- OpenStack-announce - lists.openstack.org

OpenStack Pike is officially released!
by Thierry Carrez 30 Aug '17

30 Aug '17

Hello OpenStack community, I'm proud and excited to announce the final release for the components of OpenStack Pike, which concludes the 6-month Pike development cycle. You will find a complete list of all components, their latest versions, and links to individual project release notes documents listed on the OpenStack releases site: https://releases.openstack.org/pike/ Congratulations to everyone who has contributed to making this release a success. Pike saw contributions from more than 1800 individuals, bringing the total number of contributors to OpenStack since 2012 up to 6650. During the Pike cycle we merged an average of 220 changes per day, which makes OpenStack one of the most active software development project out there today. Our next development cycle, Queens, has already started. Project team members will meet in Denver starting on September 11 at the Project Teams Gathering to kickstart the work for the coming 6 months. I hope to see you there! Thanks, -- Thierry Carrez (ttx)

1 0

[OSSA-2017-004] federated user gets wrong role (CVE-2017-2673)
by Tristan Cacqueray 25 Apr '17

25 Apr '17

================================================================ OSSA-2017-004: Incorrect role assignment with federated Keystone ================================================================ :Date: April 25, 2017 :CVE: CVE-2017-2673 Affects ~~~~~~~ - Keystone: >=10.0.0 <=10.0.1, ==11.0.0 Description ~~~~~~~~~~~ Boris Bobrov from Mail.Ru reported a vulnerability in Keystone Federation. An authenticated user may receive all the roles assigned to the user's project regardless of the federation mapping when there are rules in which group-based assignments are not used. For example, by requesting an admin user to get a role in their project, the user may be granted the admin privileges for new scoped tokens. All setups using the Keystone federation without group based assignments rules are affected. Patches ~~~~~~~ - https://review.openstack.org/459713 (Newton) - https://review.openstack.org/459732 (Ocata) - https://review.openstack.org/459705 (Pike) Credits ~~~~~~~ - Boris Bobrov from Mail.Ru (CVE-2017-2673) References ~~~~~~~~~~ - https://launchpad.net/bugs/1677723 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2673 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[all][elections] Technical Committee Election Results
by Tristan Cacqueray 20 Apr '17

20 Apr '17

Please join me in congratulating the 7 newly elected members of the Technical Committe (TC). Chris Dent (cdent) Davanum Srinivas (dims) Dean Troyer (dtroyer) Flavio Percoco (flaper87) John Garbutt (johnthetubaguy) Sean McGinnis (smcginnis) Thierry Carrez (ttx) Full results: http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_072c4cd7ff0673b5 Election process details and results are also available here: https://governance.openstack.org/election/ Thank you to all of the candidates, having a good group of candidates helps engage the community in our democratic process. Thank you to all who voted and who encouraged others to vote. We need to ensure your voice is heard. Thank you for another great round. -Tristan

1 0

[OSSA-2017-003] XSS in Horizon federation mappings UI (CVE-2017-7400)
by Tristan Cacqueray 05 Apr '17

05 Apr '17

==================================================== OSSA-2017-003: XSS in Horizon federation mappings UI ==================================================== :Date: April 04, 2017 :CVE: CVE-2017-7400 Affects ~~~~~~~ - Horizon: >=9.0.0 <=9.1.1, >=10.0.0 <=10.0.2, ==11.0.0 Description ~~~~~~~~~~~ Eric Brown from VMware reported a vulnerability in Horizon. By creating a malicious federation mapping, an adminstrator may conduct a persistent XSS attack. All Horizon setups are affected. Patches ~~~~~~~ - https://review.openstack.org/442455 (Mitaka) - https://review.openstack.org/442454 (Newton) - https://review.openstack.org/442453 (Ocata) - https://review.openstack.org/442277 (Pike) Credits ~~~~~~~ - Eric Brown from VMware (CVE-2017-7400) References ~~~~~~~~~~ - https://launchpad.net/bugs/1667086 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7400 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OSSA-2017-002] Nova logs sensitive context from notification exceptions (CVE-2017-7214)
by Jeremy Stanley 23 Mar '17

23 Mar '17

======================================================================= OSSA-2017-002: Nova logs sensitive context from notification exceptions ======================================================================= :Date: March 23, 2017 :CVE: CVE-2017-7214 Affects ~~~~~~~ - Nova: >=13.0.0 <=13.1.3, >=14.0.0 <=14.0.4, >=15.0.0 <=15.0.1 Description ~~~~~~~~~~~ Matt Riedemann with Huawei reported a vulnerability in Nova. Legacy notification exception contexts appearing in ERROR level logs may include sensitive information such as account passwords and authorization tokens. All Nova setups are affected. Patches ~~~~~~~ - https://review.openstack.org/447075 (Mitaka) - https://review.openstack.org/447072 (Newton) - https://review.openstack.org/447071 (Ocata) - https://review.openstack.org/446948 (Pike) Credits ~~~~~~~ - Matt Riedemann from Huawei (CVE-2017-7214) References ~~~~~~~~~~ - https://launchpad.net/bugs/1673569 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7214 -- Jeremy Stanley OpenStack Vulnerability Management Team

1 0

OpenStack Ocata is officially released!
by Doug Hellmann 22 Feb '17

22 Feb '17

Hello OpenStack community, I'm overjoyed to announce the final releases for the components of OpenStack Ocata, which conclude the 4-month Ocata development cycle. You will find a complete list of the deliverables for the 33 services and ~190 other components and libraries that make up the Ocata release, their latest versions, and links to individual project release notes documents listed on the release site: https://releases.openstack.org/ocata/ Congratulations to all of the teams who have contributed to this release! Many thanks to our PTLs and release liaisons for their help with release coordination this cycle. Our next production cycle, Pike, has already started. We are back to our regular 6-month development cycle, and you can find details about the release schedule at: https://releases.openstack.org/pike/schedule.html We are currently meeting in Atlanta through February 24 for the Pike Project Team Gathering to plan the work for the upcoming cycle. I hope to see you here! Doug

1 0

Project Team Lead Election Conclusion and Results
by knelson＠openstack.org 08 Feb '17

08 Feb '17

Hello All! Thank you to the electorate, to all those who voted and to all candidates who put their name forward for Project Team Lead (PTL) in this election. A healthy, open process breeds trust in our decision making capability thank you to all those who make this process possible.Now for the results of the PTL election process, please join me in extending congratulations to the following PTLs! * Barbican : Dave McCowan * Chef OpenStack : Jan Klare * Cinder : Sean McGinnis * Cloudkitty : Christophe Sauthier * Community App Catalog : Matthew Wagoner * Congress : Eric K * Designate : Tim Simmons * Documentation : Alexandra Settle * Dragonflow : Omer Anson * Ec2 Api : Alexandre Levine * Freezer : Saad Zaher * Fuel : Vladimir Kuklin * Glance : Brian Rosmaita * Heat : Rico Lin * Horizon : Rob Cresswell * I18n : Ian Y. Choi * Infrastructure : Jeremy Stanley * Ironic : Dmitry Tantsur * Karbor : Yuval Brik * Keystone : Lance Bragstad * Kolla : Michal Jastrzebski * Kuryr : Antoni Segura Puimedon * Magnum : Adrian Otto * Manila : Ben Swartzlander * Mistral : Renat Akhmerov * Monasca : Roland Hochmuth * Murano : Felipe Monteiro * Neutron : Kevin Benton * Nova : Matt Riedemann * Octavia : Michael Johnson * OpenStackAnsible : Andy McCrae * OpenStackClient : Dean Troyer * OpenStack Charms : James Page * Oslo : ChangBo Guo * Packaging Deb : Thomas Goirand * Packaging Rpm : Igor Yozhikov * Puppet OpenStack : Alex Schultz * Quality Assurance : Andrea Frittoli * Rally : Andrey Kurilin * RefStack : Catherine Diep * Release Management : Thierry Carrez * Requirements : Tony Breeds * Sahara : Telles Mota Vidal Nóbrega * Searchlight : Steve McLellan * Security : Robert Clark * Senlin : Qiming Teng * Solum : Devdatta-kulkarni Devdatta-kulkarni * Stable Branch Maintenance : Tony Breeds * Storlets : Eran Rom * Swift : John Dickinson * Tacker : Gongysh Gongysh * Telemetry : Julien Danjou * Tricircle : Chaoyi Huang * Tripleo : Emilien Macchi * Trove : Amrith Amrith * Vitrage : Ifat Afek * Watcher : Alexander Chadin * Winstackers : Claudiu Belu * Zaqar : Fei Long Wang * Zun : Hongbin Lu Elections:* Ironic: [ http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_08ff4080d37365ba ]( http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_08ff4080d37365ba )* Keystone: [ http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_1d2eef76fdfc1ec4 ]( http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_1d2eef76fdfc1ec4 )* Neutron: [ http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_6df9c8e056680402 ]( http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_6df9c8e056680402 )* Quality_Assurance: [ http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_99413ba03ba1c6b3 ]( http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_99413ba03ba1c6b3 )* Stable_Branch_Maintenance: [ http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_b719c6a5a681033b ]( http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_b719c6a5a681033b )Election process details and results are also available here: [ https://governance.openstack.org/election/ ]( https://governance.openstack.org/election/ )Thank you to all involved in the PTL election process, -Kendall Nelson (diablo_rojo)

1 0

[OSSA-2017-001] CatchErrors leaks sensitive values in oslo.middleware (CVE-2017-2592)
by Jeremy Stanley 26 Jan '17

26 Jan '17

==================================================================== OSSA-2017-001: CatchErrors leaks sensitive values in oslo.middleware ==================================================================== :Date: January 26, 2017 :CVE: CVE-2017-2592 Affects ~~~~~~~ - Oslo.middleware: <=3.8.0, >=3.9.0 <=3.19.0, >=3.20.0 <=3.23.0 Description ~~~~~~~~~~~ Divya K Konoor with IBM reported a vulnerability in oslo.middleware. Software using the CatchError class may include sensitive values in the error message accompanying a Traceback, resulting in their disclosure. For example, complete API requests (including keystone tokens in their headers) may leak into neutron error logs. Patches ~~~~~~~ - https://review.openstack.org/425734 (Mitaka) - https://review.openstack.org/425732 (Newton) - https://review.openstack.org/425730 (Ocata) Credits ~~~~~~~ - Divya K Konoor from IBM (CVE-2017-2592) References ~~~~~~~~~~ - https://launchpad.net/bugs/1628031 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2592 -- Jeremy Stanley

1 0

[new][openstackclient] python-openstackclient 3.4.1 release (ocata)
by no-reply＠openstack.org 20 Nov '16

20 Nov '16

We are satisfied to announce the release of: python-openstackclient 3.4.1: OpenStack Command-line Client This release is part of the ocata release series. The source is available from: https://git.openstack.org/cgit/openstack/python-openstackclient Download the package from: https://pypi.python.org/pypi/python-openstackclient Please report issues through launchpad: https://bugs.launchpad.net/python-openstackclient For more details, please see below. 3.4.1 ^^^^^ Bug Fixes * Fix "TypeError: __init__() got an unexpected keyword argument 'project_domain_id'" error with non-password authentication types. [Bug 1642301 (https://bugs.launchpad.net/bugs/1642301)] Changes in python-openstackclient 3.4.0..3.4.1 ---------------------------------------------- 61cc546 Add relnote for release 3.4.1 e51a8d6 Use project_domain_id only in password auth Diffstat (except docs and test files) ------------------------------------- openstackclient/common/client_config.py | 1 + releasenotes/notes/bug-1642301-18b08e0cd4b11687.yaml | 6 ++++++ 2 files changed, 7 insertions(+)

1 0

[new][puppet] puppet-openstack_extras 10.0.0 release (ocata)
by no-reply＠openstack.org 18 Nov '16

18 Nov '16

We are enthusiastic to announce the release of: puppet-openstack_extras 10.0.0: Puppet module for OpenStack Openstack_extras This release is part of the ocata release series. Download the package from: https://tarballs.openstack.org/puppet-openstack_extras/ For more details, please see below. 10.0.0 ^^^^^^ New Features ************ * With a new boolean called manage_virt, allow to whether or not activate RDO CentOS QEMU EV repository that is required when deploying OpenStack Newton with RDO packaging. It's enabled by default to make deployments working out of the box, but can be disabled. Other Notes *********** * Disable EPEL repository setup by default. Keep the boolean if users want it, but add a note that EPEL is not required when deploying OpenStack with RDO repositories. Changes in puppet-openstack_extras 9.4.0..10.0.0 ------------------------------------------------ f4614e7 Prepare 10.0.0 release 011896f Enable release notes translation 920f324 Changed the home-page to point Openstack Puppet Homepage 10401d6 Move rspec-puppet-facts to spec helper bec2257 repos: configure RDO Virtualization repository e361c88 repos: disable EPEL by default deef5b2 Update reno for stable/newton Diffstat (except docs and test files) ------------------------------------- files/RPM-GPG-KEY-CentOS-SIG-Virtualization | 20 +++++++++++++++ manifests/repo/redhat/redhat.pp | 30 ++++++++++++++++++++-- metadata.json | 2 +- .../notes/disable_epel-a07b06048465e7a1.yaml | 5 ++++ releasenotes/notes/rdo-virt-a9fb3681cbc8419e.yaml | 6 +++++ releasenotes/source/conf.py | 7 +++-- releasenotes/source/index.rst | 3 ++- releasenotes/source/newton.rst | 6 +++++ setup.cfg | 2 +- .../openstack_extras_repo_redhat_redhat_spec.rb | 28 ++++++++++++++++++++ spec/spec_helper.rb | 10 +------- 11 files changed, 103 insertions(+), 16 deletions(-)

1 0