- OpenStack-announce - lists.openstack.org

[OSSA 2014-011] RBAC policy not properly enforced in Nova EC2 API (CVE-2014-0167)
by Tristan Cacqueray 09 Apr '14

09 Apr '14

OpenStack Security Advisory: 2014-011 CVE: CVE-2014-0167 Date: April 09, 2014 Title: RBAC policy not properly enforced in Nova EC2 API Reporter: Marc Heckmann (Ubisoft) Products: Nova Versions: from 2013.1 to 2013.2.3 Description: Marc Heckmann from Ubisoft reported a vulnerability in the Nova EC2 API security group implementation. RBAC policies are not enforced when using the EC2 API, in particular the add_rules, remove_rules and destroy methods. A restricted user may overcome his limitation by using EC2 API resulting in unauthorized action on security groups. Only setups using non-default RBAC rules for Nova may be affected. Juno (development branch) fix: https://review.openstack.org/86358 Icehouse (milestone-proposed branch) fix: https://review.openstack.org/86360 Havana fix: https://review.openstack.org/86361 Notes: This fix will be included in the icehouse-rc2 development milestone and in a future 2013.2.4 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0167 https://launchpad.net/bugs/1290537 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OSSA 2014-010] XSS in Horizon orchestration dashboard (CVE-2014-0157)
by Tristan Cacqueray 08 Apr '14

08 Apr '14

OpenStack Security Advisory: 2014-010 CVE: CVE-2014-0157 Date: April 08, 2014 Title: XSS in Horizon orchestration dashboard Reporter: Cristian Fiorentino (Intel) Products: Horizon Versions: 2013.2 version up to 2013.2.3 Description: Cristian Fiorentino from Intel reported a vulnerability in Horizon Orchestration dashboard. By tricking a Horizon user into using a malicious template in the Orchestration/Stack section of Horizon, a remote attacker may trigger a cross-site-scripting vulnerability. It may result in potential assets theft (Horizon user/admin access credentials, tenants confidential information, etc.). Only setups exposing the orchestration dashboard in Horizon are affected. Juno (development branch) fix: https://review.openstack.org/86059 Icehouse (milestone-proposed branch) fix: https://review.openstack.org/86054 Havana fix: https://review.openstack.org/86056 Notes: This fix will be included in the icehouse-rc2 development milestone and in a future 2013.2.4 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0157 https://launchpad.net/bugs/1289033 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Mar 28 – Apr 4)
by Stefano Maffulli 05 Apr '14

05 Apr '14

1 0

OpenStack 2013.2.3 released
by Adam Gandelman 03 Apr '14

03 Apr '14

Hello everyone, The OpenStack Stable Maintenance team is happy to announce the release of the 2013.2.3 stable Havana release. We have been busy reviewing and accepting backported bugfixes to the stable/havana branches according to the criteria set at: https://wiki.openstack.org/wiki/StableBranch A total of 106 bugs have been fixed across all projects. These updates to Havana are intended to be low risk with no intentional regressions or API changes. The list of bugs, tarballs and other milestone information for each project may be found on Launchpad: https://launchpad.net/ceilometer/havana/2013.2.3 https://launchpad.net/cinder/havana/2013.2.3 https://launchpad.net/glance/havana/2013.2.3 https://launchpad.net/heat/havana/2013.2.3 https://launchpad.net/horizon/havana/2013.2.3 https://launchpad.net/keystone/havana/2013.2.3 https://launchpad.net/neutron/havana/2013.2.3 https://launchpad.net/nova/havana/2013.2.3 Release notes may be found on the wiki: https://wiki.openstack.org/wiki/ReleaseNotes/2013.2.3 The freeze on the stable/havana branches will be lifted today as we begin working toward the 2013.3.4 release, to be released by Alan Pevec at a TBD date after the Icehouse release has wrapped up. Thanks, Adam Gandelman

1 0

Old stable/grizzly branches removed as of March 30, 2014
by Jeremy Stanley 02 Apr '14

02 Apr '14

Based on discussion[1] at the Icehouse Summit in Hong Kong, official support for stable/grizzly branches of OpenStack projects reached end of life and was frozen on March 6, 2014 (coincident with the icehouse-3 milestone). We kept these branches around for the scheduled 2013.1.5 stable point release[2] on March 20, 2014, and then tagged them "grizzly-eol" and deleted them from official Git repositories on March 30, 2014. At that time, all related provisions within our testing infrastructure for these branches were removed in preparation for upcoming stable/icehouse branch testing. My apologies for the delayed notice on the branch deletion, in case anyone was caught off guard by it. [1] https://etherpad.openstack.org/p/stable-havana-ideas [2] http://lists.openstack.org/pipermail/openstack-announce/2014-March/000209.h… -- Jeremy Stanley

1 0

OpenStack Community Weekly Newsletter (Mar 21 – 28)
by Stefano Maffulli 28 Mar '14

28 Mar '14

1 0

[OSSA 2014-009] Nova host data leak to vm instance in rescue mode (CVE-2014-0134)
by Tristan Cacqueray 27 Mar '14

27 Mar '14

OpenStack Security Advisory: 2014-009 CVE: CVE-2014-0134 Date: March 27, 2014 Title: Nova host data leak to vm instance in rescue mode. Reporter: Stanislaw Pitucha (HP) Products: Nova Versions: 2013.2 versions up to 2013.2.2 Description: Stanislaw Pitucha from Hewlett Packard reported a vulnerability in the Nova instance rescue mode. By overwriting the disk inside an instance with a malicious image and switching the instance to rescue mode, an authenticated user would be able to leak an arbitrary file from the compute host to the virtual instance. Note that the host file must be readable by the libvirt/kvm context to be exposed. Only setups using libvirt to spawn instance, and having "use_cow_images = False" in Nova configuration are affected. Icehouse (development branch) fix: https://review.openstack.org/82840 Havana fix: https://review.openstack.org/82841 Notes: This fix will be included in the icehouse-rc1 development milestone and in a future 2013.2.3 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0134 https://launchpad.net/bugs/1221190 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OSSA 2014-008] Routers can be cross plugged by other tenants (CVE-2014-0056)
by Grant Murphy 27 Mar '14

27 Mar '14

OpenStack Security Advisory: 2014-008 CVE: CVE-2014-0056 Date: March 27, 2014 Title: Routers can be cross plugged by other tenants Reporter: Aaron Rosen (VMWare) Products: Neutron Affects: 2012.2 versions up to 2013.2.2 Description: Aaron Rosen from VMWare reported a vulnerability where Neutron fails to perform proper authorization checks when creating ports. By choosing a device id of a router from a different tenant when creating a port, an authenticated user can access the network of other tenants. This affects deployments of Neutron using plugins relying on the l3-agent. Icehouse (development branch) fix: https://review.openstack.org/83391 Havana fix: https://review.openstack.org/83393 Notes: One should perform and audit of the ports that are already attached to routers after applying this patch and remove ports that a tenant may have cross plugged. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0056 https://bugs.launchpad.net/bugs/1243327 -- Grant Murphy OpenStack Vulnerability Management Team

1 0

[OSSA 2014-007] Potential context confusion in Keystone middleware (CVE-2014-0105)
by Tristan Cacqueray 27 Mar '14

27 Mar '14

OpenStack Security Advisory: 2014-007 CVE: CVE-2014-0105 Date: March 27, 2014 Title: Potential context confusion in Keystone middleware Reporter: Kieran Spear (University of Melbourne) Products: python-keystoneclient Versions: All versions up to 0.6.0 Description: Kieran Spear from the University of Melbourne reported a vulnerability in Keystone auth_token middleware (shipped in python-keystoneclient). By doing repeated requests, with sufficient load on the target system, an authenticated user may in certain situations assume another authenticated user's complete identity and multi-tenant authorizations, potentially resulting in a privilege escalation. Note that it is related to a bad interaction between eventlet and python-memcached that should be avoided if the calling process already monkey-patches "thread" to use eventlet. Only keystone middleware setups using auth_token with memcache are vulnerable. python-keystoneclient fix (included in 0.7.0 release): https://review.openstack.org/81078 References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0105 https://bugs.launchpad.net/bugs/1282865 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Mar 14 – 21)
by Stefano Maffulli 21 Mar '14

21 Mar '14

1 0