- OpenStack-announce - lists.openstack.org

[OSSA 2014-003] Live migration can leak root disk into ephemeral storage (CVE-2013-7130)
by Grant Murphy 23 Jan '14

23 Jan '14

OpenStack Security Advisory: 2014-003 CVE: CVE-2013-7130 Date: January 23, 2014 Title: Live migration can leak root disk into ephemeral storage Reporter: Loganathan Parthipan (HP) Products: Nova Affects: All supported versions Description: Loganathan Parthipan from Hewlett Packard reported a vulnerability in the Nova libvirt driver. By spawning a server with the same flavor as another user's migrated virtual machine, an authenticated user can potentially access that user's snapshot content resulting in information leakage. Only setups using KVM live block migration are affected. Icehouse (development branch) fix: https://review.openstack.org/#/c/68658/ Havana (development branch) fix: https://review.openstack.org/#/c/68659/ Grizzly fix: https://review.openstack.org/#/c/68660/ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7130 https://bugs.launchpad.net/nova/+bug/1251590 -- Grant Murphy OpenStack Vulnerability Management Team

1 0

Icehouse-2 development milestone available
by Thierry Carrez 23 Jan '14

23 Jan '14

Hi everyone, The second milestone of the Icehouse development cycle, "icehouse-2" is now available for Keystone, Glance, Nova, Horizon, Neutron, Cinder, Ceilometer, Heat, and Trove. You can see the full list of new features and fixed bugs, as well as tarball downloads, at: https://launchpad.net/keystone/icehouse/icehouse-2 https://launchpad.net/glance/icehouse/icehouse-2 https://launchpad.net/nova/icehouse/icehouse-2 https://launchpad.net/horizon/icehouse/icehouse-2 https://launchpad.net/neutron/icehouse/icehouse-2 https://launchpad.net/cinder/icehouse/icehouse-2 https://launchpad.net/ceilometer/icehouse/icehouse-2 https://launchpad.net/heat/icehouse/icehouse-2 https://launchpad.net/trove/icehouse/icehouse-2 Including the oslo libraries, "only" 50 blueprints were implemented and about 650 bugs were fixed during this milestone, which is slightly less than our usual velocity at that point in the cycle. This is mostly due to the recent issues in gating and the end-of-year holiday season. The next development milestone, icehouse-3, is scheduled for March 6th. You can further track upcoming features and Icehouse release cycle status at: http://status.openstack.org/release/ Regards, -- Thierry Carrez (ttx)

1 0

OpenStack Community Weekly Newsletter (Jan 10 – 17)
by Stefano Maffulli 18 Jan '14

18 Jan '14

1 0

[OSSA 2014-002] Swift TempURL timing attack (CVE-2014-0006)
by Thierry Carrez 17 Jan '14

17 Jan '14

OpenStack Security Advisory: 2014-002 CVE: CVE-2014-0006 Date: January 16, 2013 Title: Swift TempURL timing attack Reporter: Samuel Merritt (SwiftStack) Products: Swift Affects: All supported versions Description: Samuel Merritt from SwiftStack reported a timing attack vulnerability in Swift TempURL middleware. By analyzing response times to arbitrary TempURL requests, an attacker may be able to guess valid secret URLs and get access to objects that were only intended to be publicly shared with specific recipients. In order to use this attack, the attacker needs to know the targeted object name, and the object account needs to have a TempURL key set. Only Swift setups enabling the TempURL middleware are affected. Icehouse (development branch) fix: https://review.openstack.org/#/c/67185/ Havana (1.10.0) fix: https://review.openstack.org/#/c/67186/ Grizzly (1.8.0) fix: https://review.openstack.org/#/c/67187/ Note: the Icehouse fix will be included in upcoming 1.12.0 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0006 https://bugs.launchpad.net/swift/+bug/1265665 Regards, -- Thierry Carrez OpenStack Vulnerability Management Team

1 0

[OSSA 2014-001] Nova live snapshots use an insecure local directory (CVE-2013-7048)
by Thierry Carrez 13 Jan '14

13 Jan '14

OpenStack Security Advisory: 2014-001 CVE: CVE-2013-7048 Date: January 13, 2013 Title: Nova live snapshots use an insecure local directory Reporter: Daniel Berrange (Red Hat) Products: Nova Affects: Grizzly and later Description: Daniel Berrange from Red Hat reported that the directories used to temporarily store live snapshots on Nova compute nodes were writable to all local users. A local attacker with shell access on compute nodes could therefore read and modify the contents of live snapshots before those are uploaded to the image service. Icehouse (development branch) fix: https://review.openstack.org/#/c/58852/ Havana fix: https://review.openstack.org/#/c/60548/ Grizzly fix: https://review.openstack.org/#/c/60550/ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7048 https://bugs.launchpad.net/nova/+bug/1227027 Regards, -- Thierry Carrez OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Jan 3 – 10)
by Stefano Maffulli 10 Jan '14

10 Jan '14

1 0

OpenStack Community Weekly Newsletter (Jan 3 2014)
by Stefano Maffulli 04 Jan '14

04 Jan '14

1 0

OpenStack Community Weekly Newsletter (Dec 20 – 27)
by Stefano Maffulli 27 Dec '13

27 Dec '13

OpenStack “J” naming poll closed <http://lists.openstack.org/pipermail/openstack/2013-December/004035.html> Polls closed, the OpenStack community decided: Juno will be the name of the OpenStack development cycle starting in May 2014, after the Icehouse cycle completes. Third party testing with Turbo-Hipster <http://josh.people.rcbops.com/2013/12/third-party-testing-with-turbo-hipste…> Soon you are going to see a new robot barista leaving comments on Nova code reviews. He is obsessed with espresso, that band you haven’t heard of yet, and easing the life of OpenStack operators. Doing a large OpenStack deployment has always been hard when it came to database migrations. Running a migration requires downtime, and when you have giant datasets that downtime could be hours. To help catch these issues a <http://josh.people.rcbops.com/2013/09/building-a>new zuul worker <http://josh.people.rcbops.com/2013/09/building-a-zuul-worker/> called Turbo-Hipster will run your patchset’s migrations against copies of real databases. This will give you valuable feedback on the success of the patch, and how long it might take to migrate. How to Upgrade an OpenStack Swift Cluster with No Downtime <http://swiftstack.com/blog/2013/12/20/upgrade-openstack-swift-no-downtime/> OpenStack Swift deployers can upgrade from one version of Swift to the next with zero downtime for end users. This has been supported since the initial release of OpenStack Swift back in 2010. OpenStack Project Update Webinars <http://www.openstack.org/blog/2013/12/openstack-project-update-webinars/> To allow for broader participation, we’ve scheduled post-Summit webinars with the Project Team Leads (PTLs) to provide the latest project updates rather than schedule these tracks during the Summit. Next scheduled events: *Tuesday, January 7, 2013* 7 a.m. Pacific/10 a.m. Eastern Project team leads: Mark Washenberger, Image Service (Glance); Julien Danjou, Telemetry (Ceilometer); John Griffith, Block Storage (Cinder) Register: http://openstack.enterthemeeting.com/m/4BC36YZQ *Thursday, January 9, 2013* Noon Pacific/3 p.m. Eastern* Project team leads: Steve Baker, Orchestration (Heat) and David Lyle, Dashboard (Horizon) Register: http://openstack.enterthemeeting.com/m/AXQYKMP7 *Recorded session* Russell Bryant, Compute (Nova) and John Dickinson, Object Storage (Swift) <http://www.youtube.com/watch?v=BZt_r54_vCM&feature=share&list=UUQ74G2gKXdpw…> /The recording of the session by Mark McClain, Networking (Neutron) and Dolph Mathews, Identity (Keystone) will be published as soon as possible./ Tips ‘n Tricks * By Chmouel Boudjnah <http://blog.chmouel.com/>: The life of an OpenStack contributor checking for Jenkins failures <http://blog.chmouel.com/2013/12/24/life-of-openstack-contributor-jenkins-fa…> * By Lars Kellogg-Stedman <http://blog.oddbit.com/>: Visualizing Neutron Networking with GraphViz <http://blog.oddbit.com/2013/12/23/visualizing-network-with-graphviz> * By Sébastien Han <http://sebastien-han.fr/>: OpenStack, Ceph RBD and QoS <http://sebastien-han.fr/blog/2013/12/23/openstack-ceph-rbd-and-qos/> Upcoming Events * 3rd OpenStack User Group Nordics meetup <http://www.meetup.com/OpenStack-User-Group-Nordics/events/141728912/> Jan 15, 2014 – Stockholm, Sweden Details <http://www.meetup.com/OpenStack-User-Group-Nordics/events/141728912/> * Austin OpenStack User Group Meetup <http://www.meetup.com/OpenStack-Austin/events/154504332/> Jan 22, 2014 – Austin, Texas Details <http://www.meetup.com/OpenStack-Austin/events/154504332/> * FOSDEM <https://fosdem.org/2014/> Feb 01 – 02, 2014 – Bruxelles, Belgium Details <https://fosdem.org/2014/> * Austin OpenStack User Group Meetup <http://www.meetup.com/OpenStack-Austin/events/154331162/> Feb 19, 2014 – Austin, Texas Details <http://www.meetup.com/OpenStack-Austin/events/154331162/> Got Answers? Ask OpenStack <https://ask.openstack.org/> is the go-to destination for OpenStack users. Interesting questions waiting for answers: * Glance image-create returns HTTPInternalServerError (HTTP 500) <https://ask.openstack.org/en/question/9570/glance-image-create-returns-http…> * How to change VNC frame size in Horizon? <https://ask.openstack.org/en/question/9351/how-to-change-vnc-frame-size-in-…> * How to set default network for project? <https://ask.openstack.org/en/question/9328/how-to-set-default-network-for-p…> * Trouble Installing Multi-Node OpenStack RDO and Gluster Backend on F19 <https://ask.openstack.org/en/question/9365/trouble-installing-multi-node-op…> * No network communication on a 3 node Havana setup <https://ask.openstack.org/en/question/9394/no-network-communication-on-a-3-…> * How to configure VM to have only one network interface <https://ask.openstack.org/en/question/9464/how-to-configure-vm-to-have-only…> * How does nova-baremetal-deploy-helper service get to run? <https://ask.openstack.org/en/question/9506/how-does-nova-baremetal-deploy-h…> * How to configure DHCP agent when I’m using openvswitch and linux bridge in cloud at the same time <https://ask.openstack.org/en/question/9532/how-to-configure-dhcp-agent-when…> * Getting TypeError SQLite DateTime while creating multi-region setup <https://ask.openstack.org/en/question/9536/getting-typeerror-sqlite-datetim…> * Disable networking – Is it possible ? <https://ask.openstack.org/en/question/9538/disable-networking-is-it-possibl…> * How to add a menu in horizon? <https://ask.openstack.org/en/question/9542/how-to-add-a-menu-in-horizon/> Welcome New Reviewers and Developers Is your affiliation correct? Check your profile in the OpenStack Foundation Members Database! <http://www.openstack.org/profile/> Pentheus <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Jia Dong <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Lee Li <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Yuanchao Sun <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Sergey Nikitin <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Michael Krotscheck <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Taurus Cheung <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> JiaHao Li <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Vadim Rovachev <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Haojie Jia <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Tim Bell <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Bob Callaway <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Stanislav Kudriashev <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Sergey Nikitin <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Ken Perkins <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Dmitry Kulishenko <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> shihanzhang <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Navid Shaikh <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Jaume Devesa <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Igor A. Lukyanenkov <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Cedric Brandily <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Feng Ju <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Yanis Guenane <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Mikhail Durnosvistov <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Latest Activity In Projects Do you want to see at a glance the bugs filed and solved this week? Latest patches submitted for review? Check out the individual project pages on OpenStack Activity Board – Insights <http://activity.openstack.org/data/display/OPNSTK2/>. * Telemetry (Ceilometer) <http://activity.openstack.org/data/display/OPNSTK2/ceilometer> * Block Storage (Cinder) <http://activity.openstack.org/data/display/OPNSTK2/cinder> * Image Service (Glance) <http://activity.openstack.org/data/display/OPNSTK2/glance> * Orchestration API <http://activity.openstack.org/data/display/OPNSTK2/heat> (Heat) <http://activity.openstack.org/data/display/OPNSTK2/heat> * Dashboard (Horizon) <http://activity.openstack.org/data/display/OPNSTK2/horizon> * Bare Metal Provisioning (Ironic) <http://activity.openstack.org/data/display/OPNSTK2/ironic> * Identity (Keystone) <http://activity.openstack.org/data/display/OPNSTK2/keystone> * Manuals <http://activity.openstack.org/data/display/OPNSTK2/openstack-manuals> * Networking (Neutron) <http://activity.openstack.org/data/display/OPNSTK2/neutron> * Compute (Nova) <http://activity.openstack.org/data/display/OPNSTK2/nova> * Hadoop Cluster as a Service (Savanna) <http://stackalytics.com/?release=icehouse&metric=commits&project_type=opens…> * Object Storage (Swift) <http://activity.openstack.org/data/display/OPNSTK2/swift> * Database As A Service (Trove) <http://activity.openstack.org/data/display/OPNSTK2/trove> /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

OpenStack Community Weekly Newsletter (Dec 13 – 20)
by Stefano Maffulli 20 Dec '13

20 Dec '13

1 0

[OSSA 2013-037] Nova compute DoS through ephemeral disk backing files (CVE-2013-6437)
by Thierry Carrez 18 Dec '13

18 Dec '13

OpenStack Security Advisory: 2013-037 CVE: CVE-2013-6437 Date: December 18, 2013 Title: Nova compute DoS through ephemeral disk backing files Reporter: Phil Day (HP) Products: Nova Affects: All supported versions Description: Phil Day from HP reported a vulnerability in the libvirt driver handling of ephemeral disk backing files on Nova compute nodes. By repeatedly creating snapshots, changing the os_type to a new random value, and spawning new instances from the snapshot (and quickly deleting those instances), an authenticated user could generate lots of different ephemeral disk backing files and fill up compute node disks, potentially resulting in a Denial of Service against a Nova setup. Only Nova setups running the libvirt driver are affected. Icehouse (development branch) fix: https://review.openstack.org/62910 Havana fix: https://review.openstack.org/62912 Grizzly fix: https://review.openstack.org/62913 References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6437 https://bugs.launchpad.net/nova/+bug/1253980 Regards, -- Thierry Carrez OpenStack Vulnerability Management Team

1 0