- OpenStack-announce - lists.openstack.org

[OSSA-2017-005] Nova Filter Scheduler bypass through rebuild action (CVE-2017-16239)
by Tristan Cacqueray 14 Nov '17

14 Nov '17

================================================================== OSSA-2017-005: Nova Filter Scheduler bypass through rebuild action ================================================================== :Date: November 14, 2017 :CVE: CVE-2017-16239 Affects ~~~~~~~ - Nova: <=14.0.9, >=15.0.0 <=15.0.7, >=16.0.0 <=16.0.2 Description ~~~~~~~~~~~ George Shuklin from servers.com reported a vulnerability in Nova. By rebuilding an instance, an authenticated user may be able to circumvent the Filter Scheduler bypassing imposed filters (for example, the ImagePropertiesFilter or the IsolatedHostsFilter). All setups using Nova Filter Scheduler are affected. Patches ~~~~~~~ - https://review.openstack.org/519684 (Newton) - https://review.openstack.org/519681 (Ocata) - https://review.openstack.org/519672 (Pike) - https://review.openstack.org/519662 (Queens) Credits ~~~~~~~ - George Shuklin from Servers.com (CVE-2017-16239) References ~~~~~~~~~~ - https://launchpad.net/bugs/1664931 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16239 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Pike is officially released!
by Thierry Carrez 30 Aug '17

30 Aug '17

Hello OpenStack community, I'm proud and excited to announce the final release for the components of OpenStack Pike, which concludes the 6-month Pike development cycle. You will find a complete list of all components, their latest versions, and links to individual project release notes documents listed on the OpenStack releases site: https://releases.openstack.org/pike/ Congratulations to everyone who has contributed to making this release a success. Pike saw contributions from more than 1800 individuals, bringing the total number of contributors to OpenStack since 2012 up to 6650. During the Pike cycle we merged an average of 220 changes per day, which makes OpenStack one of the most active software development project out there today. Our next development cycle, Queens, has already started. Project team members will meet in Denver starting on September 11 at the Project Teams Gathering to kickstart the work for the coming 6 months. I hope to see you there! Thanks, -- Thierry Carrez (ttx)

1 0

[OSSA-2017-004] federated user gets wrong role (CVE-2017-2673)
by Tristan Cacqueray 25 Apr '17

25 Apr '17

================================================================ OSSA-2017-004: Incorrect role assignment with federated Keystone ================================================================ :Date: April 25, 2017 :CVE: CVE-2017-2673 Affects ~~~~~~~ - Keystone: >=10.0.0 <=10.0.1, ==11.0.0 Description ~~~~~~~~~~~ Boris Bobrov from Mail.Ru reported a vulnerability in Keystone Federation. An authenticated user may receive all the roles assigned to the user's project regardless of the federation mapping when there are rules in which group-based assignments are not used. For example, by requesting an admin user to get a role in their project, the user may be granted the admin privileges for new scoped tokens. All setups using the Keystone federation without group based assignments rules are affected. Patches ~~~~~~~ - https://review.openstack.org/459713 (Newton) - https://review.openstack.org/459732 (Ocata) - https://review.openstack.org/459705 (Pike) Credits ~~~~~~~ - Boris Bobrov from Mail.Ru (CVE-2017-2673) References ~~~~~~~~~~ - https://launchpad.net/bugs/1677723 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2673 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[all][elections] Technical Committee Election Results
by Tristan Cacqueray 20 Apr '17

20 Apr '17

Please join me in congratulating the 7 newly elected members of the Technical Committe (TC). Chris Dent (cdent) Davanum Srinivas (dims) Dean Troyer (dtroyer) Flavio Percoco (flaper87) John Garbutt (johnthetubaguy) Sean McGinnis (smcginnis) Thierry Carrez (ttx) Full results: http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_072c4cd7ff0673b5 Election process details and results are also available here: https://governance.openstack.org/election/ Thank you to all of the candidates, having a good group of candidates helps engage the community in our democratic process. Thank you to all who voted and who encouraged others to vote. We need to ensure your voice is heard. Thank you for another great round. -Tristan

1 0

[OSSA-2017-003] XSS in Horizon federation mappings UI (CVE-2017-7400)
by Tristan Cacqueray 05 Apr '17

05 Apr '17

==================================================== OSSA-2017-003: XSS in Horizon federation mappings UI ==================================================== :Date: April 04, 2017 :CVE: CVE-2017-7400 Affects ~~~~~~~ - Horizon: >=9.0.0 <=9.1.1, >=10.0.0 <=10.0.2, ==11.0.0 Description ~~~~~~~~~~~ Eric Brown from VMware reported a vulnerability in Horizon. By creating a malicious federation mapping, an adminstrator may conduct a persistent XSS attack. All Horizon setups are affected. Patches ~~~~~~~ - https://review.openstack.org/442455 (Mitaka) - https://review.openstack.org/442454 (Newton) - https://review.openstack.org/442453 (Ocata) - https://review.openstack.org/442277 (Pike) Credits ~~~~~~~ - Eric Brown from VMware (CVE-2017-7400) References ~~~~~~~~~~ - https://launchpad.net/bugs/1667086 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7400 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OSSA-2017-002] Nova logs sensitive context from notification exceptions (CVE-2017-7214)
by Jeremy Stanley 23 Mar '17

23 Mar '17

======================================================================= OSSA-2017-002: Nova logs sensitive context from notification exceptions ======================================================================= :Date: March 23, 2017 :CVE: CVE-2017-7214 Affects ~~~~~~~ - Nova: >=13.0.0 <=13.1.3, >=14.0.0 <=14.0.4, >=15.0.0 <=15.0.1 Description ~~~~~~~~~~~ Matt Riedemann with Huawei reported a vulnerability in Nova. Legacy notification exception contexts appearing in ERROR level logs may include sensitive information such as account passwords and authorization tokens. All Nova setups are affected. Patches ~~~~~~~ - https://review.openstack.org/447075 (Mitaka) - https://review.openstack.org/447072 (Newton) - https://review.openstack.org/447071 (Ocata) - https://review.openstack.org/446948 (Pike) Credits ~~~~~~~ - Matt Riedemann from Huawei (CVE-2017-7214) References ~~~~~~~~~~ - https://launchpad.net/bugs/1673569 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7214 -- Jeremy Stanley OpenStack Vulnerability Management Team

1 0

OpenStack Ocata is officially released!
by Doug Hellmann 22 Feb '17

22 Feb '17

Hello OpenStack community, I'm overjoyed to announce the final releases for the components of OpenStack Ocata, which conclude the 4-month Ocata development cycle. You will find a complete list of the deliverables for the 33 services and ~190 other components and libraries that make up the Ocata release, their latest versions, and links to individual project release notes documents listed on the release site: https://releases.openstack.org/ocata/ Congratulations to all of the teams who have contributed to this release! Many thanks to our PTLs and release liaisons for their help with release coordination this cycle. Our next production cycle, Pike, has already started. We are back to our regular 6-month development cycle, and you can find details about the release schedule at: https://releases.openstack.org/pike/schedule.html We are currently meeting in Atlanta through February 24 for the Pike Project Team Gathering to plan the work for the upcoming cycle. I hope to see you here! Doug

1 0

Project Team Lead Election Conclusion and Results
by knelson＠openstack.org 08 Feb '17

08 Feb '17

Hello All! Thank you to the electorate, to all those who voted and to all candidates who put their name forward for Project Team Lead (PTL) in this election. A healthy, open process breeds trust in our decision making capability thank you to all those who make this process possible.Now for the results of the PTL election process, please join me in extending congratulations to the following PTLs! * Barbican : Dave McCowan * Chef OpenStack : Jan Klare * Cinder : Sean McGinnis * Cloudkitty : Christophe Sauthier * Community App Catalog : Matthew Wagoner * Congress : Eric K * Designate : Tim Simmons * Documentation : Alexandra Settle * Dragonflow : Omer Anson * Ec2 Api : Alexandre Levine * Freezer : Saad Zaher * Fuel : Vladimir Kuklin * Glance : Brian Rosmaita * Heat : Rico Lin * Horizon : Rob Cresswell * I18n : Ian Y. Choi * Infrastructure : Jeremy Stanley * Ironic : Dmitry Tantsur * Karbor : Yuval Brik * Keystone : Lance Bragstad * Kolla : Michal Jastrzebski * Kuryr : Antoni Segura Puimedon * Magnum : Adrian Otto * Manila : Ben Swartzlander * Mistral : Renat Akhmerov * Monasca : Roland Hochmuth * Murano : Felipe Monteiro * Neutron : Kevin Benton * Nova : Matt Riedemann * Octavia : Michael Johnson * OpenStackAnsible : Andy McCrae * OpenStackClient : Dean Troyer * OpenStack Charms : James Page * Oslo : ChangBo Guo * Packaging Deb : Thomas Goirand * Packaging Rpm : Igor Yozhikov * Puppet OpenStack : Alex Schultz * Quality Assurance : Andrea Frittoli * Rally : Andrey Kurilin * RefStack : Catherine Diep * Release Management : Thierry Carrez * Requirements : Tony Breeds * Sahara : Telles Mota Vidal Nóbrega * Searchlight : Steve McLellan * Security : Robert Clark * Senlin : Qiming Teng * Solum : Devdatta-kulkarni Devdatta-kulkarni * Stable Branch Maintenance : Tony Breeds * Storlets : Eran Rom * Swift : John Dickinson * Tacker : Gongysh Gongysh * Telemetry : Julien Danjou * Tricircle : Chaoyi Huang * Tripleo : Emilien Macchi * Trove : Amrith Amrith * Vitrage : Ifat Afek * Watcher : Alexander Chadin * Winstackers : Claudiu Belu * Zaqar : Fei Long Wang * Zun : Hongbin Lu Elections:* Ironic: [ http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_08ff4080d37365ba ]( http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_08ff4080d37365ba )* Keystone: [ http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_1d2eef76fdfc1ec4 ]( http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_1d2eef76fdfc1ec4 )* Neutron: [ http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_6df9c8e056680402 ]( http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_6df9c8e056680402 )* Quality_Assurance: [ http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_99413ba03ba1c6b3 ]( http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_99413ba03ba1c6b3 )* Stable_Branch_Maintenance: [ http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_b719c6a5a681033b ]( http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_b719c6a5a681033b )Election process details and results are also available here: [ https://governance.openstack.org/election/ ]( https://governance.openstack.org/election/ )Thank you to all involved in the PTL election process, -Kendall Nelson (diablo_rojo)

1 0

[OSSA-2017-001] CatchErrors leaks sensitive values in oslo.middleware (CVE-2017-2592)
by Jeremy Stanley 26 Jan '17

26 Jan '17

==================================================================== OSSA-2017-001: CatchErrors leaks sensitive values in oslo.middleware ==================================================================== :Date: January 26, 2017 :CVE: CVE-2017-2592 Affects ~~~~~~~ - Oslo.middleware: <=3.8.0, >=3.9.0 <=3.19.0, >=3.20.0 <=3.23.0 Description ~~~~~~~~~~~ Divya K Konoor with IBM reported a vulnerability in oslo.middleware. Software using the CatchError class may include sensitive values in the error message accompanying a Traceback, resulting in their disclosure. For example, complete API requests (including keystone tokens in their headers) may leak into neutron error logs. Patches ~~~~~~~ - https://review.openstack.org/425734 (Mitaka) - https://review.openstack.org/425732 (Newton) - https://review.openstack.org/425730 (Ocata) Credits ~~~~~~~ - Divya K Konoor from IBM (CVE-2017-2592) References ~~~~~~~~~~ - https://launchpad.net/bugs/1628031 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2592 -- Jeremy Stanley

1 0

[new][openstackclient] python-openstackclient 3.4.1 release (ocata)
by no-reply＠openstack.org 20 Nov '16

20 Nov '16

We are satisfied to announce the release of: python-openstackclient 3.4.1: OpenStack Command-line Client This release is part of the ocata release series. The source is available from: https://git.openstack.org/cgit/openstack/python-openstackclient Download the package from: https://pypi.python.org/pypi/python-openstackclient Please report issues through launchpad: https://bugs.launchpad.net/python-openstackclient For more details, please see below. 3.4.1 ^^^^^ Bug Fixes * Fix "TypeError: __init__() got an unexpected keyword argument 'project_domain_id'" error with non-password authentication types. [Bug 1642301 (https://bugs.launchpad.net/bugs/1642301)] Changes in python-openstackclient 3.4.0..3.4.1 ---------------------------------------------- 61cc546 Add relnote for release 3.4.1 e51a8d6 Use project_domain_id only in password auth Diffstat (except docs and test files) ------------------------------------- openstackclient/common/client_config.py | 1 + releasenotes/notes/bug-1642301-18b08e0cd4b11687.yaml | 6 ++++++ 2 files changed, 7 insertions(+)

1 0