- OpenStack-announce - lists.openstack.org

[OSSA 2014-025] Denial of Service in Neutron allowed address pair (CVE-2014-3555)
by Tristan Cacqueray 21 Jul '14

21 Jul '14

OpenStack Security Advisory: 2014-025 CVE: CVE-2014-3555 Date: July 17, 2014 Title: Denial of Service in Neutron allowed address pair Reporter: Liping Mao (Cisco) Products: Neutron Versions: up to 2013.2.3, and 2014.1 versions up to 2014.1.1 Description: Liping Mao from Cisco reported a denial of service vulnerability in Neutron's handling of allowed address pair. By creating a large number of allowed address pairs, an authenticated user may overwhelm neutron firewall rules and render compute nodes unusable. All Neutron setups are affected. Juno (development branch) fix: https://review.openstack.org/107734 Icehouse fix: https://review.openstack.org/107733 Havana fix: https://review.openstack.org/107731 Notes: This fix will be included in the Juno-2 development milestone and in future 2013.2.4 and 2014.1.2 releases. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3555 https://launchpad.net/bugs/1336207 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (July 11 – 18)
by Stefano Maffulli 18 Jul '14

18 Jul '14

DefCore Update: Input Request for Havana Capabilities <http://www.openstack.org/blog/2014/07/defcore-update-input-request-for-hava…> As part of our community’s commitment to interoperability, the OpenStack Board of Directors has been working to make sure that “downstream” OpenStack-branded commercial products offer the same baseline functionality and include the same upstream, community-developed code. The work to define these required core capabilities and code has been led by the DefCore Committee co-chaired by Rob Hirschfeld (his DefCore blog <http://robhirschfeld.com/?s=defcore&submit=Search>) and Joshua McKenty (his post <http://www.pistoncloud.com/2014/05/openstack-defcore-review-time/>). You can read more about the committee history and rationale in Mark Collier’s blog post <http://www.openstack.org/blog/2014/01/openstack-commitment-to-interoperabil…>. The next deadlines are: OSCON on July 21, 11:30 am PDT <http://www.oscon.com/oscon2014/public/schedule/detail/37014> and the Board Meeting on July 22nd. And the K cycle will be named… Kilo ! <http://lists.openstack.org/pipermail/openstack/2014-July/008447.html> The results of the poll are just in, and the winner proposal is “Kilo”. “k” is the unit symbol for “kilo”, a SI unit prefix (derived from the Greek word ?????? which means “thousand”). “Kilo” is often used as a shorthand for “kilogram”, and the kilogram is the last SI base unit to be tied to a reference artifact (stored near Paris in the Pavillon de Breteuil in Sèvres). Five Days + Twelve Writers + One Book Sprint = One Excellent Book on OpenStack Architecture <http://www.openstack.org/blog/2014/07/five-days-twelve-writers-one-book-spr…> Adozen OpenStack experts and writers from companies across the OpenStack ecosystem gathered at VMware’s Palo Alto campus for the OpenStack Architecture Design Guide book sprint. The intent was to deliver a completed book aimed architects and evaluators, on designing OpenStack clouds — in just five days. Only developers should file specifications and blueprints <http://maffulli.net/2014/07/14/only-developers-should-file-specifications-a…> If you try to solve a problem with the wrong tool you’re likely going to have a frustrating experience. OpenStack developersuse blueprints define the roadmap for the various projects, the specifications attached to a blueprint are used to discuss the implementation details before code is submitted for review. Operators and users in general don’t need to dive in the details of how OpenStack developers organize their work and definitely should never be asked to use tools designed for and by developers. Third Party CI group formation and minutes At this week’s meeting the Third-Party group continues to discuss documentation patches, including a new terminology proposal, as well as CI system naming, logging and test timing. There was also a summary review of the current state of Neutron driver CI rollout. Anyone deploying a third-party test system or interested in easing third-party involvement is welcome to attend the meetings. Minutes of ThirdParty meetings <https://wiki.openstack.org/wiki/Meetings/ThirdParty>are carefully logged. The Road To Paris 2014 – Deadlines and Resources * Call for Speakers now OPEN – November Summit in Paris <http://www.openstack.org/blog/2014/07/call-for-speakers-now-open-november-s…> * Applications for Travel Support Program are open until August 18th <https://wiki.openstack.org/wiki/Travel_Support_Program> * Request an invitation letter for VISA <https://www.openstack.org/summit/openstack-paris-summit-2014/visa-informati…> * Reserve hotel rooms <https://www.openstack.org/summit/openstack-paris-summit-2014/hotels/> Security Advisories and Notices * [OSSA 2014-024] Use of non-constant time comparison operation (CVE-2014-3517) <http://lists.openstack.org/pipermail/openstack-announce/2014-July/000253.ht…> Tips ‘n Tricks * By Cody Bunch <http://openstack.prov12n.com/>: USB Key Duplication on OSX on the Cheap <http://openstack.prov12n.com/usb-key-duplication-on-osx-on-the-cheap/> (only marginally about OpenStack but neat) * By Manishanker Talusani <http://manishankert.blogspot.com/search/label/openstack>: How to contribute to Openstack <http://manishankert.blogspot.com/2014/05/how-to-contribute-to-openstack.html> * By Kevin Jackson <http://www.rackspace.com/blog/inside-my-home-rackspace-private-cloud-openst…>: Inside My Home Rackspace Private Cloud, OpenStack Lab, Part 7: LBaaS <http://www.rackspace.com/blog/inside-my-home-rackspace-private-cloud-openst…> Upcoming Events * 4th Birthday OpenStack Beijing <http://www.meetup.com/China-OpenStack-User-Group/events/191144122/> Jul 19, 2014 – Beijing, Beijing, CN Details <http://www.meetup.com/China-OpenStack-User-Group/events/191144122/> * OpenStack 4th Birthday Party <http://www.meetup.com/OpenStack-Russia/events/190197102/> Jul 19, 2014 – Moscow, Russia Details <http://www.meetup.com/OpenStack-Russia/events/190197102/> * OpenStack 4th Birthday Party <https://www.eventbrite.com/e/4to-aniversario-de-openstack-y-3er-encuentro-d…> Jul 19, 2014 – Caracas, Venezuela Details <https://www.eventbrite.com/e/4to-aniversario-de-openstack-y-3er-encuentro-d…> * OSCON <http://www.oscon.com/oscon2014> Jul 20 – 24, 2014 – Portland, Oregon Details <http://www.oscon.com/oscon2014> * OpenStack 4th Birthday Party <http://www.meetup.com/Indian-OpenStack-User-Group/events/188059912/> Jul 20, 2014 – Mumbai, India Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/188059912/> * Minnesota OpenStack Meetup <http://www.meetup.com/Minnesota-OpenStack-Meetup/> Jul 21, 2014 – MinneapolisSt. Paul, Minnesota, US Details <http://www.meetup.com/Minnesota-OpenStack-Meetup/> * OpenStack Tutorial and 4th Birthday Party <http://sciencecloud-community.cs.tu.ac.th/?p=102> Jul 21 – 23, 2014 – Thailand Details <http://sciencecloud-community.cs.tu.ac.th/?p=102> * The Fifth Elephant 2014 <https://fifthelephant.in/2014> Jul 23 – 26, 2014 – Bangalore, Karnataka, IN Details <https://fifthelephant.in/2014> * OpenStack 4th Anniversary – Munich <http://www.meetup.com/openstack-de/events/187306792/> Jul 23, 2014 – Munich, DE Details <http://www.meetup.com/openstack-de/events/187306792/> * OpenStack 4th Birthday Party <http://www.meetup.com/OpenStack-Seattle/events/173809092/> Jul 24, 2014 – Seattle, WA Details <http://www.meetup.com/OpenStack-Seattle/events/173809092/> * OpenStack 4th Birthday Party <http://www.meetup.com/Triangle-OpenStack-Meetup/events/188128342/> Jul 24, 2014 – Triangle, North Carolina Details <http://www.meetup.com/Triangle-OpenStack-Meetup/events/188128342/> * Openstack Brazil Day / 4th Birthday <http://openstackbr.com.br/eventos/openstack-brasil-day/> Jul 26, 2014 – Porto Alegre, RS, BR Details <http://openstackbr.com.br/eventos/openstack-brasil-day/> * OpenStack 4th Anniversary-Frankfurt <http://www.meetup.com/openstack-de/events/187307832/> Jul 28, 2014 – Frankfurt, DE Details <http://www.meetup.com/openstack-de/events/187307832/> * OpenStack 4th Anniversary – Berlin <http://www.meetup.com/openstack-de/events/187308322/> Jul 29, 2014 – Berlin, DE Details <http://www.meetup.com/openstack-de/events/187308322/> * OpenStack 4th BIrthday Party <http://www.meetup.com/OpenStack-Nairobi/events/184903312/> Jul 29, 2014 – Nairobi, Kenya Details <http://www.meetup.com/OpenStack-Nairobi/events/184903312/> * OpenStack miniconf at PyCon AU <http://openstack.pycon-au.org/> Aug 01 – 05, 2014 – Brisbane, Queensland, AU Details <http://openstack.pycon-au.org/> * SFBay Meetup – Beginner track <http://www.meetup.com/openstack/events/150932532/> Aug 07, 2014 – Sunnyvale, CA Details <http://www.meetup.com/openstack/events/150932532/> * OpenStack workshop at Fedora Flock <http://flock2014.sched.org/event/1d4b19e447ef9c55207791db8e8b1307#.U4_kH66V…> Aug 09, 2014 – Prague, Czech Republic, CZ Details <http://flock2014.sched.org/event/1d4b19e447ef9c55207791db8e8b1307#.U4_kH66V…> * Serviceability, Swift and OpenStack <http://www.meetup.com/Openstack-Boston/events/189349082/> Aug 14, 2014 – Boston, MA, US Details <http://www.meetup.com/Openstack-Boston/events/189349082/> * OpenStack Trove Day <http://www.tesora.com/event/openstack-trove-day> Aug 19, 2014 – Cambridge, MA, US Details <http://www.tesora.com/event/openstack-trove-day> * CloudOpen North America <http://events.linuxfoundation.org/events/cloudopen-north-america> Aug 20 – 22, 2014 – Chicago, IL Details <http://events.linuxfoundation.org/events/cloudopen-north-america> * OpenStack Silicon Valley <http://openstacksv.com/> Sep 16, 2014 – Mountain View, CA, US Details <http://openstacksv.com/> * OpenStack Conference Benelux 2014 <http://www.openstack.nl/OpenStack_Benelux_2014> Sep 19, 2014 – Bussum, The Netherlands Details <http://www.openstack.nl/OpenStack_Benelux_2014> * OpenStack Summit November 2014 <http://openstack.org/summit> Nov 03 – 07, 2014 – Paris, France Details <http://openstack.org/summit> Other News * OpenStack DefCore Review [interview by Jason Baker] <http://robhirschfeld.com/2014/07/16/openstack-defcore-review-interview-by-j…> * How DreamHost is reinventing itself with OpenStack <http://www.dreamhost.com/dreamscape/2014/07/16/how-dreamhost-is-reinventing…> * Widening the Engagement of the Hidden OpenStack Influencers <http://sarob.com/2014/07/widening-the-engagement-of-the-hidden-openstack-in…> * OpenStack Project Meeting: Summary <http://eavesdrop.openstack.org/meetings/project/2014/project.2014-07-01-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2014/project.2014-07-01-21.…>. Got Answers? Ask OpenStack <https://ask.openstack.org/> is the go-to destination for OpenStack users. Interesting questions waiting for answers: * User role association to tenant fails from dashboard with LDAP backend? <https://ask.openstack.org/en/question/43020/user-role-association-to-tenant…> * Deleting Network with Python httplib2 doesn’t work? <https://ask.openstack.org/en/question/42881/deleting-network-with-python-ht…> * Neutron floating IPs bounded to specific hosts <https://ask.openstack.org/en/question/42882/neutron-floating-ips-bounded-to…> * Icehouse: How to create a bootable snapshot from a running instance <https://ask.openstack.org/en/question/42804/icehouse-how-to-create-a-bootab…> Welcome New Reviewers and Developers Will Foster <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> zhangtralon <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Walter Heck <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Gael Chamoulaud <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Mithil Arun <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Fabrizio Fresco <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Kieran Forde <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> badveli_vishnuus <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> JJ Asghar <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Ryan Lucio <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Gilles Dubreuil <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Martin Falatic <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Emily Hugenbruch <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Bryan Jones <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Christian Hofstädtler <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Tri Hoang Vo <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Steven Hillman <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Ryan Rossiter <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Rajesh Tailor <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Mohit <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> akash <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Tushar Katarki <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Rajini Ram <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Pawel Skowron <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Pawel Skowron <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Karthik Natarajan <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Abhishek L <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Ryan Brown <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> takehirokaneko <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Keith Basil <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Kate Coyne <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Ju Lim <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Latest Activity In Projects Do you want to see at a glance the bugs filed and solved this week? Latest patches submitted for review? Check out the individual project pages on OpenStack Activity Board – Insights <http://activity.openstack.org/data/display/OPNSTK2/>. * Telemetry (Ceilometer) <http://activity.openstack.org/data/display/OPNSTK2/ceilometer> * Block Storage (Cinder) <http://activity.openstack.org/data/display/OPNSTK2/cinder> * Image Service (Glance) <http://activity.openstack.org/data/display/OPNSTK2/glance> * Orchestration API <http://activity.openstack.org/data/display/OPNSTK2/heat> (Heat) <http://activity.openstack.org/data/display/OPNSTK2/heat> * Dashboard (Horizon) <http://activity.openstack.org/data/display/OPNSTK2/horizon> * Bare Metal Provisioning (Ironic) <http://activity.openstack.org/data/display/OPNSTK2/ironic> * Identity (Keystone) <http://activity.openstack.org/data/display/OPNSTK2/keystone> * Manuals <http://activity.openstack.org/data/display/OPNSTK2/openstack-manuals> * Networking (Neutron) <http://activity.openstack.org/data/display/OPNSTK2/neutron> * Compute (Nova) <http://activity.openstack.org/data/display/OPNSTK2/nova> * Data Processing (Sahara) <http://activity.openstack.org/data/display/OPNSTK2/swift> * Object Storage (Swift) <http://activity.openstack.org/data/display/OPNSTK2/swift> * Database As A Service (Trove) <http://activity.openstack.org/data/display/OPNSTK2/trove> /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment/

1 0

[OSSA 2014-024] Use of non-constant time comparison operation (CVE-2014-3517)
by Grant Murphy 17 Jul '14

17 Jul '14

OpenStack Security Advisory: 2014-024 CVE: CVE-2014-3517 Date: July 17, 2014 Title: Use of non-constant time comparison operation Reporter: Alex Gaynor (Rackspace) Products: Nova Versions: Up to 2013.2.3, and 2014.1 to 2014.1.1 Alex Gaynor from Rackspace reported a timing attack vulnerability in Nova. By analyzing response times to requests for instance metadata, an attacker may be able to guess a valid instance ID signature. This could allow access to important configuration details of another instance. Only setups configured to proxy metadata requests via Neutron are affected. Juno (development branch) fix: https://review.openstack.org/107396 Icehouse https://review.openstack.org/107397 Havana https://review.openstack.org/107398 Notes: This fix will be included in the Juno-2 development milestone and in future 2013.2.4 and 2014.1.2 releases References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3517 https://launchpad.net/bugs/1325128 -- Grant Murphy OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (July 4 - 11)
by Stefano Maffulli 11 Jul '14

11 Jul '14

1 0

[OSSA 2014-023] Multiple XSS vulnerabilities in Horizon (CVE-2014-3473, CVE-2014-3474, and CVE-2014-3475)
by Tristan Cacqueray 08 Jul '14

08 Jul '14

OpenStack Security Advisory: 2014-023 CVE: CVE-2014-3473, CVE-2014-3474, and CVE-2014-3475 Date: July 08, 2014 Title: Multiple XSS vulnerabilities in Horizon Reporter: Jason Hullinger (HP) - CVE-2014-3473 Craig Lorentzen (Cisco) - CVE-2014-3474 Michael Xin (Rackspace) - CVE-2014-3475 Products: Horizon Versions: up to 2013.2.3, and 2014.1 versions up to 2014.1.1 Description: Jason Hullinger from Hewlett Packard, Craig Lorentzen from Cisco and Michael Xin from Rackspace reported 3 cross-site scripting (XSS) vulnerabilities in Horizon. A malicious Orchestration template owner or catalog may conduct an XSS attack once a corrupted template is used in the Orchestration/Stack section of Horizon. A malicious Horizon user may store an XSS attack by creating a network with a corrupted name. A malicious Horizon administrator may store an XSS attack by creating a user with a corrupted email address. Once executed in a legitimate context these attacks may result in potential asset stealing (horizon user/admin access credentials, VMs/Network configuration/management, tenants' confidential information, etc.). All Horizon setups are affected. Juno (development branch) fix: https://review.openstack.org/105476 Icehouse fix: https://review.openstack.org/105477 Havana fix: https://review.openstack.org/105478 Notes: This fix will be included in the Juno-2 development milestone and in future 2013.2.4 and 2014.1.2 releases. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3473 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3474 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3475 https://launchpad.net/bugs/1308727 https://launchpad.net/bugs/1320235 https://launchpad.net/bugs/1322197 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

Swift 2.0.0 has been released and includes support for storage policies
by John Dickinson 08 Jul '14

08 Jul '14

I'm happy to announce that Swift 2.0.0 has been officially released! You can get the tarball at http://tarballs.openstack.org/swift/swift-2.0.0.tar.gz. This release is a huge milestone in the history of Swift. This release includes storage policies, a set of features I've often said is the most important thing to happen to Swift since it was open-sourced. What are storage policies, and why are they so significant? Storage policies allow you to set up your cluster to exactly match your use case. From a technical perspective, storage policies allow you to have more than one object ring in your cluster. Practically, this means that you can can do some very important things. First, given the global set of hardware for your Swift deployment, you can choose which set of hardware your data is stored on. For example, this could be performance-based, like with flash vs spinning drives, or geography-based, like Europe vs North America. Second, once you've chosen the subset of hardware for your data, storage policies allow you to choose how the data is stored across that set of hardware. You can choose the replication factor independently for each policy. For example, you can have a "reduced redundancy tier", a "3x replication tier", and also a tier with a replica in every geographic region in the world. Combined with the ability to choose the set of hardware, this gives you a huge amount of control over how your data is stored. Looking forward, storage policies is the foundation upon we are building support for non-replicated storage. With this release, we are able to focus on building support for an erasure code storage policy, thus giving the ability to more efficiently store large data sets. For more information, start with the developer docs for storage policies at http://swift.openstack.org/overview_policies.html. I gave a talk on storage policies at the Atlanta summit last April. https://www.youtube.com/watch?v=mLC1qasklQo The full changelog for this release is at https://github.com/openstack/swift/blob/master/CHANGELOG. --John

1 0

OpenStack Community Weekly Newsletter (June 27 – July 4)
by Stefano Maffulli 03 Jul '14

03 Jul '14

1 0

[OSSA 2014-022] Keystone V2 trusts privilege escalation through user supplied project id (CVE-2014-3520)
by Tristan Cacqueray 02 Jul '14

02 Jul '14

OpenStack Security Advisory: 2014-022 CVE: CVE-2014-3520 Date: July 02, 2014 Title: Keystone V2 trusts privilege escalation through user supplied project id Reporter: Jamie Lennox (Red Hat) Products: Keystone Versions: up to 2013.2.3, and 2014.1 to 2014.1.1 Description: Jamie Lennox from Red Hat reported a vulnerability in Keystone trusts. By using an out of scope project id, a trustee may gain unauthorized access if the trustor has the required roles in the requested project id. All Keystone deployments configured to enable trusts and V2 API are affected. Juno (development branch) fix: https://review.openstack.org/104216 Icehouse fix: https://review.openstack.org/104217 Havana fix: https://review.openstack.org/104218 Notes: This fix will be included in the Juno-2 development milestone and in future 2013.2.4 and 2014.1.2 releases. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3520 https://launchpad.net/bugs/1331912 --· Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (June 20 – 27)
by Stefano Maffulli 27 Jun '14

27 Jun '14

1 0

python-heatclient 0.2.9 released
by Steve Baker 26 Jun '14

26 Jun '14

The heat development community would like to announce the release of python-heatclient version 0.2.9. python-heatclient is a client library for Heat built on the Heat orchestration API. It provides a Python API (the heatclient module) and a command-line tool (heat). This release can be installed from the following locations: http://tarballs.openstack.org/python-heatclient <http://tarballs.openstack.org/python-heatclient> https://pypi.python.org/pypi/python-heatclient <https://pypi.python.org/pypi/python-heatclient> Changes in this release: https://launchpad.net/python-heatclient/+milestone/v0.2.9 <https://launchpad.net/python-heatclient/+milestone/v0.2.5>

1 1