francisco, CA, US Other News * Neutron, ZeroMQ and Git – Ubuntu OpenStack 15.04 Charm release! * OpenStack SWIFT Object Storage Tape Library Connector, first release * Support for Python 2.6 in Swift * Introducing the Xen Project – OpenStack CI Loop * What AWS Revenues Mean for Public Cloud and OpenStack More Generally The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment.

1 0

OpenStack 2015.1.0 ("Kilo") is released !
by Thierry Carrez 30 Apr '15

30 Apr '15

Hello everyone, I'm delighted to announce the final release of OpenStack 2015.1.0, code-named "Kilo". This concludes the 6-month Kilo development cycle, which saw the completion of more than 400 features and the fixing of more than 3300 bugs (only considering the 12 projects that make up this release !). In the name of all the contributors to this release, the OpenStack Technical Committee would like to dedicate it to the loving memory of Chris Yeoh, who passed away from cancer earlier this month. Chris was a long time and prolific open source developer, most recently with IBM. He contributed significantly to the OpenStack project, most notably in the Nova project team. His community spirit, technical contributions and friendship will be missed. You can find source tarballs, together with complete lists of features and bugfixes for each project, at the following links: Compute (Nova): https://launchpad.net/nova/kilo/2015.1.0 Object Storage (Swift): https://launchpad.net/swift/kilo/2.3.0 Image Service (Glance): https://launchpad.net/glance/kilo/2015.1.0 Networking (Neutron): https://launchpad.net/neutron/kilo/2015.1.0 Block Storage (Cinder): https://launchpad.net/cinder/kilo/2015.1.0 Identity (Keystone): https://launchpad.net/keystone/kilo/2015.1.0 Dashboard (Horizon): https://launchpad.net/horizon/kilo/2015.1.0 Telemetry (Ceilometer): https://launchpad.net/ceilometer/kilo/2015.1.0 Orchestration (Heat): https://launchpad.net/heat/kilo/2015.1.0 Database Service (Trove): https://launchpad.net/trove/kilo/2015.1.0 Data Processing (Sahara): https://launchpad.net/sahara/kilo/2015.1.0 Bare metal (Ironic): https://launchpad.net/ironic/kilo/2015.1.0 The Kilo Release Notes wikipage contains an overview of the key features, as well as upgrade notes and current lists of known issues. You can access them at: https://wiki.openstack.org/wiki/ReleaseNotes/Kilo Thanks again to all the individuals who contributed to this development cycle and helped in making this release a success ! -- Thierry Carrez (ttx)

1 0

OpenStack Community Weekly Newsletter (Apr 17 - 24)
by Stefano Maffulli 24 Apr '15

24 Apr '15

Why you should attend an OpenStack Summit OpenStack Summits don’t miss a beat - with a schedule full of diverse breakout sessions, captivating speakers, off-the-wall evening events and the occasional surprise, it’s the twice-yearly event you simply cannot miss. What would you add to the list of 10 most memorable summit moments to date? Gnocchi 1.0: storing metrics and resources at scale Gnocchi provides a scalable way to store and retrieve data and metrics from instances, volumes, networks and all the things that make an OpenStack cloud. Gnocchi also provides a REST API that allows the user to manipulate resources (CRUD) and their attributes, while preserving the history of those resources and their attributes. The Gnocchi team takes great pride in the quality of their documentation too, fully available online. The Road to Vancouver * Canada Visa Information * Official Hotel Room Blocks * 2015 OpenStack T-Shirt Design Contest * Preparation to Design summit * What's a Design Summit? We can squeeze few more people in Upstream Training Relevant Conversations * Please stop reviewing code while asking questions * A big tent home for Neutron backend code * upcoming library releases to unfreeze requirements in master * [Zaqar] Call for adoption (or exclusion?) * Sharing resources across OpenStack instances * 3 API Guidelines up for final review * Third-Party CI Operators: Let's use a common CI Solution! Deadlines and Development Priorities * Candidates for TC (Technical Committee): election is ongoing. Reports from Previous Events * China hosts OpenStack bug-fix hackathon * PyCon 2015 Security Advisories and Notices * [OSSN 0047] Keystone does not validate that identity providers match federation mappings Tips ‘n Tricks * By Steve Hardy: Debugging TripleO Heat templates * By Luc Van Steen: Moving from CityCloud legacy to OpenStack – Part 1 and Part 2 Upcoming Events OpenStack Israel CFP Voting is Open PyCon-AU Openstack miniconf CFP open * May 05 - 07, 2015 CeBIT AU 2015 Sydney, NSW, AU * May 09, 2015 OpenStack Meetup Hanoi Hanoi, Hanoi, VN * May 18 - 22, 2015 OpenStack Summit May 2015 Vancouver, BC * Jun 02, 2015 OpenStack Day LATAM Mexico City, MX * Jun 04, 2015 OpenStack Days Istanbul – 2015 Istanbul, TR * Jun 08, 2015 OpenStack CEE Day 2015 Budapest, HU * Jun 11, 2015 OpenStack DACH Day 2015 Berlin, DE * Jun 15, 2015 OpenStack Israel Tel Aviv, IL * Jul 20 - 24, 2015 OSCON 2015 Portland, OR, US Other News * EC2-API release 0.1.0 available * OpenStack SWIFT Object Storage Tape Library Connector * OVN and OpenStack Status – 2015-04-21 * OpenStack Kilo RC1 for Ubuntu 14.04 LTS and Ubuntu 15.04 * StackTach.v3 now in production The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment.

1 0

OpenStack Community Weekly Newsletter (Apr 10 - 17)
by Stefano Maffulli 17 Apr '15

17 Apr '15

OpenStack DefCore Community Review – TWO Sessions April 21 (agenda) During the DefCore process, we’ve had regular community check points to review and discuss the latest materials from the committee. With the latest work on the official process and flurry of Guidelines, we’ve got a lot of concrete material to show. To accommodate global participants, we’ll have TWO sessions (and record both): 1. April 21 8 am Central (1 pm UTC) https://join.me/874-029-687 2. April 21 8 pm Central (9 am Hong Kong) https://join.me/903-179-768 Help pick the new logos for OpenStack User Groups & OpenStack Days We are introducing a unique logo for OpenStack User Groups, to help recognize official groups and their important role in helping grow the OpenStack Community. The deadline to complete the survey is Wednesday April 22, 2015. Let your voice be heard: vote for the Superuser Award! The Superuser Awards, first launched at the Paris Summit, recognize a team that uses OpenStack to meaningfully improve their business and differentiate in a competitive industry, while also contributing back to the community. This time, the OpenStack community votes to select the winner. * National Supercomputer Center in Guangzhou * Walmart * eBay Inc. * Comcast OpenStack breaks a new record for active contributors With 556 active contributors per month, this first quarter of 2015 is the highest in the history of OpenStack. Compared to the previous quarter, core and regular contributors have also increased 10 percent and 20 percent, respectively. You can read the complete report, including details of the methodology, on the Activity Board repository or take deep into the activity of OpenStack individual projects. PTL Election Conclusion and Results Congratulations to the newly elected PTL John Garbutt for Nova and thank you Michael Still for the hard work. The other PTLs have been confirmed. The list and full announcement on the mailing list. The Road to Vancouver * Canada Visa Information * Official Hotel Room Blocks * 2015 OpenStack T-Shirt Design Contest * Preparation to Design summit * Liberty Design Summit - Proposed room / time layout * What's a Design Summit? We can squeeze few more people in Upstream Training Relevant Conversations * Proposed Liberty release schedule Deadlines and Development Priorities * Candidate proposals for TC (Technical Committee) positions are now open * proposed/kilo is dead, long live stable/kilo Security Advisories and Notices * Unauthorized delete of versioned Swift object (CVE-2015-1856) * S3Token TLS cert verification option not honored (CVE-2015-1852) Tips ‘n Tricks * By Sergey Melikyan: OpenStack Murano application catalog: Heat-based applications in the cloud * By Steve Dake: Preserving contaner properties via volume mounts * By Assaf Muller: Distributed Virtual Routing – Overview and East/West Routing and Distributed Virtual Routing – SNAT and Distributed Virtual Routing – Floating IPs * By Michael J. Clarkson, Jr.: OpenStack Juno multi compute node Lab – Ready to use environment on AWS and Google Cloud * By Adam Young: Creating a new Network for a dual NIC VM and Using the openstack command line interface to create a new server. Upcoming Events * Apr 17, 2015 Inaugural OpenStack PDX Meetup * Apr 17, 2015 SFBay OpenStack Advanced Track #OSSFO Topic: Keystone * Apr 18, 2015 April Sydney Hackathon * Apr 18, 2015 OpenStack India Meetup, Bangalore Bangalore, Karnataka, IN * Apr 20, 2015 Assemblée générale OpenStackFR 2015 Paris, FR * Apr 20, 2015 Meetup#14 Placement intelligent et SLA avancé avec Nova Scheduler Paris, FR * Apr 20, 2015 Melbourne Meetup featuring Randy Bias * Apr 20 - 21, 2015 OpenStack Conference, part of the CONNECT Show Melbourne, AU * Apr 20, 2015 Ubuntu OpenStack Roadshow London, GB * Apr 20, 2015 OpenStackFR annual general meeting Paris, US * Apr 20, 2015 Advanced placement with Nova Paris, FR * Apr 21 - 22, 2015 CONNECT 2015 Melbourne, Victoria, AU * Apr 21 - 24, 2015 The Great Indian HP Code Off @ GIDS Bangalore, Karnataka, IN * Apr 21, 2015 Ubuntu OpenStack Roadshow Paris, FR * Apr 22, 2015 Canonical Ubuntu OpenStack Roadshow Amsterdam, NL * Apr 22, 2015 Data storage in clouds Athens, GR * Apr 22, 2015 OpenStack’te farkli mimari ornekleri, farklari, artilari, eksileri * Apr 22 - 23, 2015 China SDNNFV Conference Beijing, CN * Apr 22, 2015 OpenStack NYC Meetup New York, NY, US * Apr 22, 2015 Ubuntu OpenStack Roadshow Amsterdam, NL * Apr 22, 2015 Data storage in OpenStack clouds Athens, GR * Apr 23, 2015 OpenStack Philadelphia Meetup Philadelphia, PA, US * Apr 23, 2015 OpenStack L.A. Meetup Pasadena, CA, US * Apr 23, 2015 Ubuntu OpenStack Roadshow Frankfurt, DE * Apr 23, 2015 Business Agility with OpenStack New York City, New York, US * May 05 - 07, 2015 CeBIT AU 2015 Sydney, NSW, AU * May 09, 2015 OpenStack Meetup Hanoi Hanoi, Hanoi, VN * May 18 - 22, 2015 OpenStack Summit May 2015 Vancouver, BC * Jun 02, 2015 OpenStack Day LATAM Mexico City, MX * Jun 04, 2015 OpenStack Days Istanbul – 2015 Istanbul, TR * Jun 08, 2015 OpenStack CEE Day 2015 Budapest, HU * Jun 11, 2015 OpenStack DACH Day 2015 Berlin, DE * Jun 15, 2015 OpenStack Israel Tel Aviv, IL * Jul 20 - 24, 2015 OSCON 2015 Portland, OR, US Other News * OpenStack Technical Committee candidates * Real innovation? It means keeping cloud solutions simple * What's Up Doc? April 17, 2015 The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment.

1 1

[OSSA 2015-007] S3Token TLS cert verification option not honored (CVE-2015-1852)
by Tristan Cacqueray 14 Apr '15

14 Apr '15

=============================================================== OSSA-2015-007: S3Token TLS cert verification option not honored =============================================================== :Date: April 14, 2015 :CVE: CVE-2015-1852 Affects ~~~~~~~ - python-keystoneclient: versions through 1.3.0 - keystonemiddleware: versions through 1.5.0 Description ~~~~~~~~~~~ Brant Knudson from IBM reported a vulnerability in keystonemiddleware (formerly shipped as python-keystoneclient). When the 'insecure' option is set in a S3Token paste configuration file its value is effectively ignored and instead assumed to be true. As a result certificate verification will be disabled, leaving TLS connections open to MITM attacks. Note that it's unusual to explicitly add this option and then set it to false, so the impact of this bug is thought to be limited. All versions of s3_token middleware with TLS settings configured are affected by this flaw. Patches ~~~~~~~ - https://review.openstack.org/173378 (python-keystoneclient) (Icehouse) - https://review.openstack.org/173376 (keystonemiddleware) (Juno) - https://review.openstack.org/173377 (python-keystoneclient) (Juno) - https://review.openstack.org/173365 (keystonemiddleware) (Kilo) - https://review.openstack.org/173370 (python-keystoneclient) (Kilo) Credits ~~~~~~~ - Brant Knudson from IBM (CVE-2015-1852) References ~~~~~~~~~~ - https://launchpad.net/bugs/1411063 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1852 Notes ~~~~~ - This fix will be included in keystonemiddleware 1.6.0 release and python-keystoneclient 1.4.0 release. -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OSSA 2015-006] Unauthorized delete of versioned Swift object (CVE-2015-1856)
by Tristan Cacqueray 14 Apr '15

14 Apr '15

============================================================ OSSA-2015-006: Unauthorized delete of versioned Swift object ============================================================ :Date: April 14, 2015 :CVE: CVE-2015-1856 Affects ~~~~~~~ - Swift: versions through 2.2.2 Description ~~~~~~~~~~~ Clay Gerrard from SwiftStack reported a vulnerability in Swift object versioning. An authenticated user can delete the most recent version of any versioned object whose name is known if the user have listing access to the x-versions-location container. Only Swift setups with allow_version setting are affected. Patches ~~~~~~~ - https://review.openstack.org/173366 (Icehouse) - https://review.openstack.org/173363 (Juno) - https://review.openstack.org/173361 (Kilo) Credits ~~~~~~~ - Clay Gerrard from SwiftStack (CVE-2015-1856) References ~~~~~~~~~~ - https://launchpad.net/bugs/1430645 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1856 Notes ~~~~~ - This fix will be included in the upcoming 2.3.0 release. -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack 2014.2.3 released
by Adam Gandelman 13 Apr '15

13 Apr '15

Hello everyone, The OpenStack Stable Maintenance team is happy to announce the release of the 2014.2.3 stable Juno release. We have been busy reviewing and accepting backported bugfixes to the stable/juno branches according to the criteria set at: https://wiki.openstack.org/wiki/StableBranch A total of 109 bugs have been fixed across all projects. These updates to Juno are intended to be low risk with no intentional regressions or API changes. The list of bugs, tarballs and other milestone information for each project may be found on Launchpad: https://launchpad.net/ceilometer/juno/2014.2.3 https://launchpad.net/cinder/juno/2014.2.3 https://launchpad.net/glance/juno/2014.2.3 https://launchpad.net/heat/juno/2014.2.3 https://launchpad.net/horizon/juno/2014.2.3 https://launchpad.net/keystone/juno/2014.2.3 https://launchpad.net/nova/juno/2014.2.3 https://launchpad.net/neutron/juno/2014.2.3 https://launchpad.net/trove/juno/2014.2.3 Release notes may be found on the wiki: https://wiki.openstack.org/wiki/ReleaseNotes/2014.2.3 The freeze on the stable/juno branches will be lifted today as we begin working toward the 2014.2.4 release. Thanks, Adam

1 0