- OpenStack-announce - lists.openstack.org

[OSSA 2015-007] S3Token TLS cert verification option not honored (CVE-2015-1852)
by Tristan Cacqueray 14 Apr '15

14 Apr '15

=============================================================== OSSA-2015-007: S3Token TLS cert verification option not honored =============================================================== :Date: April 14, 2015 :CVE: CVE-2015-1852 Affects ~~~~~~~ - python-keystoneclient: versions through 1.3.0 - keystonemiddleware: versions through 1.5.0 Description ~~~~~~~~~~~ Brant Knudson from IBM reported a vulnerability in keystonemiddleware (formerly shipped as python-keystoneclient). When the 'insecure' option is set in a S3Token paste configuration file its value is effectively ignored and instead assumed to be true. As a result certificate verification will be disabled, leaving TLS connections open to MITM attacks. Note that it's unusual to explicitly add this option and then set it to false, so the impact of this bug is thought to be limited. All versions of s3_token middleware with TLS settings configured are affected by this flaw. Patches ~~~~~~~ - https://review.openstack.org/173378 (python-keystoneclient) (Icehouse) - https://review.openstack.org/173376 (keystonemiddleware) (Juno) - https://review.openstack.org/173377 (python-keystoneclient) (Juno) - https://review.openstack.org/173365 (keystonemiddleware) (Kilo) - https://review.openstack.org/173370 (python-keystoneclient) (Kilo) Credits ~~~~~~~ - Brant Knudson from IBM (CVE-2015-1852) References ~~~~~~~~~~ - https://launchpad.net/bugs/1411063 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1852 Notes ~~~~~ - This fix will be included in keystonemiddleware 1.6.0 release and python-keystoneclient 1.4.0 release. -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OSSA 2015-006] Unauthorized delete of versioned Swift object (CVE-2015-1856)
by Tristan Cacqueray 14 Apr '15

14 Apr '15

============================================================ OSSA-2015-006: Unauthorized delete of versioned Swift object ============================================================ :Date: April 14, 2015 :CVE: CVE-2015-1856 Affects ~~~~~~~ - Swift: versions through 2.2.2 Description ~~~~~~~~~~~ Clay Gerrard from SwiftStack reported a vulnerability in Swift object versioning. An authenticated user can delete the most recent version of any versioned object whose name is known if the user have listing access to the x-versions-location container. Only Swift setups with allow_version setting are affected. Patches ~~~~~~~ - https://review.openstack.org/173366 (Icehouse) - https://review.openstack.org/173363 (Juno) - https://review.openstack.org/173361 (Kilo) Credits ~~~~~~~ - Clay Gerrard from SwiftStack (CVE-2015-1856) References ~~~~~~~~~~ - https://launchpad.net/bugs/1430645 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1856 Notes ~~~~~ - This fix will be included in the upcoming 2.3.0 release. -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack 2014.2.3 released
by Adam Gandelman 13 Apr '15

13 Apr '15

Hello everyone, The OpenStack Stable Maintenance team is happy to announce the release of the 2014.2.3 stable Juno release. We have been busy reviewing and accepting backported bugfixes to the stable/juno branches according to the criteria set at: https://wiki.openstack.org/wiki/StableBranch A total of 109 bugs have been fixed across all projects. These updates to Juno are intended to be low risk with no intentional regressions or API changes. The list of bugs, tarballs and other milestone information for each project may be found on Launchpad: https://launchpad.net/ceilometer/juno/2014.2.3 https://launchpad.net/cinder/juno/2014.2.3 https://launchpad.net/glance/juno/2014.2.3 https://launchpad.net/heat/juno/2014.2.3 https://launchpad.net/horizon/juno/2014.2.3 https://launchpad.net/keystone/juno/2014.2.3 https://launchpad.net/nova/juno/2014.2.3 https://launchpad.net/neutron/juno/2014.2.3 https://launchpad.net/trove/juno/2014.2.3 Release notes may be found on the wiki: https://wiki.openstack.org/wiki/ReleaseNotes/2014.2.3 The freeze on the stable/juno branches will be lifted today as we begin working toward the 2014.2.4 release. Thanks, Adam

1 0

OpenStack Community Weekly Newsletter (Apr 3 - 10)
by Stefano Maffulli 10 Apr '15

10 Apr '15

Making your list and checking it twice for the OpenStack Vancouver Summit Emily Hugenbruch shared her pre-summit checklists: great tips there. OVN and OpenStack Integration Development Update The Open vSwitch project announced the OVN effort back in January and Russell Bryant started to look into it. He reports about OVN, calling it “a promising open source backend for OpenStack Neutron”. OpenStack in the classroom Amrith Kumar announced an effort to work with educational institutions in Massachusetts and near Toronto (where Tesora has offices) to try and make available a course on cloud computing with OpenStack as the exemplar system. OpenStack In The Enterprise A new mini-portal on openstack.org website to discover use cases and white papers from the enterprise world. The Road to Vancouver * Sign up for OpenStack Upstream Training in Vancouver * Canada Visa Information * Official Hotel Room Blocks * 2015 OpenStack T-Shirt Design Contest * Preparation to Design summit * Liberty Design Summit - Proposed slot allocation * What's a Design Summit? There is still room for Upstream Training Relevant Conversations * PTL Voting is now open * Kilo stable branches for "other" libraries * The Evolution of core developer to maintainer? * The Core Deficiency * Implementation of Pacemaker Managed OpenStack VM Recovery * Neutron Kilo Retrospective and a Look Toward Liberty * [Neutron] The specs process, effective operators feedback and product management Deadlines and Development Priorities * [Nova] Identifying release critical bugs in Kilo * [Cinder] Bug Triage - Call for Participation * [Nova] Liberty specs are now open and [Nova] Trunk is now Liberty * [neutron] Liberty Specs are now open! Security Advisories and Notices * None Tips ‘n Tricks * By Adam Young: Horizon WebSSO via SSSD * By Assaf Muller: Multinode DVR Devstack * By Alessandro Pilotti: VirtualBox driver for OpenStack Upcoming Events * Apr 13 - 14, 2015 OpenStack Live Santa Clara, CA, US * Apr 13 - 16, 2015 StackAttack! A HOLatCollaborate15 Las Vegas, NV, US * Apr 15, 2015 iX OpenStack Tag Köln, NRW, DE * Apr 15 - 16, 2015 1º Hangout OpenStack Brasil 2015 Brasil, BR * Apr 16 - 18, 2015 Open Cloud 2015 Beijing, Beijing, CN * Apr 16, 2015 8th OpenStack Meetup Stockholm Stockholm, SE * Apr 16, 2015 8th OpenStack User Group Nordics meetup Stockholm, SE * Apr 21 - 22, 2015 CONNECT 2015 Melbourne, Victoria, AU * Apr 22 - 23, 2015 China SDNNFV Conference Beijing, CN * Apr 22, 2015 OpenStack NYC Meetup New York, NY, US * Apr 23, 2015 OpenStack Philadelphia Meetup Philadelphia, PA, US * May 05 - 07, 2015 CeBIT AU 2015 Sydney, NSW, AU * May 18 - 22, 2015 OpenStack Summit May 2015 Vancouver, BC Other News * A community distribution of OpenStack * Why adopting OpenStack for dev/test matters * Gophercloud Update * Why OpenStack will change the way we live, work and play The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment.

1 0

OpenStack Community Weekly Newsletter (Mar 27 - Apr 3)
by Stefano Maffulli 03 Apr '15

03 Apr '15

Game changer: inside Adobe’s new Marketing Cloud architecture The Adobe Marketing Cloud powers software-as-a-service marketing for outfits such as the Los Angeles Kings, eBags and Verizon Wireless. When the IT infrastructure team in Adobe’s Digital Marketing group realized it was time for an evolutionary revamp, it turned to OpenStack and VMware to up its game. Nominations for OpenStack PTLs (Program Technical Leads) are now open Nominations for OpenStack PTLs (Program Technical Leads) are now open and will remain open until April 9, 2015 05:59 UTC. To announce your candidacy please start a new openstack-dev at lists.openstack.org mailing list thread with the program name as a tag, example [Glance] PTL Candidacy with the body as your announcement of intent. People who are not the candidate, please refrain from posting +1 to the candidate announcement posting. Additional information about the nomination process can be found on the wiki. Additions to OpenStack git namespace * Magnum is now in the openstack git namespace * [congress] is an openstack project The Road to Vancouver * Sign up for OpenStack Upstream Training in Vancouver * Canada Visa Information * Official Hotel Room Blocks * 2015 OpenStack T-Shirt Design Contest * Preparation to Design summit * Liberty Design Summit planning * [Nova] Tracking ideas for summit sessions * [QA] Tracking Ideas for Summit Sessions * [neutron] Design Summit Session etherpad Relevant Conversations * The Evolution of core developer to maintainer? * [Nova][Neutron] Status of the nova-network to Neutron migration work * "First App" Tutorial for OpenStack * [api] Erring is Caring: An API Working Group Guideline for Errors * "The Security Team" for OpenStack Deadlines and Development Priorities * [Nova] Identifying release critical bugs in Kilo * [neutron] FF and our march towards the RC * [cinder] Proposals for Liberty Summit * [Cinder] Bug Triage - Call for Participation * [sahara] Design summit proposals for Liberty Summit * [Nova] Liberty specs are now open * [neutron] Liberty Specs are now open! Security Advisories and Notices * None Tips ‘n Tricks * By Victoria Martínez de la Cruz: Creation of Trove-Compatible Images for RDO Reports from Previous Events * OpenStack QA Code Sprint in NYC * Best Practices and Considerations Deploying OpenStack In Production Upcoming Events * Apr 06 - 07, 2015 April Meetup: “I Can Haz Moar Networks?” w/Midokura & Cumulus Networks Morrisville, NC, US * Apr 07, 2015 April Sydney Meetup * Apr 08 - 16, 2015 PyCon 2015 Montreal, Quebec, CA * Apr 08 - 09, 2015 Software Defined Networks (SDN) & Linux Based Network OS (#20) Washington D.C., DC, US * Apr 09 - 10, 2015 Are you getting the most out of Cinder block storage in OpenStack? * Apr 09, 2015 OpenStack Howto part 1 - Install and Run Prague, CZ * Apr 13 - 14, 2015 OpenStack Live Santa Clara, CA, US * Apr 13 - 16, 2015 StackAttack! A HOLatCollaborate15 Las Vegas, NV, US * Apr 15, 2015 iX OpenStack Tag Köln, NRW, DE * Apr 15 - 16, 2015 1º Hangout OpenStack Brasil 2015 Brasil, BR * Apr 16 - 18, 2015 Open Cloud 2015 Beijing, Beijing, CN * Apr 16, 2015 8th OpenStack Meetup Stockholm Stockholm, SE * Apr 16, 2015 8th OpenStack User Group Nordics meetup Stockholm, SE * Apr 21 - 22, 2015 CONNECT 2015 Melbourne, Victoria, AU * Apr 22 - 23, 2015 China SDNNFV Conference Beijing, CN * Apr 22, 2015 OpenStack NYC Meetup New York, NY, US * Apr 23, 2015 OpenStack Philadelphia Meetup Philadelphia, PA, US * May 05 - 07, 2015 CeBIT AU 2015 Sydney, NSW, AU * May 18 - 22, 2015 OpenStack Summit May 2015 Vancouver, BC Other News * Parallels goes open source, wants OpenStack’s help to penetrate enterprise * Passion + community support = Success with OpenStack * python-barbicanclient 3.0.3 released * Million level scalability test report from cascading * What's Up Doc? Apr 2 2015 * [release] taskflow 0.8.1 * Call for testing: 2014.2.3 candidate tarballs The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment.

1 0

OpenStack Community Weekly Newsletter (Mar 20 - 27)
by Stefano Maffulli 27 Mar '15

27 Mar '15

OpenStack DefCore Process Draft Posted for Review [major milestone] OpenStack DefCore Committee is looking for community feedback about the proposed DefCore Process. March has been a month for OpenStack DefCore milestones. At the March Board meeting, the first official DefCore Guideline (called DefCore 2015.03) was approved. And the first DefCore Process draft is ready to be committed. 2015 OpenStack T-Shirt Design Contest It’s that time of year again and we’re looking for a new design to grace OpenStack’s T-Shirts. Here’s your chance to show us your creative talent and submit an original design for our 2015 OpenStack T-shirt Design Contest! The Road to Vancouver * Sign up for OpenStack Upstream Training in Vancouver * Canada Visa Information * Official Hotel Room Blocks * Next batch of invites to Kilo contributors will be sent after a new milestone is released Relevant Conversations * [Nova][Neutron] Status of the nova-network to Neutron migration work Deadlines and Development Priorities * [cinder] Deadline For Volume Drivers to Be Readded * [neutron] FF and our march towards the RC * Feature freeze + Kilo-3 development milestone available * [cinder] Proposals for Liberty Summit * [Cinder] Bug Triage - Call for Participation * [sahara] Design summit proposals for Liberty Summit * [oslo] must-fix bugs for final kilo releases * [Nova] Liberty specs are now open Security Advisories and Notices * Nova console Cross-Site WebSocket hijacking (CVE-2015-0259) Tips ‘n Tricks * By Belmiro Moreira: Nova quota usage - synchronization * By Anne Gentle: Male allies for women in tech: What’s needed? * By Sébastien Han: OpenStack: reserve memory on your hypervisors * By emoralesrh: SR-IOV Networking – Part II: Implementation Best Practices * By Tim Bell: Not all cores are created equal * By Sean Dague: OpenStack Emacs Tools * By Maish Saidel-Keesing: Installing OpenStack CLI clients on Mac OSX * By Adam Young: OpenStack keeps resetting my hostname * By Steve Martinelli: Checklist for performing OpenStack code reviews * By Adam Young: Troubleshooting Keystone in a New Install Reports from Previous Events * Scale & Maturity: Thoughts on the OpenStack Mid-Cycle Operators Meetup Upcoming Events OpenStack @ PyCon 2015: Booth info, looking for volunteers, posting of jobs, OpenStack presentations * Mar 31, 2015 Ceph Day Amsterdam Amsterdam, Netherlands, NL * Mar 31, 2015 OpenStack: fueled and containerized Rome, IT * Apr 01, 2015 OpenStack Meetup DFW Frisco, Texas, US * Apr 03 - 06, 2015 ISCC2015 Ariana, Ariana, TN * Apr 08 - 16, 2015 PyCon 2015 Montreal, Quebec, CA * Apr 13 - 14, 2015 OpenStack Live Santa Clara, CA, US * Apr 13 - 16, 2015 StackAttack! A HOLatCollaborate15 Las Vegas, NV, US * Apr 15, 2015 iX OpenStack Tag Köln, NRW, DE * Apr 16 - 18, 2015 Open Cloud 2015 Beijing, Beijing, CN * Apr 21 - 22, 2015 CONNECT 2015 Melbourne, Victoria, AU * Apr 22 - 23, 2015 China SDNNFV Conference Beijing, CN * Apr 22, 2015 OpenStack NYC Meetup New York, NY, US * Apr 23, 2015 OpenStack Philadelphia Meetup Philadelphia, PA, US * May 05 - 07, 2015 CeBIT AU 2015 Sydney, NSW, AU * May 18 - 22, 2015 OpenStack Summit May 2015 Vancouver, BC * Jun 11, 2015 OpenStack DACH Day 2015 Berlin, DE * Jul 20 - 24, 2015 OSCON 2015 Portland, OR, US * Aug 10 - 13, 2015 Gartner Catalyst Conference San Diego, CA, US * Sep 17, 2015 OpenStack Benelux Conference 2015 Bussum, NL * Oct 04 - 08, 2015 Gartner SymposiumITxpo Orlando, FL, US * Nov 15 - 20, 2015 Supercomputing 15 Austin, TX, US Other News * Interview with Doug Hellmann, OpenStack Contributor and Technical Committee Member * As Paypal.com approaches 100 percent OpenStack, the private cloud is here to stay * Why OpenStack is different from other open source projects * OpenStack at 10: different code, same collaboration? The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment.

1 0

OpenStack Community Weekly Newsletter (Mar 13 - 20)
by Stefano Maffulli 20 Mar '15

20 Mar '15

Feature freeze + Kilo-3 development milestone available We just hit Feature Freeze, so please do not approve changes that add features or new configuration options unless those have been granted a feature freeze exception. This is also String Freeze, so you should avoid changing translatable strings. If you have to modify a translatable string, you should give a heads-up to the I18N team. Finally, this is also DepFreeze so you should avoid adding new dependencies (bumping oslo or openstack client libraries is OK until RC1). If you have a new dependency to add, raise a thread on openstack-dev about it. The kilo-3 development milestone was tagged, it contains more than 200 features and 825 bugfixes added since the kilo-2 milestone 6 weeks ago. More details on the full announcement. The joy of contributing to OpenStack Contributing to OpenStack doesn’t have to be painful. To ease these pain points, OpenStack developed free upstream training.. You can sign up for the next one by May 2. Another nice reading on the topic is Why your first OpenStack commit will always be the hardest, the interview with Susanne Balle, distinguished technologist with HP Cloud working on platform services. Leveraging OpenStackClient as your unified command line interface OpenStackClient v1.0.3 was released last week and this release includes a large number of feature requests and bug fixes. But the even more exciting news is that the OpenStack Technical Committee voted in favor to include OpenStackClient as part of it’s list of official projects! The newly integrated OpenStackClient project will include python-openstackclient, cliff and os-client-config. Handling High Email Volume with sup Over the last year, the openstack-dev mailing list has averaged 2500 messages every month. Staying on top of that much email can be challenging, especially with some of the consumer-grade email clients available today. Doug Hellmann recently upgraded his email setup to use sup, a terminal-based mail client. He says the switch helped him process the mailing list, and even keep up with gerrit at the same time. Sounds too good to be true to me. What do you think? The Road to Vancouver * Sign up for OpenStack Upstream Training in Vancouver * Deadline for Superuser Awards: March 22 * Vancouver Summit Sponsorships Now Available * Canada Visa Information * Official Hotel Room Blocks * Next batch of invites to Kilo contributors will be sent after a new milestone is released Relevant Conversations * if by "archived" you mean, "wipes out your tables completely", then sure, it works fine * Example configs * Capability Discovery API Deadlines and Development Priorities * Feature freeze + Kilo-3 development milestone available * [cinder] Proposals for Liberty Summit * [Cinder] Bug Triage - Call for Participation * [sahara] Design summit proposals for Liberty Summit * [oslo] must-fix bugs for final kilo releases * [Nova] Liberty specs are now open * Gerrit downtime on 2015-03-21 Security Advisories and Notices * None Tips ‘n Tricks * By Kashyap Chamarthy: Minimal DevStack with OpenStack Neutron networking * By CaptainKVM: Custom Cloud Images for OpenStack pt1 * By Ben Nemec: QuintupleO Success! * By Sébastien Han: OpenStack Glance NFS and Compute local direct fetch Upcoming Events OpenStack @ PyCon 2015: Booth info, looking for volunteers, posting of jobs, OpenStack presentations * Mar 22 - 23, 2015 OpenStack Workshop, Pune, Bangalore, Karnataka, IN * Mar 22 - 23, 2015 OpenStack Workshop at SICSR, Pune * Mar 24, 2015 OpenStack Malaysia 2nd Meetup Damansara, Kuala Lumpur, MY * Mar 26, 2015 PDX OpenStack Hackathon Portland, OR, US * Mar 26, 2015 #CloudBeerStockholm Stockholm, SE * Mar 26, 2015 OpenStack L.A. March Meetup Pasadena, CA, US * Mar 31, 2015 Ceph Day Amsterdam Amsterdam, Netherlands, NL * Mar 31, 2015 OpenStack: fueled and containerized Rome, IT * Apr 01, 2015 OpenStack Meetup DFW Frisco, Texas, US * Apr 03 - 06, 2015 ISCC2015 Ariana, Ariana, TN * Apr 08 - 16, 2015 PyCon 2015 Montreal, Quebec, CA * Apr 13 - 14, 2015 OpenStack Live Santa Clara, CA, US * Apr 13 - 16, 2015 StackAttack! A HOLatCollaborate15 Las Vegas, NV, US * Apr 15, 2015 iX OpenStack Tag Köln, NRW, DE * Apr 16 - 18, 2015 Open Cloud 2015 Beijing, Beijing, CN * Apr 21 - 22, 2015 CONNECT 2015 Melbourne, Victoria, AU * Apr 22 - 23, 2015 China SDNNFV Conference Beijing, CN * Apr 22, 2015 OpenStack NYC Meetup New York, NY, US * Apr 23, 2015 OpenStack Philadelphia Meetup Philadelphia, PA, US * May 05 - 07, 2015 CeBIT AU 2015 Sydney, NSW, AU * May 18 - 22, 2015 OpenStack Summit May 2015 Vancouver, BC * Jun 11, 2015 OpenStack DACH Day 2015 Berlin, DE * Jul 20 - 24, 2015 OSCON 2015 Portland, OR, US * Aug 10 - 13, 2015 Gartner Catalyst Conference San Diego, CA, US * Sep 17, 2015 OpenStack Benelux Conference 2015 Bussum, NL * Oct 04 - 08, 2015 Gartner SymposiumITxpo Orlando, FL, US * Nov 15 - 20, 2015 Supercomputing 15 Austin, TX, US Other News * QuintupleO Demo Video * What’s Going On With Heat-Translator * Meet AVOS: the analytics dashboard for your OpenStack cloud * QEMU QCow2 built-in encryption: just say no. Deprecated now, to be deleted soon * [Ceilometer] Gnocchi 1.0.0a1 released * [Ironic] Announcing Bifrost Got Answers? Ask OpenStack is the go-to destination for OpenStack users. Interesting questions waiting for answers: * is there planned support for destination ip as a load balancing method? * Network connection leak in Keystone? * read failed with input/output error on VolGroup * How to use Opendaylight loadbalance app in OpenStack Neutron Lbaas? * JJB looking for the postbuilders(maven project) config to set "Run only if build succeeds" * Rally throwing errors for heat testing. * Inserting additional status entries into nova.instance_actions? The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment.

1 0

Feature freeze + Kilo-3 development milestone available
by Thierry Carrez 20 Mar '15

20 Mar '15

Hi everyone, We just hit feature freeze[1], so please do not approve changes that add features or new configuration options unless those have been granted a feature freeze exception. This is also string freeze[2], so you should avoid changing translatable strings. If you have to modify a translatable string, you should give a heads-up to the I18N team. Finally, this is also DepFreeze[3], so you should avoid adding new dependencies (bumping oslo or openstack client libraries is OK until RC1). If you have a new dependency to add, raise a thread on openstack-dev about it. The kilo-3 development milestone was tagged, it contains more than 200 features and 825 bugfixes added since the kilo-2 milestone 6 weeks ago (not even counting the Oslo libraries in the mix !). You can find the full list of new features and fixed bugs, as well as tarball downloads, at: https://launchpad.net/keystone/kilo/kilo-3 https://launchpad.net/glance/kilo/kilo-3 https://launchpad.net/nova/kilo/kilo-3 https://launchpad.net/horizon/kilo/kilo-3 https://launchpad.net/neutron/kilo/kilo-3 https://launchpad.net/cinder/kilo/kilo-3 https://launchpad.net/ceilometer/kilo/kilo-3 https://launchpad.net/heat/kilo/kilo-3 https://launchpad.net/trove/kilo/kilo-3 https://launchpad.net/sahara/kilo/kilo-3 https://launchpad.net/ironic/kilo/kilo-3 Congrats to all the PTLs and release management liaisons who made us reach this important milestone in the Kilo development cycle ! Regards, [1] https://wiki.openstack.org/wiki/FeatureFreeze [2] https://wiki.openstack.org/wiki/StringFreeze [3] https://wiki.openstack.org/wiki/DepFreeze Regards, -- Thierry Carrez (ttx)

1 0

OpenStack Community Weekly Newsletter (Mar 6 - 13)
by Stefano Maffulli 13 Mar '15

13 Mar '15

Five years in: Charting the OpenStack galaxy The Starship Enterprise had a five year mission, to "explore strange new worlds," among other things, and as we approach the five year mark in our own mission, it's fun to think about the worlds we've seen and contemplate where to go next. Did anyone think we'd have a non-profit foundation in year three, with VMware joining right after we started it? Strange new worlds, indeed. Check out what's under the hood at TryStack Billed as the easiest way to try out OpenStack, this free service lets you test what the cloud can do for you, offering networking, storage, and compute instances, without having to go all in with your own hardware. Dan Radez, whose day job is at Red Hat, unveiled TryStack’s new gear in a lightning show-and-tell talk at the recent Mid-Cycle Ops Meetup. The Road to Vancouver * Sign up for OpenStack Upstream Training in Vancouver * Superuser Awards Nominations Now Open * Vancouver Summit Sponsorships Now Available * Canada Visa Information * Official Hotel Room Blocks * Next batch of invites to Kilo contributors will be sent after a new milestone is released Relevant Conversations * Call for mentors - Upstream Training, Outreachy (former OPW) * Stepping out of the way * readout from Philly Operators Meetup * Avoiding regression in project governance * Microversions. And why do we need API extensions for new API functionality? Deadlines and Development Priorities * [nova] Kilo FeatureFreeze is March 19th, FeatureProposalFreeze has happened * [cinder] Kilo Deadlines need to have a CI by end of K-3, March 19th 2015 * [cinder] Proposals for Liberty Summit * [sahara] Design summit proposals for Liberty Summit * [oslo] must-fix bugs for final kilo releases * Log Working Group priorities Security Advisories and Notices * Nova console Cross-Site WebSocket hijacking (CVE-2015-0259) * [OSSN 0045] Vulnerable clients allow a TLS protocol downgrade (FREAK) Reports from Previous Events * March 2 Board of Directors Meeting * OpenStack Mid-Cycle meetup, day one roundup * OpenStack Mid-Cycle meetup, day two roundup * Takeaways from OpenStack’s Mid-Cycle Ops Meetup: A little more conversation, a little more action * [horizon] Kilo angular virtual sprint Tips ‘n Tricks * By Lars Kellogg-Stedman: Diagnosing problems with an OpenStack deployment * By Doug Hellmann: Deploying Nested ZNC Services with Ansible * By Gabriel Samfira: Windows + Open Compute + MAAS = ♥ * By Matthias Runge: Testing Horizon git snapshots * By Russell Bryant: The Different Facets of OpenStack HA * By Emilien Macchi: Writing a new OpenStack Puppet module Upcoming Events OpenStack @ PyCon 2015: Booth info, looking for volunteers, posting of jobs, OpenStack presentations * Mar 14, 2015 Meetup event in Intel * Mar 16 - 17, 2015 OpenStack Workshop ,Bangalore, Karnataka, IN * Mar 16 - 17, 2015 OpenStack Workshop at PESIT * Mar 17, 2015 OpenStack Munich Meetup Munich, Bavaria, DE * Mar 17, 2015 Disrupting Vendor Clouds Stanford, CA, US * Mar 17, 2015 HP Helion Technical Session Boston, MA, US * Mar 17, 2015 OpenStack München Meetup – Lets talk about Storage * Mar 18 - 19, 2015 Introduction to OpenDaylight: Current Events and OpenStack Neutron Integration * Mar 19 - 20, 2015 Keystone and External Authentication Implementation * Mar 19 - 20, 2015 OpenStack Baltimore Meetup #3 * Mar 19 - 20, 2015 OpenStack networking - Neutron deep dive with PLUMgrid * Mar 20 - 21, 2015 March Sydney Hackathon - Tentative Date * Mar 20, 2015 SFBay OpenStack Hackathon #OSSFO * Mar 22 - 23, 2015 OpenStack Workshop, Pune, Bangalore, Karnataka, IN * Mar 22 - 23, 2015 OpenStack Workshop at SICSR, Pune * Mar 24, 2015 OpenStack Malaysia 2nd Meetup Damansara, Kuala Lumpur, MY * Mar 26, 2015 PDX OpenStack Hackathon Portland, OR, US * Mar 26, 2015 #CloudBeerStockholm Stockholm, SE * Mar 26, 2015 OpenStack L.A. March Meetup Pasadena, CA, US * Mar 31, 2015 Ceph Day Amsterdam Amsterdam, Netherlands, NL * Mar 31, 2015 OpenStack: fueled and containerized Rome, IT * Apr 01, 2015 OpenStack Meetup DFW Frisco, Texas, US * Apr 03 - 06, 2015 ISCC2015 Ariana, Ariana, TN * Apr 08 - 16, 2015 PyCon 2015 Montreal, Quebec, CA * Apr 13 - 14, 2015 OpenStack Live Santa Clara, CA, US * Apr 13 - 16, 2015 StackAttack! A HOLatCollaborate15 Las Vegas, NV, US * Apr 15, 2015 iX OpenStack Tag Köln, NRW, DE * Apr 16 - 18, 2015 Open Cloud 2015 Beijing, Beijing, CN * Apr 21 - 22, 2015 CONNECT 2015 Melbourne, Victoria, AU * Apr 22 - 23, 2015 China SDNNFV Conference Beijing, CN * Apr 22, 2015 OpenStack NYC Meetup New York, NY, US * Apr 23, 2015 OpenStack Philadelphia Meetup Philadelphia, PA, US * May 05 - 07, 2015 CeBIT AU 2015 Sydney, NSW, AU * May 18 - 22, 2015 OpenStack Summit May 2015 Vancouver, BC * Jun 11, 2015 OpenStack DACH Day 2015 Berlin, DE * Jul 20 - 24, 2015 OSCON 2015 Portland, OR, US * Aug 10 - 13, 2015 Gartner Catalyst Conference San Diego, CA, US * Sep 17, 2015 OpenStack Benelux Conference 2015 Bussum, NL * Oct 04 - 08, 2015 Gartner SymposiumITxpo Orlando, FL, US * Nov 15 - 20, 2015 Supercomputing 15 Austin, TX, US Other News * OpenStack 2014.1.4 released * glance_store release 0.1.12 * [OpenStackClient] OSC release 1.0.3 * Announcing Gertty 1.1.0 * Second Release of Magnum * Superuser Reader app for Android available now * Welcoming oslo.policy into the OpenStack Oslo family * Pass the Mic User Spotlight: Jeremy Stanley, OpenStack Infrastructure Team * OpenStack and the Balance Between Independence and Compatibility * How to Take the CI/CD Plunge or How I Learned to Stop Worrying and Love OpenStack — Q&A * Xen Project Now an Easy Option in OpenStack Got Answers? Ask OpenStack is the go-to destination for OpenStack users. Interesting questions waiting for answers: * I accidentally deleted nova-cert service. How can I rebuild it? * ImportError: No module named auth.identity * Ceilometer: How to get metrics from SDN controllers * Why the BufferedHttpResponse stops proceeding requests? * Why does Openstack Swift PUT requests are blocked by eventlet.green.httplib? * Using Openstack alarms The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment.

1 0

[OSSA 2015-005] Nova console Cross-Site WebSocket hijacking (CVE-2015-0259)
by Tristan Cacqueray 13 Mar '15

13 Mar '15

========================================================== OSSA-2015-005: Nova console Cross-Site WebSocket hijacking ========================================================== :Date: March 13, 2015 :CVE: CVE-2015-0259 Affects ~~~~~~~ - Nova: up to 2014.1.3 and 2014.2 versions up to 2014.2.2 Description ~~~~~~~~~~~ Brian Manifold from Cisco and Paul McMillan from Nebula reported a vulnerability in Nova console websocket. By tricking an authenticated user into visiting a malicious URL, a remote attacker or a man in the middle may exploit a cross-site-websocket-hijacking vulnerability resulting in potential hijack of consoles where the user is still logged in. Only Nova setups with vnc or spice enabled are affected. Patches ~~~~~~~ - https://review.openstack.org/163035 (Icehouse) - https://review.openstack.org/163034 (Juno) - https://review.openstack.org/163033 (Kilo) Credits ~~~~~~~ - Brian Manifold from Cisco (CVE-2015-0259) - Paul McMillan from Nebula (CVE-2015-0259) References ~~~~~~~~~~ - https://launchpad.net/bugs/1409142 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0259 Notes ~~~~~ - This fix is included in 2014.1.4 (icehouse) release and it will be included in the kilo-3 development milestone and in the future 2014.2.3 (juno) release. -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0