- OpenStack-announce - lists.openstack.org

[OSSA 2014-017] Nova VMWare driver leaks rescued images (CVE-2014-2573)
by Jeremy Stanley 29 May '14

29 May '14

OpenStack Security Advisory: 2014-017 CVE: CVE-2014-2573 Date: May 29, 2014 Title: Nova VMWare driver leaks rescued images Reporter: Jaroslav Henner (Red Hat) Products: Nova Versions: from 2013.2 to 2013.2.3, and 2014.1 Description: Jaroslav Henner from Red Hat reported a vulnerability in Nova. By requesting Nova place an image into rescue, then deleting the image, an authenticated user my exceed their quota. This can result in a denial of service via excessive resource consumption. Only setups using the Nova VMWare driver are affected. Juno (development branch) fix: https://review.openstack.org/75788 https://review.openstack.org/80284 Icehouse fix: https://review.openstack.org/88514 https://review.openstack.org/89217 Havana fix: https://review.openstack.org/89762 https://review.openstack.org/89768 Notes: This fix will be included in the juno-1 development milestone and in future 2013.2.4 and 2014.1.1 releases. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2573 https://launchpad.net/bugs/1269418 -- Jeremy Stanley OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (May 2 – 23)
by Stefano Maffulli 23 May '14

23 May '14

1 0

[OSSA 2014-016] Heat template URL information leakage (CVE-2014-3801)
by Tristan Cacqueray 23 May '14

23 May '14

OpenStack Security Advisory: 2014-016 CVE: CVE-2014-3801 Date: May 23, 2014 Title: Heat template URL information leakage Reporter: Jason Dunsmore (Rackspace) Products: Heat Versions: 2013.2 to 2013.2.3, and 2014.1 Description: Jason Dunsmore from Rackspace reported a vulnerability in Heat. An authenticated user may temporarily see the URL of a provider template used in another tenant by listing heat resources types. This may result in disclosure of additional information if the template itself can be accessed. The URL disappears from the listing after a certain point in the stack creation. All Heat setups are affected. Juno (development branch) fix: https://review.openstack.org/89695 Icehouse fix: https://review.openstack.org/94625 Havana fix: https://review.openstack.org/94644 Notes: This fix will be included in the juno-1 development milestone and in future 2013.2.4 and 2014.1.1 releases. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3801 https://launchpad.net/bugs/1311223 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

New release of python-swiftclient (now with py3 support)
by John Dickinson 23 May '14

23 May '14

I'm happy to announce that python-swiftclient 2.1.0 has just been released! https://pypi.python.org/pypi/python-swiftclient/ This release includes support for Python 3.3. I want to specifically thank Tristan Cacqueray, Chmouel Boudjnah, Alex Gaynor, and Christian Schwede for working on the py3 compatibility. --John

1 0

[OSSA 2014-015] Keystone user and group id mismatch (CVE-2014-0204)
by Tristan Cacqueray 21 May '14

21 May '14

OpenStack Security Advisory: 2014-015 CVE: CVE-2014-0204 Date: May 21, 2014 Title: Keystone user and group id mismatch Reporter: Michael Stancampiano (IBM) Products: Keystone Versions: 2014.1 Description: Michael Stancampiano from IBM reported a vulnerability in Keystone. Someone with write access to the user and group repository (such as the LDAP directory server) may willingly or unwillingly grant additional rights by picking the same IDs for users and groups, resulting in roles assigned to a group being assigned to the affected user even if he is not a member of this group. Only Keystone setups using LDAP for the Identity driver are affected. Juno (development branch) fixes: https://review.openstack.org/94396 https://review.openstack.org/94470 Icehouse fix: https://review.openstack.org/94397 Notes: This fix will be included in the juno-1 development milestone and in a future 2014.1.1 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0204 https://launchpad.net/bugs/1309228 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Apr 25 – May 2)
by Stefano Maffulli 02 May '14

02 May '14

DefCore Core Capabilities Selection Criteria SIMPLIFIED -> how we are picking Core <http://robhirschfeld.com/2014/05/01/defcore-capabilities-selection/> Rob Hirschfeld <http://robhirschfeld.com/> summarizes the status of discussions within OpenStack community of what is ‘Openstack’. The effort is now summarized in a diagram showing the 12 criterias grouped in 4 main categories. Better go read Rob’s post, it’ll all make sense. Announcing the O’Reilly OpenStack Operations Guide <http://www.openstack.org/blog/2014/04/announcing-the-oreilly-openstack-oper…> O’Reilly has completed the production of the /OpenStack Operations Guide: Set Up and Manage Your OpenStack Cloud/. You can get your bits-n-bytes copy at http://docs.openstack.org/ops/ or order a dead-tree version on the O’Reilly site <http://shop.oreilly.com/product/0636920032625.do>. What It Means To Be In The OpenStack Community (One Member’s Take) <http://cloudarchitectmusings.com/2014/04/28/what-it-means-to-be-in-the-open…> What is Kenneth Hui <http://cloudarchitectmusings.com/>, Rackspace Technology Evangelist, deeply committed member of OpenStack, doing at a CloudStack conference? Read his blog post to find out what it means to be a good citizen of a community. Results of the TC Election <http://lists.openstack.org/pipermail/openstack-announce/2014-April/000229.h…> Please join me in congratulating the 7 newly elected members of the TC: Thierry Carrez, Jay Pipes, Vishvananda Ishaya, Michael Still, Jim Blair, Mark McClain, Devananda van der Veen. Full results: Full results <http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_d34934c9fd1f6282>. The road to Juno Summit – Atlanta 2014 * Applying for Visa? Looking for accommodation in Atlanta? Visit http://openstack.org/summit * Check the official agenda <http://openstacksummitmay2014atlanta.sched.org/> Tips ‘n Tricks * By Assaf Muller <http://assafmuller.wordpress.com/>: Introduction to Neutron <http://assafmuller.wordpress.com/2014/05/02/introduction-to-neutron/> * By Ramon Acedo <http://trickycloud.wordpress.com/>: Multiple Private Networks with Open vSwitch GRE Tunnels and Libvirt <http://trickycloud.wordpress.com/2014/05/02/multiple-private-networks-with-…> * By dudo <http://blog.zhaw.ch/icclab/manage-instance-startup-order-in-openstack-heat-…>: Manage instance startup order in OpenStack Heat Templates <http://blog.zhaw.ch/icclab/manage-instance-startup-order-in-openstack-heat-…> * By Loïc Dachary <http://dachary.org/>: Two minor pitfalls when upgrading Havana stable <http://dachary.org/?p=2948> and Resetting an instance {power,vm,task}_state in Havana <http://dachary.org/?p=2939> * By Sean Dague <https://dague.net/>: Helpful Gerrit Queries (Gerrit 2.8 edition) <https://dague.net/2014/04/30/helpful-gerrit-queries-gerrit-2-8-edition/> * By Rob Hirschfeld <http://robhirschfeld.com/>: Success Factors of Operating Open Source Infrastructure [Series Intro] <http://robhirschfeld.com/2014/04/29/openops-success-factors/> and Reference Deployments are Critical [2/4 series on Operating Open Source Infrastructure] <http://robhirschfeld.com/2014/04/29/reference-deployments/> * By Piyush Harsh <http://blog.zhaw.ch/icclab/managing-hosts-in-a-running-openstack-environmen…>: Managing hosts in a running OpenStack environment <http://blog.zhaw.ch/icclab/managing-hosts-in-a-running-openstack-environmen…> * By Nathan Kinder <https://blog-nkinder.rhcloud.com/>: Secure messaging with Kite <https://blog-nkinder.rhcloud.com/?p=62> * By Andy Edmonds <http://blog.zhaw.ch/icclab/getting-started-with-openshift-and-openstack/>: Getting Started with OpenShift and OpenStack <http://blog.zhaw.ch/icclab/getting-started-with-openshift-and-openstack/> Reports from Previous Events * What’s new in the OpenStack Heat Icehouse release <https://plus.google.com/u/0/events/ckhqrki6iepg12vkqk5vnt7ijd0> * Asia Pacific: How to launch, run & grow OpenStack User Groups <https://www.youtube.com/watch?v=2XPa_d2XnWY> Upcoming Events * OpenStack Brasil User Group Meeting @ FISL15 <http://softwarelivre.org/fisl15> May 07 – 10, 2014 – Porto Alegre, Brasil Details <http://softwarelivre.org/fisl15> * OpenStack DACH Day at LinuxTag 2014 <http://www.linuxtag.org/2014/en/#openstack> May 09, 2014 – Berlin, Germany Details <http://www.linuxtag.org/2014/en/#openstack> * OpenStack Summit May 2014 <http://www.openstack.org/summit/openstack-summit-atlanta-2014/> May 12 – 16, 2014 – Atlanta, GA Details <http://www.openstack.org/summit/openstack-summit-atlanta-2014/> * SFBay OpenStack Hackathon #OSSFO <http://www.meetup.com/openstack/> May 15, 2014 – Details <http://www.meetup.com/openstack/> * Gartner IT Infrastructure Operations & Data Center Summit <http://www.gartner.com/technology/summits/apac/data-center/> May 21 – 22, 2014 – Sydney, Australia Details <http://www.gartner.com/technology/summits/apac/data-center/> * OpenStack Study Group <http://www.nycresistor.com/2014/04/17/openstack-study-group-may-21/> May 21, 2014 – Brooklyn, NY Details <http://www.nycresistor.com/2014/04/17/openstack-study-group-may-21/> * OpenStack in Action <http://www.openstackinaction.fr/en/> May 28, 2014 – Paris, France Details <http://www.openstackinaction.fr/en/> * OpenStack CEE Day <http://www.eventbrite.com/e/openstack-cee-day-2014-tickets-11161407069?aff=…> May 28, 2014 – Budapest, Hungary Details <http://www.eventbrite.com/e/openstack-cee-day-2014-tickets-11161407069?aff=…> * SFBay OpenStack Hackathon #OSSFO <http://www.meetup.com/openstack/> May 29, 2014 – Details <http://www.meetup.com/openstack/> * #1 OpenStack Day <http://www.meetup.com/OpenStack-User-Group-Italia/events/176817882/> May 30, 2014 – Milan, Italy Details <http://www.meetup.com/OpenStack-User-Group-Italia/events/176817882/> * OpenStack Israel Event <http://www.meetup.com/IGTCloud/events/157265772/> Jun 02, 2014 – Herzliya, Israel Details <http://www.meetup.com/IGTCloud/events/157265772/> * OpenStack UK Day in London <http://www.eventbooking.uk.com/openstack/index.php> Jun 04, 2014 – London, UK Details <http://www.eventbooking.uk.com/openstack/index.php> * SFBay Meetup – Beginner track <http://www.meetup.com/openstack/events/123227662/> Jun 05, 2014 – Sunnyvale, CA Details <http://www.meetup.com/openstack/events/123227662/> * SFBay OpenStack Hackathon #OSSFO <http://www.meetup.com/openstack/> Jun 12, 2014 – Details <http://www.meetup.com/openstack/> * Cloud World Forum <http://cloudwf.com/> Jun 17 – 18, 2014 – London, UK Details <http://cloudwf.com/> * Cloud World Forum <http://cloudwf.com/> Jun 17 – 18, 2014 – London, UK Details <http://cloudwf.com/> * SFBay Meetup – Beginner track <http://www.meetup.com/openstack/events/150932472/> Jul 03, 2014 – Sunnyvale, CA Details <http://www.meetup.com/openstack/events/150932472/> * OSCON <http://www.oscon.com/oscon2014> Jul 20 – 24, 2014 – Portland, Oregon Details <http://www.oscon.com/oscon2014> * SFBay Meetup – Beginner track <http://www.meetup.com/openstack/events/150932532/> Aug 07, 2014 – Sunnyvale, CA Details <http://www.meetup.com/openstack/events/150932532/> * OpenStack Summit November 2014 <http://openstack.org/summit> Nov 03 – 08, 2014 – Paris, France Details <http://openstack.org/summit> Other News * OpenStack, Icehouse and Red Hat Enterprise Linux 7 – Available Now <http://redhatstackblog.redhat.com/2014/05/02/openstack-icehouse-and-red-hat…> * Oracle adds OpenStack to updated Solaris <http://www.computerworld.com/s/article/9247998/Oracle_adds_OpenStack_to_upd…> * Updated: SUSE Cloud 3 Admin Appliance 1.2.0 available <http://blog.seader.us/2014/04/updated-suse-cloud-3-admin-appliance_25.html> * Project Solum Goes Full Steam Ahead To Milestone 1 <http://www.rackspace.com/blog/project-solum-goes-full-steam-ahead-to-milest…> * #OpenStack Israel Podcast – Episode 9 is out! <http://cloudifysource.tumblr.com/post/84132078901> * Nagios / Ceilometer integration: new plugin available <http://blog.zhaw.ch/icclab/nagios-ceilometer-integration-new-plugin-availab…> * Improving libvirt firewall performance <https://www.berrange.com/posts/2014/05/02/improving-libvirt-firewall-perfor…> * Why We Craft OpenStack (Featuring Rackspace Software Development Manager Glen Campbell) <http://www.rackspace.com/blog/why-we-craft-openstack-featuring-rackspace-so…> * Why We Craft OpenStack (Featuring Rackspace Principal Engineer Chuck Thier) <http://www.rackspace.com/blog/why-we-craft-openstack-featuring-rackspace-pr…> * Open Mic Spotlight: Lucas Gomes <http://www.openstack.org/blog/2014/05/5926/> * Networking in Cloud Environments, SDN, NFV, and why it matters [part 1 of 2] <http://robhirschfeld.com/2014/05/01/networking-in-cloud-1/> * KVM and Docker LXC Benchmarking with OpenStack <http://bodenr.blogspot.com/2014/05/kvm-and-docker-lxc-benchmarking-with.html> * OpenCrowbar.Anvil released – hammering out a gold standard in open bare metal provisioning <http://robhirschfeld.com/2014/04/30/opencrowbar-anvil/> * HP is running a survey for release at the Summit <https://www.surveymonkey.com/s/SM1OpenStack> * OpenStack Project Meeting: didn’t happen this week Got Answers? Ask OpenStack <https://ask.openstack.org/> is the go-to destination for OpenStack users. Interesting questions waiting for answers: * What causes ‘Namespace’ object has no attribute ‘volume’ restoring a Cinder backup? <https://ask.openstack.org/en/question/28362/what-causes-namespace-object-ha…> * How to use filtering queries in Ceilometer via CLI? <https://ask.openstack.org/en/question/28512/how-to-use-filtering-queries-in…> * Unable to load quantum from configuration file /etc/neutron/api-paste.ini – Icehouse <https://ask.openstack.org/en/question/28431/unable-to-load-quantum-from-con…> * Configure multiple External network <https://ask.openstack.org/en/question/28428/configure-multiple-external-net…> * Instance not taking IP form The DHCP and Gateway router external port down? <https://ask.openstack.org/en/question/28391/instance-not-taking-ip-form-the…> Welcome New Reviewers and Developers Christina Darretta <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Abhinav Agrawal <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Sam Hague <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Gabriel Assis Bezerra <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Obulapathi <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Michael Tupitsyn <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> yummy.bian <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Laurel Michaels <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Tushar Gohad <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Karin Levenstein <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Karin Levenstein <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Baohua Yang <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Andrew James <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Tushar Gohad <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Latest Activity In Projects Do you want to see at a glance the bugs filed and solved this week? Latest patches submitted for review? Check out the individual project pages on OpenStack Activity Board – Insights <http://activity.openstack.org/data/display/OPNSTK2/>. * Telemetry (Ceilometer) <http://activity.openstack.org/data/display/OPNSTK2/ceilometer> * Block Storage (Cinder) <http://activity.openstack.org/data/display/OPNSTK2/cinder> * Image Service (Glance) <http://activity.openstack.org/data/display/OPNSTK2/glance> * Orchestration API <http://activity.openstack.org/data/display/OPNSTK2/heat> (Heat) <http://activity.openstack.org/data/display/OPNSTK2/heat> * Dashboard (Horizon) <http://activity.openstack.org/data/display/OPNSTK2/horizon> * Bare Metal Provisioning (Ironic) <http://activity.openstack.org/data/display/OPNSTK2/ironic> * Identity (Keystone) <http://activity.openstack.org/data/display/OPNSTK2/keystone> * Manuals <http://activity.openstack.org/data/display/OPNSTK2/openstack-manuals> * Networking (Neutron) <http://activity.openstack.org/data/display/OPNSTK2/neutron> * Compute (Nova) <http://activity.openstack.org/data/display/OPNSTK2/nova> * Data Processing (Sahara) <http://stackalytics.com/?release=icehouse&metric=commits&project_type=opens…> * Object Storage (Swift) <http://activity.openstack.org/data/display/OPNSTK2/swift> * Database As A Service (Trove <http://activity.openstack.org/data/display/OPNSTK2/trove> /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

Results of the TC Election
by Anita Kuno 25 Apr '14

25 Apr '14

Please join me in congratulating the 7 newly elected members of the TC. * Thierry Carrez * Jay Pipes * Vishvananda Ishaya * Michael Still * Jim Blair * Mark McClain * Devananda van der Veen Full results: http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_d34934c9fd1f6282 Thank you to all candidates who stood for election, having a good group of candidates helps engage the community in our democratic process, Thank you to all who voted and who encouraged others to vote. We need to ensure your voice is heard. Thanks to my fellow election official, Tristan Cacqueray, I appreciate your help and perspective. Thank you for another great round. Here's to Juno, Anita.

1 0

OpenStack Community Weekly Newsletter (Apr 18 – 25)
by Stefano Maffulli 25 Apr '14

25 Apr '14

1 0

[OSSA 2014-014] Neutron security groups bypass through invalid CIDR (CVE-2014-0187)
by Tristan Cacqueray 22 Apr '14

22 Apr '14

OpenStack Security Advisory: 2014-014 CVE: CVE-2014-0187 Date: April 22, 2014 Title: Neutron security groups bypass through invalid CIDR Reporters: Stephen Ma (HP) and Christoph Thiel (Deutsche Telekom) Products: Neutron Versions: 2013.1 to 2013.2.3, and 2014.1 Description: Stephen Ma from Hewlett Packard and Christoph Thiel from Deutsche Telekom reported a vulnerability in Neutron security groups. By creating a security group rule with an invalid CIDR, an authenticated user may break openvswitch-agent process, preventing further rules from being applied on the host. Note: removal of the faulty rule is not enough, the openvswitch-agent must be restarted. All Neutron setups using Open vSwitch are affected. Juno (development branch) fix: https://review.openstack.org/59212 Icehouse fix: https://review.openstack.org/88674 Havana fix: https://review.openstack.org/88057 Notes: This fix will be included in the juno-1 development milestone and in future 2013.2.4 and 2014.1.1 releases. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0187 https://launchpad.net/bugs/1300785 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Apr 11 – 18)
by Stefano Maffulli 18 Apr '14

18 Apr '14

1 0