- OpenStack-announce - lists.openstack.org

OpenStack Community Weekly Newsletter (Dec 6 – 13)
by Stefano Maffulli 16 Dec '13

16 Dec '13

1 2

[Swift] Release of Swift 1.11.0
by John Dickinson 12 Dec '13

12 Dec '13

I'm happy to announce that we've released Swift 1.11.0. You can find the high-level Launchpad details (including a link to the tarball) at https://launchpad.net/swift/icehouse/1.11.0. As always, you can upgrade to this release without any downtime to your users. Swift 1.11.0 is the work of 26 contributors, including the following 5 new contributors to Swift: Rick Hawkins Steven Lang Gonéri Le Bouder Zhenguo Niu Aaron Rosen This release includes some significant new features. I encourage you to read the change log (https://github.com/openstack/swift/blob/master/CHANGELOG) and I'll highlight some of the more significant changes below. * Discoverable capabilities: The Swift proxy server will now respond to /info requests with information about the particular cluster being queried. This will allow easy programmatic discovery of limits and features implemented in a particular Swift system. The first two obvious use cases are for cross-cluster clients (e.g. common client between Rackspace, HP, and a private deployment) and for deeper functional testing of all parts of the Swift API. * Early quorum response: On writes, the Swift proxy server will not return success unless a quorum of the storage nodes indicate they have successfully written data to disk. Previously, the proxy waited for all storage nodes to respond, even if it had already heard from a quorum of servers. With this change, the proxy node will be able to respond to client requests as soon as a quorum of the storage nodes indicate a common response. This can help lower response times to clients and improve performance of the cluster. * Retry reads: If a storage server fails during an object read request, the proxy will now continue the response stream to the client by making a request to a different replica of the data. For example, if a client requests a 3GB object and the particular object server serving the response fails during the request after 1.25GB, the proxy will make a range request to a different replica, asking for the data starting at 1.25GB into the file. In this way, Swift provides even higher availability to your data in the face of hardware failures. * DiskFile API: The DiskFile abstraction for talking to data on disk has been refactored to allow alternate implementations to be developed. There is an example in-memory implementation included in the codebase. External implementations include one for Gluster and one for Seagate Kinetic drives. The DiskFile API is still a work in progress and is not yet finalized. * Object replication ssync (an rsync alternative): A Swift storage node can now be configured to use Swift primitives for replication transport instead of rsync. Although still being tested at scale, this mechanism will allow for future development improving replication times and lowering both MTTD and MTTR of errors. I'd like to publicly thank the Swift contributors and core developers for their work on Swift. Their diverse experience and viewpoints make Swift the mature project it is, capable of running the world's largest storage clouds. --John

1 0

[OSSA 2013-036] Insufficient sanitization of Instance Name in Horizon (CVE-2013-6858)
by Jeremy Stanley 11 Dec '13

11 Dec '13

OpenStack Security Advisory: 2013-036 CVE: CVE-2013-6858 Date: December 11, 2013 Title: Insufficient sanitization of Instance Name in Horizon Reporter: Cisco PSIRT Products: Horizon Affects: All supported releases Description: Cisco PSIRT reported a vulnerability in the OpenStack Horizon dashboard. By embedding HTML tags in an Instance Name, a tenant may execute a script within an administrator's browser resulting in a cross-site scripting (XSS) attack. Only setups using the Horizon dashboard are affected. Icehouse (development branch) fix: https://review.openstack.org/55175 Havana fix: https://review.openstack.org/58465 Grizzly fix: https://review.openstack.org/58820 Notes: This fix is included in the icehouse-1 development milestone and will appear in a future 2013.2.1 stable point release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6858 https://launchpad.net/bugs/1247675 -- Jeremy Stanley OpenStack Vulnerability Management Team

1 0

[OSSA 2013-035] Heat ReST API doesn't respect tenant scoping (CVE-2013-6428)
by Jeremy Stanley 11 Dec '13

11 Dec '13

OpenStack Security Advisory: 2013-035 CVE: CVE-2013-6428 Date: December 11, 2013 Title: Heat ReST API doesn't respect tenant scoping Reporter: Steven Hardy (Red Hat) Products: Heat Affects: All supported releases Description: Steven Hardy from Red Hat reported a vulnerability in the Heat ReST API. By changing the request path, an authenticated client may override their tenant scope resulting in privilege escalation. Only setups exposing the Heat orchestration ReST interface are affected. Icehouse (development branch) fix: https://review.openstack.org/61455 Havana fix: https://review.openstack.org/61456 Notes: This fix will be included in the icehouse-2 development milestone and in a future 2013.2.1 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6428 https://launchpad.net/bugs/1256983 -- Jeremy Stanley OpenStack Vulnerability Management Team

1 0

[OSSA 2013-034] Heat CFN policy rules not all enforced (CVE-2013-6426)
by Jeremy Stanley 11 Dec '13

11 Dec '13

OpenStack Security Advisory: 2013-034 CVE: CVE-2013-6426 Date: December 11, 2013 Title: Heat CFN policy rules not all enforced Reporter: Steven Hardy (Red Hat) Products: Heat Affects: All supported releases Description: Steven Hardy from Red Hat reported a vulnerability in Heat's default API policy enforcement. By calling the CreateStack or UpdateStack methods, an in-instance user may be able to create or update a stack in violation of the default policy. Only setups using Heat's cloudformation-compatible API are affected. Icehouse (development branch) fix: https://review.openstack.org/61452 Havana fix: https://review.openstack.org/61454 Notes: This fix will be included in the icehouse-2 development milestone and in a future 2013.2.1 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6426 https://launchpad.net/bugs/1256049 -- Jeremy Stanley OpenStack Vulnerability Management Team

1 0

[OSSA 2013-034] Heat CFN policy rules not all enforced (CVE-2013-6426)
by Jeremy Stanley 11 Dec '13

11 Dec '13

OpenStack Security Advisory: 2013-034 CVE: CVE-2013-6426 Date: December 11, 2013 Title: Heat CFN policy rules not all enforced Reporter: Steven Hardy (Red Hat) Products: Heat Affects: All supported releases Description: Steven Hardy from Red Hat reported a vulnerability in Heat's default API policy enforcement. By calling the CreateStack or UpdateStack methods, an in-instance user may be able to create or update a stack in violation of the default policy. Only setups using Heat's cloudformation-compatible API are affected. Icehouse (development branch) fix: https://review.openstack.org/61452 Havana fix: https://review.openstack.org/61454 Notes: This fix will be included in the icehouse-2 development milestone and in a future 2013.2.1 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6426 https://launchpad.net/bugs/1256049 -- Jeremy Stanley OpenStack Vulnerability Management Team

1 0

[OSSA 2013-033] Metadata queries from Neutron to Nova are not restricted by tenant (CVE-2013-6419)
by Jeremy Stanley 11 Dec '13

11 Dec '13

OpenStack Security Advisory: 2013-033 CVE: CVE-2013-6419 Date: December 11, 2013 Title: Metadata queries from Neutron to Nova are not restricted by tenant Reporter: Aaron Rosen (VMware) Products: Neutron, Nova Affects: All supported releases Description: Aaron Rosen from VMware reported a vulnerability in the metadata access from OpenStack Neutron to Nova. Because of a missing authorization check on port binding, by guessing an instance_id a tenant may retrieve another tenant's metadata resulting in information disclosure. Only OpenStack setups running neutron-metadata-agent are affected. Icehouse (development branch) fix: https://review.openstack.org/61439 (neutron) https://review.openstack.org/61428 (nova) Havana fix: https://review.openstack.org/61442 (neutron) https://review.openstack.org/61435 (nova) Grizzly fix: https://review.openstack.org/61443 (neutron) https://review.openstack.org/61437 (nova) Notes: This fix will be included in the icehouse-2 development milestone and in a future 2013.2.1 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6419 https://launchpad.net/bugs/1235450 -- Jeremy Stanley OpenStack Vulnerability Management Team

1 0

[OSSA 2013-032] Keystone trust circumvention through EC2-style tokens (CVE-2013-6391)
by Jeremy Stanley 11 Dec '13

11 Dec '13

OpenStack Security Advisory: 2013-032 CVE: CVE-2013-6391 Date: December 11, 2013 Title: Keystone trust circumvention through EC2-style tokens Reporter: Steven Hardy (Red Hat) Products: Keystone Affects: Havana and later Description: Steven Hardy from Red Hat reported a vulnerability in Keystone trusts when used in conjunction with the ec2tokens API. By generating EC2 credentials using a trust-scoped token, a trustee may retrieve a token not scoped to the trust, therefore elevating privileges to all of the trustor's roles. Only Keystone setups enabling EC2-style authentication are affected. Icehouse (development branch) fix: https://review.openstack.org/61419 Havana fix: https://review.openstack.org/61425 Notes: This fix will be included in the icehouse-2 development milestone and in a future 2013.2.1 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6391 https://launchpad.net/bugs/1242597 -- Jeremy Stanley OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Nov 29 – Dec 6)
by Stefano Maffulli 06 Dec '13

06 Dec '13

1 0

Icehouse-1 development milestone available
by Thierry Carrez 05 Dec '13

05 Dec '13

Hi everyone, The first milestone of the Icehouse development cycle, "icehouse-1" is now available for Keystone, Glance, Nova, Horizon, Neutron, Cinder, Ceilometer, Heat, and Trove. It contains all the new features that have been added since the Havana Feature Freeze in September. You can see the full list of new features and fixed bugs, as well as tarball downloads, at: https://launchpad.net/keystone/icehouse/icehouse-1 https://launchpad.net/glance/icehouse/icehouse-1 https://launchpad.net/nova/icehouse/icehouse-1 https://launchpad.net/horizon/icehouse/icehouse-1 https://launchpad.net/neutron/icehouse/icehouse-1 https://launchpad.net/cinder/icehouse/icehouse-1 https://launchpad.net/ceilometer/icehouse/icehouse-1 https://launchpad.net/heat/icehouse/icehouse-1 https://launchpad.net/trove/icehouse/icehouse-1 Including the oslo libraries, 69 blueprints were implemented and 738 bugs were fixed during this milestone. The next development milestone, icehouse-2, is scheduled for January 23rd. You can further track upcoming features and Icehouse release cycle status at: http://status.openstack.org/release/ Regards, -- Thierry Carrez (ttx)

1 0