- OpenStack-announce - lists.openstack.org

[Security][LP# 1471161] Designate mDNS DoS through incorrect handling of large RecordSets
by Kiall Mac Innes 28 Jul '15

28 Jul '15

Launchpad Number: 1471161 CVE: TBA Date: July 28, 2015 Title: Designate mDNS DoS through incorrect handling of large RecordSets Reporter: Florian Weimer (Red Hat) Products: Designate Versions: 2015.1.0 through 1.0.0.0b1 Description: Florian Weimer from Red Hat reported a vulnerability in Designate. By creating a single RecordSet that exceeds the configured max allowed DNS packet size, an authenticated user may cause the Designate mDNS service to enter an infinite loop, triggering a DoS. Liberty (development branch) fix: https://review.openstack.org/206578 Kilo fix: https://review.openstack.org/206580 Notes: This fix will be included in a future 1.0.0.0b2 release. References: https://launchpad.net/bugs/1471161 -- Kiall Mac Innes, OpenStack Designate PTL

1 0

[OSSA 2015-013] Glance task flow may fail to delete image from backend
by Grant Murphy 28 Jul '15

28 Jul '15

===================================================================== OSSA-2015-013: Glance task flow may fail to delete image from backend ===================================================================== :Date: July 28, 2015 :CVE: CVE-2015-3289 Affects ~~~~~~~ - Glance: versions 2015.1.0 Description ~~~~~~~~~~~ Abhishek Kekane from NTT reported a vulnerability in Glance. By creating numerous images using the import task flow API and deleting them, an authenticated attacker may accumulate untracked image data in the backend resulting in potential resource exhaustion and denial of service. All glance setups are affected. Patches ~~~~~~~ - https://review.openstack.org/#/c/181816/ (Kilo) - https://review.openstack.org/#/c/181345/ (Liberty) Credits ~~~~~~~ - Abhishek Kekane from NTT (CVE-2015-3289) References ~~~~~~~~~~ - https://launchpad.net/bugs/1454087 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3289 Notes ~~~~~ - This fix will be included in the future 2015.1.1 (kilo) release.

1 0

[release][oslo] tooz release 1.20.0 (liberty)
by davanum＠gmail.com 27 Jul '15

27 Jul '15

We are excited to announce the release of: tooz 1.20.0: Coordination library for distributed systems. This release is part of the liberty release series. With source available at: http://git.openstack.org/cgit/openstack/tooz With package available at: https://pypi.python.org/pypi/tooz For more details, please see the git log history below and: http://launchpad.net/python-tooz/+milestone/1.20.0 Please report issues through launchpad: http://bugs.launchpad.net/python-tooz/ Changes in tooz 1.19.0..1.20.0 ------------------------------ 7accc78 Updated from global requirements a07405d Updated from global requirements 8511d4c Use futurist to allow for executor providing and unifying 3216c90 Use a lua script(s) instead of transactions c5bda82 Update .gitignore Diffstat (except docs and test files) ------------------------------------- .gitignore | 10 ++- requirements.txt | 1 + test-requirements.txt | 8 +- tooz/drivers/file.py | 37 +++------ tooz/drivers/ipc.py | 5 +- tooz/drivers/memcached.py | 8 +- tooz/drivers/redis.py | 196 ++++++++++++++++++++++++++++++++-------------- tooz/utils.py | 87 ++++++++++++++++++++ 9 files changed, 309 insertions(+), 96 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 340681d..f849a5c 100644 --- a/requirements.txt +++ b/requirements.txt @@ -13,0 +14 @@ futures>=3.0;python_version=='2.7' or python_version=='2.6' +futurist>=0.1.2 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index 5c2e6bc..8e27295 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -10,2 +10 @@ doc8 # Apache-2.0 -mock!=1.1.4,>=1.1;python_version!='2.6' -mock==1.0.1;python_version=='2.6' +mock>=1.2 @@ -26 +25 @@ kazoo>=2.2 -pymemcache>=1.2.9 # Apache 2.0 License +pymemcache!=1.3.0,>=1.2.9 # Apache 2.0 License @@ -27,0 +27,3 @@ redis>=2.10.0 + +# Ensure that the eventlet executor continues to operate... +eventlet>=0.17.4

1 0

[release][oslo] taskflow release 1.17.0 (liberty)
by davanum＠gmail.com 27 Jul '15

27 Jul '15

We are content to announce the release of: taskflow 1.17.0: Taskflow structured state management library. This release is part of the liberty release series. With source available at: http://git.openstack.org/cgit/openstack/taskflow With package available at: https://pypi.python.org/pypi/taskflow For more details, please see the git log history below and: http://launchpad.net/taskflow/+milestone/1.17.0 Please report issues through launchpad: http://bugs.launchpad.net/taskflow/ Changes in taskflow 1.16.0..1.17.0 ---------------------------------- 9ad7ec6 Modify listeners to handle the results now possible from revert() 16d9914 Updated from global requirements 7e1d330 Fix lack of space between functions 359cc49 Create and use a serial retry executor e5092b6 Just link to the worker engine docs instead of including a TOC inline 5bbf8cf Link to run() method in engines doc 58fbfd0 Add ability to reset an engine via a `reset` method 02c83d4 Remove **most** usage of taskflow.utils in examples 7bc1be0 Unify the zookeeper/redis jobboard iterators e004197 Use io.open vs raw open 14de80d Make currently implemented jobs use @functools.total_ordering 0d884a2 Use encodeutils for exception -> string function db7af3f Remove kazoo hack/fix for issue no longer needed 3e16e24 Update states comment to refer to task section 9e6ef18 Document more of the retry subclasses special keyword arguments Diffstat (except docs and test files) ------------------------------------- requirements.txt | 2 +- taskflow/engines/action_engine/actions/base.py | 16 ++ taskflow/engines/action_engine/actions/retry.py | 66 +++----- taskflow/engines/action_engine/actions/task.py | 6 +- taskflow/engines/action_engine/completer.py | 11 +- taskflow/engines/action_engine/engine.py | 37 +++-- taskflow/engines/action_engine/executor.py | 48 +++++- taskflow/engines/action_engine/runner.py | 3 +- taskflow/engines/action_engine/runtime.py | 10 +- taskflow/engines/action_engine/scheduler.py | 6 +- taskflow/engines/base.py | 15 +- taskflow/examples/dump_memory_backend.py | 14 +- taskflow/examples/hello_world.py | 14 +- taskflow/examples/parallel_table_multiply.py | 6 +- taskflow/examples/persistence_example.py | 3 +- taskflow/examples/resume_from_backend.py | 31 ++-- taskflow/examples/resume_vm_boot.py | 18 ++- taskflow/examples/resume_volume_create.py | 13 +- taskflow/examples/run_by_iter.py | 7 +- taskflow/examples/run_by_iter_enumerate.py | 7 +- taskflow/examples/switch_graph_flow.py | 12 +- taskflow/exceptions.py | 33 ++-- taskflow/jobs/backends/impl_redis.py | 64 +++++--- taskflow/jobs/backends/impl_zookeeper.py | 95 +++-------- taskflow/jobs/base.py | 73 +++++++++ taskflow/listeners/base.py | 8 +- taskflow/listeners/logging.py | 26 +-- taskflow/persistence/backends/impl_dir.py | 8 +- taskflow/persistence/models.py | 94 +++++++++++ taskflow/retry.py | 39 ++++- taskflow/states.py | 1 + taskflow/types/failure.py | 12 +- taskflow/utils/kazoo_utils.py | 8 +- taskflow/utils/mixins.py | 35 ++++ taskflow/utils/persistence_utils.py | 75 --------- test-requirements.txt | 3 +- 45 files changed, 776 insertions(+), 427 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 4c9740c..7ae9099 100644 --- a/requirements.txt +++ b/requirements.txt @@ -17 +17 @@ enum34;python_version=='2.7' or python_version=='2.6' -futurist>=0.1.1 # Apache-2.0 +futurist>=0.1.2 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index b0ed54c..5a06c57 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -7,2 +7 @@ oslotest>=1.7.0 # Apache-2.0 -mock!=1.1.4,>=1.1;python_version!='2.6' -mock==1.0.1;python_version=='2.6' +mock>=1.2

1 0

[release][oslo] oslo.vmware release 1.18.0 (liberty)
by davanum＠gmail.com 27 Jul '15

27 Jul '15

We are stoked to announce the release of: oslo.vmware 1.18.0: Oslo VMware library This release is part of the liberty release series. With source available at: http://git.openstack.org/cgit/openstack/oslo.vmware With package available at: https://pypi.python.org/pypi/oslo.vmware For more details, please see the git log history below and: http://launchpad.net/oslo.vmware/+milestone/1.18.0 Please report issues through launchpad: http://bugs.launchpad.net/oslo.vmware Changes in oslo.vmware 1.17.0..1.18.0 ------------------------------------- 9df58d2 Make usage doc easier to understand for library consumers 99df328 Updated from global requirements d83f03f Imported Translations from Transifex 6f20758 Updated from global requirements 4e8fc09 Updated from global requirements b24f717 Remove username from logs e2d35bd Updated from global requirements Diffstat (except docs and test files) ------------------------------------- .../locale/fr/LC_MESSAGES/oslo.vmware-log-error.po | 5 ++-- .../locale/fr/LC_MESSAGES/oslo.vmware-log-info.po | 5 ++-- .../fr/LC_MESSAGES/oslo.vmware-log-warning.po | 22 ++++-------------- oslo.vmware/locale/fr/LC_MESSAGES/oslo.vmware.po | 5 ++-- oslo.vmware/locale/oslo.vmware-log-warning.pot | 18 +++------------ oslo_vmware/api.py | 2 +- requirements.txt | 6 ++--- setup.py | 2 +- test-requirements.txt | 3 +-- 10 files changed, 41 insertions(+), 54 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index f663c97..deb5080 100644 --- a/requirements.txt +++ b/requirements.txt @@ -5 +5 @@ -pbr<2.0,>=0.11 +pbr<2.0,>=1.3 @@ -17 +17 @@ oslo.i18n>=1.5.0 # Apache-2.0 -oslo.utils>=1.6.0 # Apache-2.0 +oslo.utils>=1.9.0 # Apache-2.0 @@ -27 +27 @@ urllib3>=1.8.3 -oslo.concurrency>=2.1.0 # Apache-2.0 +oslo.concurrency>=2.3.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index 48cf65a..bfa5505 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -10,2 +10 @@ fixtures>=1.3.1 -mock>=1.1;python_version!='2.6' -mock==1.0.1;python_version=='2.6' +mock>=1.2

1 0

[release][oslo] oslo.utils release 2.1.0 (liberty)
by davanum＠gmail.com 27 Jul '15

27 Jul '15

We are happy to announce the release of: oslo.utils 2.1.0: Oslo Utility library This release is part of the liberty release series. With source available at: http://git.openstack.org/cgit/openstack/oslo.utils With package available at: https://pypi.python.org/pypi/oslo.utils For more details, please see the git log history below and: http://launchpad.net/oslo.utils/+milestone/2.1.0 Please report issues through launchpad: http://bugs.launchpad.net/oslo.utils Changes in oslo.utils 2.0.0..2.1.0 ---------------------------------- 485222b Imported Translations from Transifex 4005058 Updated from global requirements c46c436 Adding checking around the monotonic import Diffstat (except docs and test files) ------------------------------------- oslo.utils/locale/de/LC_MESSAGES/oslo.utils-log-info.po | 5 +++-- oslo.utils/locale/de/LC_MESSAGES/oslo.utils.po | 7 ++++--- .../locale/en_GB/LC_MESSAGES/oslo.utils-log-error.po | 4 ++-- .../locale/en_GB/LC_MESSAGES/oslo.utils-log-info.po | 4 ++-- .../locale/en_GB/LC_MESSAGES/oslo.utils-log-warning.po | 4 ++-- oslo.utils/locale/en_GB/LC_MESSAGES/oslo.utils.po | 8 ++++---- oslo.utils/locale/fr/LC_MESSAGES/oslo.utils-log-error.po | 5 +++-- oslo.utils/locale/fr/LC_MESSAGES/oslo.utils-log-info.po | 5 +++-- .../locale/fr/LC_MESSAGES/oslo.utils-log-warning.po | 5 +++-- oslo.utils/locale/fr/LC_MESSAGES/oslo.utils.po | 9 +++++---- oslo.utils/locale/oslo.utils.pot | 15 ++++++++++----- oslo_utils/timeutils.py | 8 +++++++- test-requirements.txt | 3 +-- 13 files changed, 49 insertions(+), 33 deletions(-) Requirements updates -------------------- diff --git a/test-requirements.txt b/test-requirements.txt index fe29bea..a11796d 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -25,2 +25 @@ oslosphinx>=2.5.0 # Apache-2.0 -mock!=1.1.4,>=1.1;python_version!='2.6' -mock==1.0.1;python_version=='2.6' +mock>=1.2

1 0

[release][oslo] oslo.service release 0.5.0 (liberty)
by davanum＠gmail.com 27 Jul '15

27 Jul '15

We are pleased to announce the release of: oslo.service 0.5.0: oslo.service library This release is part of the liberty release series. With source available at: http://git.openstack.org/cgit/openstack/oslo.service With package available at: https://pypi.python.org/pypi/oslo.service For more details, please see the git log history below and: http://launchpad.net/oslo.service/+milestone/0.5.0 Please report issues through launchpad: http://bugs.launchpad.net/oslo.service Changes in oslo.service 0.4.0..0.5.0 ------------------------------------ 87cdb36 Updated from global requirements 3d9ae77 Updated from global requirements 2b01b95 Updated from global requirements 6726c25 Add oslo_debug_helper to tox.ini a6cd5df Add usage documentation for oslo_service.service module 390b934 save docstring, name etc using six.wraps Diffstat (except docs and test files) ------------------------------------- oslo_service/loopingcall.py | 2 + oslo_service/service.py | 13 +------ requirements.txt | 2 +- setup.py | 2 +- test-requirements.txt | 5 +-- tox.ini | 5 ++- 8 files changed, 103 insertions(+), 19 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 1ed395c..b4d7b3d 100644 --- a/requirements.txt +++ b/requirements.txt @@ -9 +9 @@ monotonic>=0.1 # Apache-2.0 -oslo.utils>=1.6.0 # Apache-2.0 +oslo.utils>=1.9.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index 2d275f9..3455de1 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -6,3 +6,2 @@ hacking<0.11,>=0.10.0 -mock>=1.1;python_version!='2.6' -mock==1.0.1;python_version=='2.6' -oslotest>=1.5.1 # Apache-2.0 +mock>=1.2 +oslotest>=1.7.0 # Apache-2.0

1 0

[release][oslo] oslo.policy release 0.8.0 (liberty)
by davanum＠gmail.com 27 Jul '15

27 Jul '15

We are stoked to announce the release of: oslo.policy 0.8.0: Oslo Policy library This release is part of the liberty release series. With source available at: http://git.openstack.org/cgit/openstack/oslo.policy With package available at: https://pypi.python.org/pypi/oslo.policy For more details, please see the git log history below and: http://launchpad.net/oslo.policy/+milestone/0.8.0 Please report issues through launchpad: http://bugs.launchpad.net/oslo.policy Changes in oslo.policy 0.7.0..0.8.0 ----------------------------------- 92cc71d Updated from global requirements b5f78aa Fix typo of 'available' in token_fixture.py 59ebc39 Fixes up the API docs and module index Diffstat (except docs and test files) ------------------------------------- requirements.txt | 2 +- setup.cfg | 1 + setup.py | 2 +- test-requirements.txt | 2 +- 8 files changed, 9 insertions(+), 25 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 62ebd6c..6016da0 100644 --- a/requirements.txt +++ b/requirements.txt @@ -8 +8 @@ oslo.serialization>=1.4.0 # Apache-2.0 -oslo.utils>=1.6.0 # Apache-2.0 +oslo.utils>=1.9.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index eb6240f..d649626 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -6 +6 @@ hacking<0.11,>=0.10.0 -oslotest>=1.5.1 # Apache-2.0 +oslotest>=1.7.0 # Apache-2.0

1 0

[release][oslo] oslo.messaging release 2.1.0 (liberty)
by davanum＠gmail.com 27 Jul '15

27 Jul '15

We are gleeful to announce the release of: oslo.messaging 2.1.0: Oslo Messaging API This release is part of the liberty release series. With source available at: http://git.openstack.org/cgit/openstack/oslo.messaging With package available at: https://pypi.python.org/pypi/oslo.messaging For more details, please see the git log history below and: http://launchpad.net/oslo.messaging/+milestone/2.1.0 Please report issues through launchpad: http://bugs.launchpad.net/oslo.messaging Changes in oslo.messaging 2.0.0..2.1.0 -------------------------------------- 577b93b Imported Translations from Transifex a06e152 Updated from global requirements 1b390c3 add plugin documentation for executors and notifiers d94d6d6 Allows to change defaults opts adcd080 Allow a forward slash as a part of the user/password Diffstat (except docs and test files) ------------------------------------- .../locale/de/LC_MESSAGES/oslo.messaging.po | 8 ++++---- .../en_GB/LC_MESSAGES/oslo.messaging-log-error.po | 4 ++-- .../locale/en_GB/LC_MESSAGES/oslo.messaging.po | 9 +++------ .../es/LC_MESSAGES/oslo.messaging-log-error.po | 6 +++--- .../locale/es/LC_MESSAGES/oslo.messaging.po | 13 +++++-------- .../fr/LC_MESSAGES/oslo.messaging-log-error.po | 6 +++--- .../locale/fr/LC_MESSAGES/oslo.messaging.po | 11 ++++------- oslo.messaging/locale/oslo.messaging.pot | 8 ++------ .../ru/LC_MESSAGES/oslo.messaging-log-error.po | 6 +++--- oslo_messaging/_drivers/impl_rabbit.py | 4 ++-- oslo_messaging/_drivers/impl_zmq.py | 3 ++- oslo_messaging/_executors/impl_aioeventlet.py | 3 ++- oslo_messaging/_executors/impl_pooledexecutor.py | 8 +++++--- oslo_messaging/opts.py | 20 ++++++++++++++++++++ requirements.txt | 2 +- test-requirements.txt | 3 +-- 19 files changed, 87 insertions(+), 65 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 03f0c23..1ec26bf 100644 --- a/requirements.txt +++ b/requirements.txt @@ -7 +7 @@ pbr<2.0,>=1.3 -futurist>=0.1.1 # Apache-2.0 +futurist>=0.1.2 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index 0ce7632..2e0bbcf 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -10,2 +10 @@ fixtures>=1.3.1 -mock!=1.1.4,>=1.1;python_version!='2.6' -mock==1.0.1;python_version=='2.6' +mock>=1.2

1 0

[release][oslo] oslo.log release 1.7.0 (liberty)
by davanum＠gmail.com 27 Jul '15

27 Jul '15

We are gleeful to announce the release of: oslo.log 1.7.0: oslo.log library This release is part of the liberty release series. With source available at: http://git.openstack.org/cgit/openstack/oslo.log With package available at: https://pypi.python.org/pypi/oslo.log For more details, please see the git log history below and: http://launchpad.net/oslo.log/+milestone/1.7.0 Please report issues through launchpad: http://bugs.launchpad.net/oslo.log Changes in oslo.log 1.6.0..1.7.0 -------------------------------- 94aa7d7 Imported Translations from Transifex a96fb87 Add more default fancier formatting params bfc00f5 Updated from global requirements ef559bf Updated from global requirements 0a0a37e Updated from global requirements ee11222 Do not report deprecations in subclasses fafa3e4 Imported Translations from Transifex fb26b4f Updated from global requirements c2210a2 Add tox target to find missing requirements 71f3940 setting taskflow log level to WARN Diffstat (except docs and test files) ------------------------------------- oslo.log/locale/es/LC_MESSAGES/oslo.log.po | 2 +- oslo_log/_options.py | 2 +- oslo_log/formatters.py | 3 ++- oslo_log/versionutils.py | 21 ++++++++++++++++++++- requirements.txt | 4 ++-- setup.py | 2 +- test-requirements.txt | 8 +++----- tox.ini | 8 ++++++++ 9 files changed, 43 insertions(+), 12 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 6476ae0..1faa606 100644 --- a/requirements.txt +++ b/requirements.txt @@ -5 +5 @@ -pbr<2.0,>=0.11 +pbr<2.0,>=1.3 @@ -12 +12 @@ oslo.i18n>=1.5.0 # Apache-2.0 -oslo.utils>=1.6.0 # Apache-2.0 +oslo.utils>=1.9.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index 13c1a2a..c7e1e5c 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -8 +8 @@ discover -fixtures>=0.3.14 +fixtures>=1.3.1 @@ -13 +13,2 @@ testtools>=1.4.0 -oslotest>=1.5.1 # Apache-2.0 +mock>=1.2 +oslotest>=1.7.0 # Apache-2.0 @@ -23,3 +23,0 @@ oslosphinx>=2.5.0 # Apache-2.0 - -# mocking framework -mock>=1.0

1 0