- OpenStack-announce - lists.openstack.org

[OSSA 2015-001] L3 agent denial of service with radvd 2.0+ (CVE-2014-8153)
by Tristan Cacqueray 08 Jan '15

08 Jan '15

========================================================= OSSA-2015-001: L3 agent denial of service with radvd 2.0+ ========================================================= :Date: January 08, 2015 :CVE: CVE-2014-8153 Affects ~~~~~~~ - Neutron: 2014.2 version up to 2014.2.1 Description ~~~~~~~~~~~ Ihar Hrachyshka from Red Hat reported a vulnerability in Neutron. By creating 8 routers and assigning each of them a non-provider ipv6 subnet, a malicious user may block router update processing for all tenants, potentially resulting in a Denial of Service. Only Neutron setups running with radvd 2.0+ are affected. Patches ~~~~~~~ - https://review.openstack.org/141575 (Juno) - https://review.openstack.org/138688 (Kilo) Credits ~~~~~~~ - Ihar Hrachyshka from Red Hat (CVE-2014-8153) References ~~~~~~~~~~ - https://launchpad.net/bugs/1399172 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8153 Notes ~~~~~ - This fix will be included in a future 2014.2.2 release. - The OSSA announce format for the 2015 advisories has been changed to RST. -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OSSA 2014-041.1] Glance v2 API unrestricted path traversal (CVE-2014-9493) ERRATA 1
by Grant Murphy 05 Jan '15

05 Jan '15

OpenStack Security Advisory: 2014-041 (ERRATA 1) CVE: CVE-2014-9493 Date: January 5, 2015 Title: Glance v2 API unrestricted path traversal Reporter: Masahito Muroi (NTT) Products: Glance Versions: up to 2014.1.3 and 2014.2 version up to 2014.2.1 Description: Masahito Muroi from NTT reported a vulnerability in Glance. By setting a malicious image location an authenticated user can download or delete any file on the Glance server for which the Glance process user has access to. Only setups using the Glance V2 API are affected by this flaw. Errata: When the original advisory was published a CVE number was not assigned. CVE-2014-9493 can now be used to track this vulnerability. Kilo (development branch) fix: https://review.openstack.org/141706 Juno fix: https://review.openstack.org/142373 Icehouse fix: https://review.openstack.org/142788 Notes: * This fix was included in the kilo-1 development milestone and will be included in future 2014.2.2 (juno) and 2014.1.4 (icehouse) releases. * The OpenStack VMT recommends revoking all credentials stored in files accessible by Glance as a precautionary measure. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9493 https://launchpad.net/bugs/1400966 OSSA History: 2015-01-05 - Errata 1 2014-12-23 - Original Version -- Grant Murphy OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Dec 20 - 26)
by Stefano Maffulli 26 Dec '14

26 Dec '14

Last newsletter of 2014, see you again in 2015! University of Hawaii College of Education harnesses OpenStack to support faculty research via a secure private cloud OpenStack powers a Holodeck at University of Hawaii at Manoa... Read the full story on Mirantis blog. The TOSCA Cloud State of the Union A nice summary of the status of OpenStack Heat and the relation between the different specifications to describe topology and orchestration in cloud world. Relevant Conversations * Application level HA via Heat * The state of nova-network to neutron migration * [Openstack-operators] Packaging sample config versions Deadlines and Development Priorities * [nova] Kilo Project Priorities * Neutron Priorities for Kilo * [Nova] Mid-cycle meetup details for kilo Security Advisories and Notices * [OSSA-2014-041] Glance v2 API unrestricted path traversal Reports from Previous Events * Rhones-Alpes meetup summary Tips ‘n Tricks * By Lars Kellogg-Stedman: Accessing the serial console of your Nova servers * By Darryl Cauldwell:Create A vSphere OpenStack Glance Windows VM Image Upcoming Events 2015 OpenStack Foundation Events Plan and Calls for Papers Available. The 2015 events plan is now available on the Global Events Calendar wiki. The detailed spreadsheet covers industry events, Summits (dates and locations), as well as regional OpenStack Days organized by the community. If you’re interested in sponsoring or speaking at a planned OpenStack Day, please contact the contact listed in the spreadsheet. * [Call for Speaker, Sponsor, Participants] OpenStack Day in Korea - Feb. 05, 2015 * Jan 15, 2015 Deep Dive into Trove Austin, Texas, US * Feb 05, 2015 OpenStack Day in Korea Seoul, Seoul, KR * Feb 19 - 20, 2015 World Techies Forum Mumbai, Maharashtra, IN * Apr 13 - 14, 2015 OpenStack Live Santa Clara, CA, US * Apr 22 - 23, 2015 China SDNNFV Conference Beijing, CN * May 18 - 22, 2015 OpenStack Summit May 2015 Vancouver, BC * Sep 17, 2015 OpenStack Benelux Conference 2015 Bussum, NL Other News * Volunteers needed for OpenStack Stand at FOSDEM in Brussels * Symantec joins OpenStack Foundation as Gold Member! * Keystone Middleware 1.3.1 release * OpenStack Crossproject Meeting: suspended for holidays. Got Answers? Ask OpenStack is the go-to destination for OpenStack users. Interesting questions waiting for answers: * how to extract the image details from glance api * HEAT grub commands for CentOS 7 Nova Instance * swift change replication address * Solaris 11.2 Openstack - CSRF Verification failed * How to retrieve ceilometer statistics for the meter "network.incoming.bytes" for an instance * Nova Scheduler warning "Host has more disk space than database expected" on launching instances * How to configure VirtualBox based testing environment? The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment.

1 0

[OSSA-2014-041] Glance v2 API unrestricted path traversal
by Grant Murphy 23 Dec '14

23 Dec '14

OpenStack Security Advisory: 2014-041 CVE: Requested Date: December 23, 2014 Title: Glance v2 API unrestricted path traversal Reporter: Masahito Muroi (NTT) Products: Glance Versions: up to 2014.1.3 and 2014.2 version up to 2014.2.1 Description: Masahito Muroi from NTT reported a vulnerability in Glance. By setting a malicious image location an authenticated user can download or delete any file on the Glance server for which the Glance process user has access to. Only setups using the Glance V2 API are affected by this flaw. Kilo (development branch) fix: https://review.openstack.org/141706 Juno fix: https://review.openstack.org/142373 Icehouse fix: https://review.openstack.org/142788 Notes: * This fix was included in the kilo-1 development milestone and will be included in future 2014.2.2 (juno) and 2014.1.4 (icehouse) releases. * The OpenStack VMT recommends revoking all credentials stored in files accessible by Glance as a precautionary measure. * A CVE has been requested for this issue, the OpenStack VMT will issue an errata with the correct CVE number assigned once this information is available. References: https://launchpad.net/bugs/1400966 -- Grant Murphy OpenStack Vulnerability Management Team

1 0

[keystonemiddleware] Keystone Middleware 1.3.1 release
by Morgan Fainberg 22 Dec '14

22 Dec '14

The Keystone development community would like to announce the 1.3.1 release of the Keystone Middleware package. This release can be installed from the following locations: * http://tarballs.openstack.org/keystonemiddleware <http://tarballs.openstack.org/keystonemiddleware> * https://pypi.python.org/pypi/keystonemiddleware <https://pypi.python.org/pypi/keystonemiddleware> 1.3.1 ------- * auth_token middleware no longer contacts keystone when a request with no token is received. Detailed changes in this release beyond what is listed above: https://launchpad.net/keystonemiddleware/+milestone/1.3.1

1 0

OpenStack Community Weekly Newsletter (Dec 13 - 20)
by Stefano Maffulli 19 Dec '14

19 Dec '14

1 0

Swift 2.2.1 released
by John Dickinson 19 Dec '14

19 Dec '14

I'm happy to announce the release of Swift 2.2.1. The work of 28 contributors (including 8 first-time contributors), this release is definitely operator-centric. I recommend that you upgrade; as always you can upgrade to this release with no customer downtime. Get the release: https://launchpad.net/swift/kilo/2.2.1 Full change log: https://github.com/openstack/swift/blob/master/CHANGELOG Below I've highlighted a few of the more significant updates in this release. * Swift now rejects object names with unicode surrogates. These unicode code points are not able to be encoded as UTF-8, so they are now formally rejected. * Storage node error limits now survive a ring reload. Each Swift proxy server tracks errors when talking to a storage node. If a storage node sends too many errors, no further requests are sent to that node for a time. However, previously this error tracking was cleared with a ring reload, and a ring reload could happen frequently if some servers were being gradually added to the cluster. Now, the error tracking is not lost on ring reload, and error tracking is aggregated across storage polices. Basically, this means that the proxy server has a more accurate view of the health of the cluster and your cluster will be less stressed when you have failures and capacity adjustments at the same time. * Clean up empty account and container partitions directories if they are empty. This keeps the system healthy and prevents a large number of empty directories from (significantly) slowing down the replication process. * Swift now includes a full translation for Simplified Chinese (zh_CN locale). I'd like to thank all of the Swift contributors for helping with this release. I'd especially like to thank the first-time contributors listed below: Cedric Dos Santos Martin Geisler Filippo Giunchedi Gregory Haynes Daisuke Morita Hisashi Osanai Shilla Saebi Pearl Yajing Tan Thank you, and have a happy holiday season. John

1 0

Kilo-1 development milestone available
by Thierry Carrez 19 Dec '14

19 Dec '14

Hi everyone, The first milestone of the Kilo development cycle, "kilo-1" is now reached for Keystone, Glance, Nova, Horizon, Neutron, Cinder, Ceilometer, Heat, Trove, Sahara, and Ironic ! It contains all the new features and bugfixes that have been added since the Juno Feature Freeze in September. You can find the full list of new features and fixed bugs, as well as tarball downloads, at: https://launchpad.net/keystone/kilo/kilo-1 https://launchpad.net/glance/kilo/kilo-1 https://launchpad.net/nova/kilo/kilo-1 https://launchpad.net/horizon/kilo/kilo-1 https://launchpad.net/neutron/kilo/kilo-1 https://launchpad.net/cinder/kilo/kilo-1 https://launchpad.net/ceilometer/kilo/kilo-1 https://launchpad.net/heat/kilo/kilo-1 https://launchpad.net/trove/kilo/kilo-1 https://launchpad.net/sahara/kilo/kilo-1 https://launchpad.net/ironic/kilo/kilo-1 91 blueprints were implemented and no less than 1056 bugs were fixed during this milestone. And that is not even counting all the features and bugfixes that were pushed to Oslo libraries in the same timeframe. The next development milestone, kilo-2, is scheduled for February 5th. You can further track upcoming features and Kilo release cycle status at: http://status.openstack.org/release/ Enjoy your local end-of-year holidays ! -- Thierry Carrez (ttx)

1 0

[keystonemiddleware] keystonemiddlware release 1.3.0
by Morgan Fainberg 18 Dec '14

18 Dec '14

The Keystone development community would like to announce the 1.3.0 release of the keystone middleware package. This release can be installed from the following locations: * http://tarballs.openstack.org/keystonemiddleware * https://pypi.python.org/pypi/keystonemiddleware 1.3.0 ------- * http_connect_timeout option is now an integer instead of a boolean. * The service user for auth_token middlware can now be in a domain other than the default domain. Detailed changes in this release beyond what is listed above: https://launchpad.net/keystonemiddleware/+milestone/1.3.0

1 0

[python-keystoneclient] Release of python-keystoneclient 1.0.0
by Morgan Fainberg 18 Dec '14

18 Dec '14

The Keystone development community would like to announce the release of python-keystoneclient 1.0.0. The move to the 1.x.x development branch was made to match the perception that the library has long been considered stable. Beyond the move to the stable release version, this release is no different than any other python-keystoneclient release. This release can be installed from the following locations: * http://tarballs.openstack.org/python-keystoneclient <http://tarballs.openstack.org/python-keystoneclient> * https://pypi.python.org/pypi/python-keystoneclient <https://pypi.python.org/pypi/python-keystoneclient> 1.0.0 ------- * Registered CLI Options will no longer use the default values instead of the ENV variables (if present) * The `curl` examples from the debug output now includes `--globoff` for ipv6 urls * HTTPClient will no longer incorrectly raise AttributeError if authentication has not occurred when checking if `.has_service_catalog` Detailed changes in this release beyond what is listed above: https://launchpad.net/python-keystoneclient/+milestone/1.0.0

1 0