- OpenStack-announce - lists.openstack.org

[OSSA 2015-020] Glance storage overrun (CVE-2015-5286)
by Tristan Cacqueray 02 Oct '15

02 Oct '15

===================================== OSSA-2015-020: Glance storage overrun ===================================== :Date: October 01, 2015 :CVE: CVE-2015-5286 Affects ~~~~~~~ - Glance: <=2014.2.3, >=2015.1.0, <=2015.1.1 Description ~~~~~~~~~~~ Mike Fedosin and Alexei Galkin from Mirantis reported a vulnerability in Glance. By deleting images that are being uploaded using a token that is about to expire, a malicious user can overcome the storage quota and accumulate untracked image data in the backend resulting in potential resource exhaustion and denial of service. All Glance setups using the V1 API are affected and all setups using the V2 API with the registry db_api enabled are affected. Patches ~~~~~~~ - https://review.openstack.org/229946 (Juno) - https://review.openstack.org/229975 (Juno) - https://review.openstack.org/229945 (Kilo) - https://review.openstack.org/229973 (Kilo) - https://review.openstack.org/230056 (Liberty) - https://review.openstack.org/229972 (Liberty) - https://review.openstack.org/229943 (Mitaka) - https://review.openstack.org/229971 (Mitaka) Credits ~~~~~~~ - Mike Fedosin from Mirantis (CVE-2015-5286) - Alexei Galkin from Mirantis (CVE-2015-5286) References ~~~~~~~~~~ - https://bugs.launchpad.net/bugs/1498163 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5286 Notes ~~~~~ - This fix will be included in future 2014.2.4 (juno) and 2015.1.2 (kilo) releases. -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[release] [ironic] [inspector] ironic-inspector release 2.2.1 (liberty)
by Dmitry Tantsur 02 Oct '15

02 Oct '15

We are chuffed to announce the release of: ironic-inspector 2.2.1: Hardware introspection for OpenStack Bare Metal With source available at: http://git.openstack.org/cgit/openstack/ironic-inspector For more details, please see the git log history below and: http://launchpad.net/ironic-inspector/+milestone/2.2.1 Please report issues through launchpad: http://bugs.launchpad.net/ironic-inspector This release fixes a critical issue with MySQL database as a backend: https://bugs.launchpad.net/bugs/1501746 Changes in ironic-inspector 2.2.0..2.2.1 ---------------------------------------- 17a72c3 Fix database schema for mysql and switch the gate to testing it afa0b49 Updated from global requirements 43ca598 Set default branch for stable/liberty Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + README.rst | 8 +++++--- devstack/plugin.sh | 6 ++---- ironic_inspector/db.py | 6 +++--- .../migrations/versions/578f84f38d_inital_db_schema.py | 6 +++--- requirements.txt | 2 +- 6 files changed, 15 insertions(+), 14 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 18d7b2a..e53d673 100644 --- a/requirements.txt +++ b/requirements.txt @@ -24 +24 @@ stevedore>=1.5.0 # Apache-2.0 -SQLAlchemy>=0.9.9,<1.1.0 +SQLAlchemy<1.1.0,>=0.9.9

1 0

[release][ironic] python-ironicclient release 0.9.0 (mitaka)
by doug＠doughellmann.com 01 Oct '15

01 Oct '15

We are content to announce the release of: python-ironicclient 0.9.0: OpenStack Bare Metal Provisioning API Client Library This release is part of the mitaka release series. With source available at: http://git.openstack.org/cgit/openstack/python-ironicclient With package available at: https://pypi.python.org/pypi/python-ironicclient For more details, please see the git log history below and: http://launchpad.net/python-ironicclient/+milestone/0.9.0 Please report issues through launchpad: http://bugs.launchpad.net/python-ironicclient Changes in python-ironicclient 0.8.1..0.9.0 ------------------------------------------- 824025b Use doc8 style checker 9aa761f Fix the bug of incorrect spelling 07fc85c Replace six.iteritems() with .items() f672ac3 Allow 'abort' verb for node-set-provision-state 5afd483 Set a default endpoint value of None 6618390 Updated from global requirements ec7b3b1 Added unit test cases for command-line shell a5a15e4 Introduce openstackclient plugin b8691d0 Updated from global requirements 1338cd3 Remove unneeded param['detail'] setting Diffstat (except docs and test files) ------------------------------------- ironicclient/common/http.py | 4 +- ironicclient/osc/__init__.py | 0 ironicclient/osc/client.py | 51 +++ ironicclient/osc/plugin.py | 70 +++ ironicclient/osc/v1/__init__.py | 0 ironicclient/osc/v1/baremetal.py | 319 ++++++++++++++ ironicclient/v1/node_shell.py | 17 +- requirements.txt | 4 +- setup.cfg | 11 + setup.py | 2 +- test-requirements.txt | 1 + tox.ini | 1 + 22 files changed, 1456 insertions(+), 18 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 7203d39..d0236f7 100644 --- a/requirements.txt +++ b/requirements.txt @@ -4 +4 @@ -pbr<2.0,>=1.6 +pbr>=1.6 @@ -7,0 +8 @@ dogpile.cache>=0.5.4 +cliff>=1.14.0 # Apache-2.0 @@ -13,0 +15 @@ python-keystoneclient>=1.6.0 +python-openstackclient>=1.5.0 diff --git a/test-requirements.txt b/test-requirements.txt index 169c959..67223b4 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -6,0 +7 @@ discover +doc8 # Apache-2.0

1 0

[release][openstack] os-client-config release 1.8.0 (mitaka)
by doug＠doughellmann.com 01 Oct '15

01 Oct '15

We are content to announce the release of: os-client-config 1.8.0: OpenStack Client Configuation Library This release is part of the mitaka release series. With package available at: https://pypi.python.org/pypi/os-client-config For more details, please see the git log history below. Notable changes ---------------- Bugfixes. Added SWITCHengines to vendor list. Properly handle OS_CLOUD and OS_REGION_NAME when mixing ansible and openstackclient. Changes in os-client-config 1.7.5..1.8.0 ---------------------------------------- d3c82ab Fix two typos 21ff307 Put in override for Rackspace broken neutron 7d84f10 Support passing force_ipv4 to the constructor 733c04f identity version is 2.0 723b893 Handle OS_CLOUD and OS_REGION_NAME friendly-like 79637b1 Added SWITCHengines vendor file 988e305 update RST for readme so pypi looks pretty 75954fa Add support for Catalyst as vendor Diffstat (except docs and test files) ------------------------------------- README.rst | 30 +++++++++++------- os_client_config/cloud_config.py | 10 ++++-- os_client_config/config.py | 47 +++++++++++++++++++++++------ os_client_config/defaults.yaml | 2 +- os_client_config/vendors/catalyst.yaml | 10 ++++++ os_client_config/vendors/rackspace.yaml | 1 + os_client_config/vendors/switchengines.yaml | 9 ++++++ 11 files changed, 132 insertions(+), 31 deletions(-)

1 0

[release][ironic] ironic-lib release 0.2.0 (mitaka)
by doug＠doughellmann.com 01 Oct '15

01 Oct '15

We are amped to announce the release of: ironic-lib 0.2.0: Ironic common library This release is part of the mitaka release series. With package available at: https://pypi.python.org/pypi/ironic-lib For more details, please see the git log history below. Changes in ironic-lib 0.1.0..0.2.0 ---------------------------------- cf73a8f Move to oslo.i18n 63f83cc Put py34 first in the env order of tox a66db84 Remove README.md and update README.rst 467c10d Update link for where to report bugs f163009 Remove execute permission from exception.py d7d3d03 Add a cover target to tox eb1277c Better optimize test runs fb520b1 Move tests/ under ironic_lib/, use ostestr 46a29ec Remove TODO 854ece3 Update setup.cfg 618ab03 Use standard locale when executing 'dd' command 3bb86b2 Updated from global requirements Diffstat (except docs and test files) ------------------------------------- CONTRIBUTING.rst | 2 +- README.md | 2 - README.rst | 5 + TODO.rst | 23 -- ironic_lib/common/__init__.py | 0 ironic_lib/common/i18n.py | 31 ++ ironic_lib/disk_partitioner.py | 4 +- ironic_lib/disk_utils.py | 15 +- ironic_lib/exception.py | 4 +- ironic_lib/utils.py | 6 +- requirements.txt | 3 +- setup.cfg | 3 +- setup.py | 2 +- test-requirements.txt | 2 +- tox.ini | 16 +- 24 files changed, 1052 insertions(+), 1030 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 2b1fb18..b21a88b 100644 --- a/requirements.txt +++ b/requirements.txt @@ -5 +5 @@ -pbr<2.0,>=1.6 +pbr>=1.6 @@ -11,0 +12 @@ oslo.config>=2.3.0 # Apache-2.0 +oslo.i18n>=1.5.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index e42aa2c..392154f 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -13 +12,0 @@ sphinx!=1.2.0,!=1.3b1,<1.3,>=1.1.2 -testrepository>=0.0.18 @@ -16,0 +16 @@ mox3>=0.7.0 +os-testr>=0.1.0

1 0

[release][stable][openstack] python-openstackclient release 1.7.1 (liberty)
by doug＠doughellmann.com 01 Oct '15

01 Oct '15

We are overjoyed to announce the release of: python-openstackclient 1.7.1: OpenStack Command-line Client This release is part of the liberty stable release series. With source available at: https://git.openstack.org/cgit/openstack/python-openstackclient With package available at: https://pypi.python.org/pypi/python-openstackclient For more details, please see the git log history below and: https://launchpad.net/python-openstackclient/+milestone/1.7.1 Please report issues through launchpad: https://bugs.launchpad.net/python-openstackclient Changes in python-openstackclient 1.7.0..1.7.1 ---------------------------------------------- 599905e Release notes 1.7.1 0e89d08 docs: pip install -e needs an argument 8faabb3 Glance `image set` Resolve Fracturing 9e6f99e Use `discover_extensions` for novaclient 00eebaf Override the debug default and help text Diffstat (except docs and test files) ------------------------------------- openstackclient/compute/client.py | 10 ++--- openstackclient/image/v2/image.py | 64 +++++++++++++++++++++++++--- openstackclient/shell.py | 4 ++ 7 files changed, 132 insertions(+), 17 deletions(-)

1 0

[release][nova] python-novaclient release 2.31.0 (mitaka)
by davanum＠gmail.com 01 Oct '15

01 Oct '15

We are thrilled to announce the release of: python-novaclient 2.31.0: Client library for OpenStack Compute API This release is part of the mitaka release series. With source available at: http://git.openstack.org/cgit/openstack/python-novaclient With package available at: https://pypi.python.org/pypi/python-novaclient For more details, please see the git log history below and: http://launchpad.net/python-novaclient/+milestone/2.31.0 Please report issues through launchpad: http://bugs.launchpad.net/python-novaclient Changes in python-novaclient 2.30.0..2.31.0 ------------------------------------------- abd0630 Always send volume_id when booting with legacy bdm 3350a57 Change default service_type for volumes managers 0455932 Split functional tests for legacy(V2.1) and microversions 2793331 Specify api_version for functional tests 3e99d3f Improve help strings Diffstat (except docs and test files) ------------------------------------- novaclient/base.py | 17 +- novaclient/shell.py | 16 +- .../functional/v2/legacy/test_readonly_nova.py | 191 ++++++++++++++++++++ novaclient/v2/shell.py | 200 +++++++++++---------- novaclient/v2/volume_snapshots.py | 13 +- novaclient/v2/volume_types.py | 12 +- novaclient/v2/volumes.py | 12 +- 32 files changed, 1060 insertions(+), 844 deletions(-)

1 0

[release][stable][nova] python-novaclient release 2.30.1 (liberty)
by davanum＠gmail.com 01 Oct '15

01 Oct '15

We are eager to announce the release of: python-novaclient 2.30.1: Client library for OpenStack Compute API This release is part of the liberty stable release series. With source available at: http://git.openstack.org/cgit/openstack/python-novaclient With package available at: https://pypi.python.org/pypi/python-novaclient For more details, please see the git log history below and: http://launchpad.net/python-novaclient/+milestone/2.30.1 Please report issues through launchpad: http://bugs.launchpad.net/python-novaclient Changes in python-novaclient 2.30.0..2.30.1 ------------------------------------------- 3424bc6 Always send volume_id when booting with legacy bdm 0afb131 Update .gitreview for stable/liberty Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + novaclient/base.py | 4 +++- 3 files changed, 24 insertions(+), 4 deletions(-)

1 0

[release][stable][sahara] python-saharaclient release 0.11.1 (liberty)
by Sergey Lukjanov 28 Sep '15

28 Sep '15

We are eager to announce the release of: python-saharaclient 0.11.1: Client library for Sahara API This release is part of the liberty stable release series. With source available at: http://git.openstack.org/cgit/openstack/python-saharaclient With package available at: https://pypi.python.org/pypi/python-saharaclient For more details, please see the git log history below and: http://launchpad.net/python-saharaclient/+milestone/0.11.1 Please report issues through launchpad: http://bugs.launchpad.net/python-saharaclient Changes in python-saharaclient 0.11.0..0.11.1 --------------------------------------------- 52b1c1d Updating saharaclient api docs 7240b0e Updated from global requirements 2646595 Change ignore-errors to ignore_errors 660dc7b Fixing cluster and node group template updates da1d4cb Remove `data source update` from setup.cfg bd35e41 Adding missed public/protected support for jobs creation cc9123d Fix functional tests in saharaclient 1421609 Update .gitreview for stable/liberty Diffstat (except docs and test files) ------------------------------------- .coveragerc | 2 +- .gitreview | 1 + requirements.txt | 2 +- saharaclient/api/cluster_templates.py | 51 ++++++------ saharaclient/api/jobs.py | 7 +- saharaclient/api/node_group_templates.py | 72 +++++++---------- setup.cfg | 1 - setup.py | 2 +- test-requirements.txt | 6 +- 12 files changed, 115 insertions(+), 125 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index dd734cb..d6629e9 100644 --- a/requirements.txt +++ b/requirements.txt @@ -5 +5 @@ -pbr<2.0,>=1.6 +pbr>=1.6 diff --git a/test-requirements.txt b/test-requirements.txt index 0158543..1f0b3da 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -12,2 +12,2 @@ oslosphinx>=2.5.0 # Apache-2.0 -python-neutronclient<3,>=2.6.0 -python-novaclient>=2.26.0 +python-neutronclient>=2.6.0 +python-novaclient>=2.28.1 @@ -17 +17 @@ sphinx!=1.2.0,!=1.3b1,<1.3,>=1.1.2 -tempest-lib>=0.6.1 +tempest-lib>=0.8.0

1 0

[release] [ironic] [inspector] ironic-inspector release 2.2.0 (liberty)
by Dmitry Tantsur 28 Sep '15

28 Sep '15

We are content to announce the release of: ironic-inspector 2.2.0: Hardware introspection for OpenStack Bare Metal With source available at: http://git.openstack.org/cgit/openstack/ironic-inspector This release introduced database migrations, be sure to initialize the database schema version: https://github.com/openstack/ironic-inspector#managing-the-ironic-inspector… Highlights of the release: * Hook interface changed to move away from returning patches to just calling ironic to apply changes * API to expose introspection data * User-settable introspection rules * Root device hints * Support for ironic-python-agent * Support for Alembic and rootwrap For more details, please see the git log history below and: http://launchpad.net/ironic-inspector/+milestone/2.2.0 Please report issues through launchpad: http://bugs.launchpad.net/ironic-inspector Changes in ironic-inspector 2.1.0..2.2.0 ---------------------------------------- b57cf89 Add troubleshooting section for Ubuntu DNS issues 7b7130a Add a warning about sudoers file 92a8550 Add explicit dependencies on Alembic and SA 5552d0d Update README with extra_hardware plugin changes bef7617 Don't rely on dict ordering in test_plugins_standard 8d0a04d Fix rootwrap configuration documentation 6a2bd8e devstack: allow nodes to be already MANAGEABLE in exercise db7865a Updated from global requirements aa3b8ba Add alembic migrations for the inspector database 52ef561 Use rootwrap to execute iptables instead of requiring root dc8d2fa Support IPA in raid_device plugin 973dd16 Convert eDeploy data so that rules can process it ad788cf Stop recommending using DIB from source 8f7f889 Allow empty lookup attributes if node_not_found_hook is provided de2108d Switch to using CLI for introspection rules 6c686e8 Add missing plugins for introspection rules 6d06f09 Ignore IPMI Address for IPMI Bridged nodes 0defa89 Updated from global requirements 8fc9f7a Replace glance and keystone commands with OSC equivalents 13b11c8 Smart root disk selection including support for root device hints d5f0817 Add API Discovery to Ironic Inspector 9d95e05 Add mock for check_call to all firewall tests b338739 Updated from global requirements 105aa64 Deprecate returning patches from plugins eb9b3da Add introspection rules support 1bdf87c Add instructions how to try IPA as a ramdisk f21eb0a Stop using configuration options in top level code 7b3ed65 Split standard plugin tests from other processing tests 5b02639 Move update functions to NodeInfo object 4aedc45 Enable colorized logging in devstack plugin 676a581 Revisit required provision states 22c670a Updated from global requirements d7447b3 Add logging to introspection data storage 5831723 Make list of ipmi_address-alike driver fields configurable f02540a Fix logic for internal server error 3f7054e Pass -w flag to iptables to make it wait for xtables lock 6eb9f58 Store and expose introspection data c0ffce0 Updated from global requirements 7343cad Rename plugin root_device_hint -> raid_device 2ab0770 Clean up README 0d11309 Fail introspection early if no lookup attributes can be detected d456bbb Updated from global requirements 535d1d1 Mock socket in test_bad_hostname_errors 61b78a8 Copy gitignore from ironic 661e818 Updated from global requirements 38ee234 Add func3 tox environment for functional testing with Python 3. Diffstat (except docs and test files) ------------------------------------- .gitignore | 40 +- CONTRIBUTING.rst | 92 ++++- HTTP-API.rst | 120 ++++++ README.rst | 331 ++++++++++++---- devstack/exercise.sh | 78 +++- devstack/plugin.sh | 39 +- example.conf | 32 +- ironic_inspector/alembic.ini | 38 ++ ironic_inspector/common/swift.py | 54 +++ ironic_inspector/conf.py | 29 +- ironic_inspector/db.py | 55 ++- ironic_inspector/dbsync.py | 90 +++++ ironic_inspector/firewall.py | 23 +- ironic_inspector/introspect.py | 24 +- ironic_inspector/main.py | 132 ++++++- ironic_inspector/migrations/env.py | 82 ++++ ironic_inspector/migrations/script.py.mako | 36 ++ .../versions/578f84f38d_inital_db_schema.py | 63 ++++ .../migrations/versions/d588418040d_add_rules.py | 64 ++++ ironic_inspector/node_cache.py | 154 +++++++- ironic_inspector/plugins/base.py | 137 +++++-- ironic_inspector/plugins/example.py | 11 +- ironic_inspector/plugins/extra_hardware.py | 52 ++- ironic_inspector/plugins/raid_device.py | 100 +++++ ironic_inspector/plugins/root_device_hint.py | 94 ----- ironic_inspector/plugins/rules.py | 140 +++++++ ironic_inspector/plugins/standard.py | 89 ++++- ironic_inspector/process.py | 63 ++-- ironic_inspector/rules.py | 381 +++++++++++++++++++ ironic_inspector/test/base.py | 15 + ironic_inspector/test/functional.py | 212 ++++++++++- ironic_inspector/test/test_firewall.py | 47 ++- ironic_inspector/test/test_introspect.py | 115 +++++- ironic_inspector/test/test_main.py | 196 +++++++++- ironic_inspector/test/test_node_cache.py | 158 +++++++- ironic_inspector/test/test_plugins_base.py | 44 +++ .../test/test_plugins_extra_hardware.py | 79 ++-- ironic_inspector/test/test_plugins_raid_device.py | 132 +++++++ .../test/test_plugins_root_device_hint.py | 103 ----- ironic_inspector/test/test_plugins_rules.py | 216 +++++++++++ ironic_inspector/test/test_plugins_standard.py | 284 ++++++++++++++ ironic_inspector/test/test_process.py | 244 +++--------- ironic_inspector/test/test_rules.py | 420 +++++++++++++++++++++ ironic_inspector/test/test_swift.py | 78 +++- ironic_inspector/test/test_utils.py | 37 +- ironic_inspector/utils.py | 41 +- plugin-requirements.txt | 2 - requirements.txt | 17 +- rootwrap.conf | 27 ++ rootwrap.d/ironic-inspector-firewall.filters | 6 + setup.cfg | 23 +- setup.py | 2 +- tox.ini | 5 + 53 files changed, 4408 insertions(+), 738 deletions(-) Requirements updates -------------------- diff --git a/plugin-requirements.txt b/plugin-requirements.txt index 9dc610c..e69de29 100644 --- a/plugin-requirements.txt +++ b/plugin-requirements.txt @@ -1,2 +0,0 @@ -# required for extra_hardware plugin -python-swiftclient>=2.2.0 diff --git a/requirements.txt b/requirements.txt index eac89f8..18d7b2a 100644 --- a/requirements.txt +++ b/requirements.txt @@ -3,0 +4 @@ +alembic>=0.8.0 @@ -6,0 +8,2 @@ Flask<1.0,>=0.10 +jsonpath-rw<2.0,>=1.2.0 +jsonschema!=2.5.0,<3.0.0,>=2.0.0 @@ -8,2 +11,3 @@ keystonemiddleware>=2.0.0 -pbr<2.0,>=1.4 -python-ironicclient>=0.6.0 +netaddr!=0.7.16,>=0.7.12 +pbr>=1.6 +python-ironicclient>=0.8.0 @@ -11,2 +15,3 @@ python-keystoneclient>=1.6.0 -oslo.config>=1.11.0 # Apache-2.0 -oslo.db>=2.0 # Apache-2.0 +python-swiftclient>=2.2.0 +oslo.config>=2.3.0 # Apache-2.0 +oslo.db>=2.4.1 # Apache-2.0 @@ -15 +20,2 @@ oslo.log>=1.8.0 # Apache-2.0 -oslo.utils>=1.9.0 # Apache-2.0 +oslo.rootwrap>=2.0.0 # Apache-2.0 +oslo.utils>=2.0.0 # Apache-2.0 @@ -17,0 +24 @@ stevedore>=1.5.0 # Apache-2.0 +SQLAlchemy>=0.9.9,<1.1.0

1 0