- OpenStack-announce - lists.openstack.org

[OSSA 2014-039.1] Neutron DoS through invalid DNS configuration (CVE-2014-7821) ERRATA 1
by Tristan Cacqueray 10 Dec '14

10 Dec '14

OpenStack Security Advisory: 2014-039 (ERRATA 1) CVE: CVE-2014-7821 Date: December 10, 2014 Title: Neutron DoS through invalid DNS configuration Reporter: Henry Yamauchi, Charles Neill and Michael Xin (Rackspace) Products: Neutron Versions: up to 2014.1.3 and 2014.2 Description: Henry Yamauchi, Charles Neill and Michael Xin from Rackspace reported a vulnerability in Neutron. By configuring a maliciously crafted dns_nameservers an authenticated user may crash Neutron service resulting in a denial of service attack. All Neutron setups are affected. Errata: The former fix did not take into account the usage of hostnames as nameserver and caused a regression for this use-case. This update provides an additional fix for that issue. Kilo (development branch) fixes: https://review.openstack.org/135616 (original) https://review.openstack.org/137560 (errata) Juno fixes: https://review.openstack.org/135623 (original) https://review.openstack.org/139061 (errata) Icehouse fixes: https://review.openstack.org/135624 (original) https://review.openstack.org/139063 (errata) Notes: These fixes are included in the 2014.2.1 release and will be included in a future 2014.1.4 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7821 https://launchpad.net/bugs/1378450 OSSA History: 2014-12-10 - Errata 1 2014-11-19 - Original Version -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OSSA 2014-040] Horizon denial of service attack through login page (CVE-2014-8124)
by Tristan Cacqueray 09 Dec '14

09 Dec '14

OpenStack Security Advisory: 2014-040 CVE: CVE-2014-8124 Date: December 09, 2014 Title: Horizon denial of service attack through login page Reporter: Eric Peterson (Time Warner Cable) Products: Horizon Versions: up to 2014.1.3 and 2014.2 version up to 2014.2.1 Description: Eric Peterson from Time Warner Cable reported a vulnerability in Horizon. By making repeated requests to the Horizon login page a remote attacker may generate unwanted session records, potentially resulting in a denial of service. Only Horizon setups using a db or memcached session engine are affected. Kilo (development branch) fix: https://review.openstack.org/140353 Juno fix: https://review.openstack.org/140358 Icehouse fix: https://review.openstack.org/140356 django_openstack_auth fix: https://review.openstack.org/140352 Notes: This fix will be included in future 2014.1.3 and 2014.2.1 releases. The django_openstack_auth Horizon dependency requires the additional patch above. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8124 https://launchpad.net/bugs/1394370 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Nov 28 - Dec 6)
by Stefano Maffulli 05 Dec '14

05 Dec '14

1 0

OpenStack 2014.2.1 released
by Alan Pevec 05 Dec '14

05 Dec '14

Hello everyone, The OpenStack Stable Maintenance team is happy to announce the release of the 2014.2.1 stable Juno release. We have been busy reviewing and accepting backported bugfixes to the stable/juno branches according to the criteria set at: https://wiki.openstack.org/wiki/StableBranch A total of 123 bugs have been fixed across all projects. These updates to Juno are intended to be low risk with no intentional regressions or API changes. The list of bugs, tarballs and other milestone information for each project may be found on Launchpad: https://launchpad.net/ceilometer/juno/2014.2.1 https://launchpad.net/cinder/juno/2014.2.1 https://launchpad.net/glance/juno/2014.2.1 https://launchpad.net/heat/juno/2014.2.1 https://launchpad.net/horizon/juno/2014.2.1 https://launchpad.net/keystone/juno/2014.2.1 https://launchpad.net/neutron/juno/2014.2.1 https://launchpad.net/nova/juno/2014.2.1 https://launchpad.net/sahara/juno/2014.2.1 OpenStack Database Service (Trove) did not have stable/juno fixes at this time and will skip 2014.2.1 release. Release notes may be found on the wiki: https://wiki.openstack.org/wiki/ReleaseNotes/2014.2.1 The freeze on the stable/juno branches will be lifted today as we begin working toward the 2014.2.2 release, planned for Jan 29 2015 release and managed by Chuck Short. Thanks, Alan

1 0

Notice of meeting to elect Individual Directors,,The Annual Meeting of the Individual Members to elect directors for the Board of the OpenStack Foundation shall be held from January 12, 2015 to January 16, 2015, commencing at 00:01 UTC on January 12 and ending at 17:00 UTC on January 16. The meeting will be held by remote communication. While technically a "meeting" according to our bylaws, all of the voting will take place online. If you are an eligible voter, you will receive an email
by Stefano Maffulli 28 Nov '14

28 Nov '14

Notice of meeting to elect Individual Directors The Annual Meeting of the Individual Members to elect directors for the Board of the OpenStack Foundation shall be held from January 12, 2015 to January 16, 2015, commencing at 00:01 UTC on January 12 and ending at 17:00 UTC on January 16. The meeting will be held by remote communication <http://www.openstack.org/election/2015-individual-director-election/>. While technically a "meeting" according to our bylaws, all of the voting will take place online. If you are an eligible voter, you will receive an email with a link that will allow you to complete your ballot during the time that the election occurs. In the meantime, nominate OpenStack Foundation Individual Members as candidates for election <http://www.openstack.org/election/2015-individual-director-election/>. The requirements for nominating any individual to run for the Board must be completed and received by the OpenStack Foundation on or prior to 23:00 UTC on December 12, 2014. Nominations Close: 23:00 UTC, December 12, 2014. Polls Open: 00:01 UTC, January 12, 2015. Polls Close: 17:00 UTC, January 16, 2015 <http://www.timeanddate.com/worldclock/fixedtime.html?msg=Close+of+meeting+-…>. The Foundation Board of Directors is also considering three potential changes to the OpenStack Foundation Bylaws, as a result of the work during the DefCore Committee's activities. If the proposed amendments are passed at the Board meeting on December 2, they will each be on the ballot in the upcoming election January 12-16, 2015. Read an explanation of the three amendments and the proposed language <https://wiki.openstack.org/wiki/Governance/Foundation/2014ProposedBylawsAme…>. Seeing Murano Actions in action <https://www.mirantis.com/blog/seeing-murano-actions-action/> Murano is an OpenStack project that enables application developers and cloud developers to publish applications in a browsable catalog. With the catalog, users can create complex multi-tier application environments with the push of a button using published applications as building blocks. reBot – using Lego for bare metal deployments on Intel NUC <http://www.cloudbase.it/rebot/> Cloudbase uses a lot of Intel Next Unit of Computing (NUC) <http://www.intel.com/content/www/us/en/nuc/nuc-kit-d54250wyk.html> for internal testing and development work. NUCs lack the ability to power them on and off remotely, like higher grade servers do with technologies likeIPMI <http://en.wikipedia.org/wiki/Intelligent_Platform_Management_Interface>, AMT <http://www.intel.com/content/www/us/en/architecture-and-technology/intel-ac…>, iLO <http://h17007.www1.hp.com/us/en/enterprise/servers/management/ilo/index.aspx>. In pure hacker spirit, Cloudbase invented their own to have some fun. Spoiler alert: it involves Lego. Fedora Atomic, OpenStack, and Kubernetes (oh my) <http://blog.oddbit.com/2014/11/24/fedora-atomic-openstack-and-kubernetes-oh…> Lars Kellogg-Stedman <http://blog.oddbit.com/> has embarked in a fascinating journey: follow his thoughts among the most recent, bleeding edge technologies. Relevant Conversations * Converging in the project structure reform <http://lists.openstack.org/pipermail/openstack-tc/2014-November/000887.html> * Proposal to split Neutron into separate repositories <http://lists.openstack.org/pipermail/openstack-dev/2014-November/050961.html> * Paris OpenStack Summit - The Big Tent Casts a Long Shadow <http://blog.nemebean.com/content/paris-openstack-summit-big-tent-casts-long…> * [Neutron] Stale patches <http://lists.openstack.org/pipermail/openstack-dev/2014-November/050498.html> * [ossg] Introducing Bandit code security analyzer <http://lists.openstack.org/pipermail/openstack-dev/2014-November/051523.html> Deadlines and Development Priorities * Neutron Spec Proposal Deadline (SPD) <https://wiki.openstack.org/wiki/NeutronKiloProjectPlan>: Monday 12-8-2014 * Neutron Spec Approval Deadline (SAD) <https://wiki.openstack.org/wiki/NeutronKiloProjectPlan>: Monday 12-15-2014 * Deprecation of Python 2.6 CI Testing <http://lists.openstack.org/pipermail/openstack-dev/2014-November/051551.html>: Nov 30, 2014 * [Nova] Tracking Kilo priorities <http://lists.openstack.org/pipermail/openstack-dev/2014-November/051133.html> * [Neutron][IPv6] Priorities for Kilo? <http://lists.openstack.org/pipermail/openstack-dev/2014-November/051539.html> Tips ‘n Tricks * By Andy Hill <http://virtualandy.wordpress.com/>: Operating OpenStack: Monitoring RabbitMQ <http://virtualandy.wordpress.com/2014/09/02/operating-openstack-monitoring-…> * By Maish Saidel-Keesing <http://technodrone.blogspot.com/search/label/OpenStack>: Start Contributing to OpenStack - The Easy Way #docker <http://technodrone.blogspot.com/2014/11/start-contributing-to-openstack-eas…> * By Cloudenablers: Deploying Openstack with Multi-Hypervisor Environment <http://www.cloudenablers.com/blog/deploying-openstack-with-multi-hypervisor…> * By Robert van Leeuwen <http://engineering.spilgames.com/openstack-operator-tool-novacek/>: OpenStack Operator tool: Novacek <http://engineering.spilgames.com/openstack-operator-tool-novacek/> * By Stephane Combaudon <http://www.percona.com/blog/2014/11/24/schema-changes-in-mysql-for-openstac…>: Schema changes in MySQL for OpenStack Trove users <http://www.percona.com/blog/2014/11/24/schema-changes-in-mysql-for-openstac…> Reports from Previous Events * OpenStack Bootstrapping Hour: Debugging in the Gate <http://lists.openstack.org/pipermail/openstack-dev/2014-November/050922.html> Upcoming Events * Dec 01, 2014 <http://openstack.jp/events/20141201.html> Japan OpenStack User Group Meetup <http://openstack.jp/events/20141201.html> Chiyoda-ku, Tokyo, JP <http://openstack.jp/events/20141201.html> * Dec 02 - 05, 2014 <http://www.gartner.com/technology/summits/na/data-center/> Gartner Data Center Conference <http://www.gartner.com/technology/summits/na/data-center/> Las Vegas, NV <http://www.gartner.com/technology/summits/na/data-center/> * Dec 02, 2014 <http://www.gsebelux.com/Hybrid-Solutions> With or without OpenStack? <http://www.gsebelux.com/Hybrid-Solutions> Herstal, BE <http://www.gsebelux.com/Hybrid-Solutions> * Dec 09, 2014 Stockholm OpenStack Meetup Stockholm, Sweden <http://www.meetup.com/OpenStack-User-Group-Nordics/events/218754241/> * Dec 09 - 11, 2014 <http://bitex.bh/> Bitex 2014 <http://bitex.bh/> Bahrain, BH <http://bitex.bh/> * Dec 11 - 12, 2014 <http://www.e-side.co.jp/okinawaopendays/2014/en.html> Okinawa Open Days 2014 <http://www.e-side.co.jp/okinawaopendays/2014/en.html> Naha, Okinawa, JP <http://www.e-side.co.jp/okinawaopendays/2014/en.html> * Apr 13 - 14, 2015 <http://www.percona.com/live/openstack-live-2015/> OpenStack Live <http://www.percona.com/live/openstack-live-2015/> Santa Clara, CA, US <http://www.percona.com/live/openstack-live-2015/> * May 18 - 22, 2015 <https://www.openstack.org/summit/vancouver-2015/> OpenStack Summit May 2015 <https://www.openstack.org/summit/vancouver-2015/> Vancouver, BC <https://www.openstack.org/summit/vancouver-2015/> * Sep 17, 2015 <http://www.openstackbeneluxconference.nl/> OpenStack Benelux Conference 2015 <http://www.openstackbeneluxconference.nl/> Bussum, NL <http://www.openstackbeneluxconference.nl/> Other News * Horizon topics during Kilo development summit <https://www.mirantis.com/blog/horizon-topics-kilo-development-summit/> * OpenStack Series: Part 16 – Ceph in OpenStack <https://www.mirantis.com/blog/openstack-series-part-16-ceph-openstack/> * OpenStack Users are Ready to Move From Hypervisors <http://cloudtweaks.com/2014/11/openstack-users-ready-move-hypervisors/> * OpenStack Project Meeting: Summary <http://eavesdrop.openstack.org/meetings/project/2014/project.2014-11-25-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2014/project.2014-11-25-21.…>. Got Answers? Ask OpenStack <https://ask.openstack.org/> is the go-to destination for OpenStack users. Interesting questions waiting for answers: * OpenVswitch module not found in SLES 11 SP3 installation <https://ask.openstack.org/en/question/54676/openvswitch-module-not-found-in…> * What is the difference between juju and heat? <https://ask.openstack.org/en/question/54652/what-is-the-difference-between-…> * what configuration should be made in neutron during ironic installation <https://ask.openstack.org/en/question/54397/what-configuration-should-be-ma…> * What is the "share network" in manila? And is it necessary to all drivers? <https://ask.openstack.org/en/question/54356/what-is-the-share-network-in-ma…> Welcome New Reviewers, Developers and Core Reviewers yoan desbordes <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> 刘军卫 <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Cedric Dos Santos <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> ZhangYang <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Praveen Kumar <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Bharat Kumar Kobagana <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Bharat Kumar Kobagana <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> zhu.rong <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Einst Crazy <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Danny Wilson <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> kulafenghen <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> ice.yao <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Maxime Leroy <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Kai Qiang Wu <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Ikuo Kumagai <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Naohiro Tamura <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> coding1314 <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Dingyx <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> xhzhf <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Jan Kundrát <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

OpenStack Community Weekly Newsletter (Nov 14 - 21)
by Stefano Maffulli 21 Nov '14

21 Nov '14

1 0

[OSSA 2014-039] Neutron DoS through invalid DNS configuration (CVE-2014-7821)
by Tristan Cacqueray 19 Nov '14

19 Nov '14

OpenStack Security Advisory: 2014-039 CVE: CVE-2014-7821 Date: November 19, 2014 Title: Neutron DoS through invalid DNS configuration Reporter: Henry Yamauchi, Charles Neill and Michael Xin (Rackspace) Products: Neutron Versions: up to 2014.1.3 and 2014.2 Description: Henry Yamauchi, Charles Neill and Michael Xin from Rackspace reported a vulnerability in Neutron. By configuring a maliciously crafted dns_nameservers an authenticated user may crash Neutron service resulting in a denial of service attack. All Neutron setups are affected. Kilo (development branch) fix: https://review.openstack.org/135616 Juno fix: https://review.openstack.org/135623 Icehouse fix: https://review.openstack.org/135624 Notes: This fix will be included in future 2014.1.4 and 2014.2.1 releases. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7821 https://launchpad.net/bugs/1378450 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Post Paris)
by Stefano Maffulli 14 Nov '14

14 Nov '14

1 0

[OSSA 2014-038] Nova network DoS through API filtering (CVE-2014-3708)
by Tristan Cacqueray 28 Oct '14

28 Oct '14

OpenStack Security Advisory: 2014-038 CVE: CVE-2014-3708 Date: October 28, 2014 Title: Nova network DoS through API filtering Reporter: Mohammed Naser (Vexxhost) Products: Nova Versions: up to 2014.1.3, and 2014.2 Description: Mohammed Naser from Vexxhost reported a vulnerability in Nova API filters. By listing active servers using an ip filter, an authenticated user may overload nova-network or neutron-server process, resulting in a denial of services. All Nova setups are affected. Kilo (development branch) fix: https://review.openstack.org/131460 Juno fix: https://review.openstack.org/131462 Icehouse fix: https://review.openstack.org/131461 Notes: This fix will be included in future 2014.1.4 and 2014.2.1 releases. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3708 https://launchpad.net/bugs/1358583 --· Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Oct 17 – 24)
by Stefano Maffulli 24 Oct '14

24 Oct '14

1 0