- OpenStack-announce - lists.openstack.org

[OSSA 2012-020] Information leak in libvirt LVM-backed instances (CVE-2012-5625)
by Thierry Carrez 11 Dec '12

11 Dec '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 OpenStack Security Advisory: 2012-020 CVE: CVE-2012-5625 Date: December 11, 2012 Title: Information leak in libvirt LVM-backed instances Reporter: Eric Windisch (Cloudscaling) Products: Nova Affects: Folsom, Grizzly Description: Eric Windisch from Cloudscaling reported a vulnerability in libvirt LVM-backed instances. The physical volume content was not wiped out before being reallocated and passed to an instance, which may result in the disclosure of information from previously-allocated logical volumes. Only setups using libvirt and LVM-backed instances (libvirt_images_type=lvm) are affected. Grizzly (development branch) fix: http://github.com/openstack/nova/commit/9d2ea970422591f8cdc394001be9a2deca4… Folsom fix (included in upcoming Nova 2012.2.2 stable update): http://github.com/openstack/nova/commit/a99a802e008eed18e39fc1d98170edc495c… References: https://bugs.launchpad.net/nova/+bug/1070539 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2012-5625 - -- Thierry Carrez (ttx) OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iQIcBAEBCAAGBQJQx4DRAAoJEFB6+JAlsQQj5sEP/2osrfWvooWEeQbhnHGIp7yg GRR1BdPqqnBqBT4lzXp1B6O23l4LqSjKVC1X3r3zs2VqUcsZwTiJJz3FmPFlr0xZ 5BSSrg4GWo+If0atGqsWwOabTzuOZqCoFe16uXghtBwjmceZBjUOhra4mfnW+VtO xVc9eXiREEnxkHFHVPVuNnAxdxgoYin8Nw0NaOs+uZ9ehTjv2h0/81FNGNy3Rw5Y TPJOq3YFrneAK5GEL/srhV+3V6LnRKXqlPIhFbw5wqO+WlHZWOHnayL/hQZaivdF gYiuaTkwU2d6yKbasy+q9flreylZbtllcj1p3IGvoAFbTSA3u2l3AeElqnx6D+ak ULxIpLQGlBzabiUDLpSe+9t/gv7bY7qcf+Ec1u6DsgRpN/GhHHwBKykzoQwvTPS/ Of+CfmJj39NJarepUHMO7GMVUu/BYkQm4EnfPAnP8X8Gz5/0xJjo2ue7vnx8yuxC M7CPxWx3pZanC98n1omF5GvRlcdWECmbcP7NYynXhrROOw8mgXAs+Eh77mD94flk iZULo5fOJDShCVY+LmekzHix9WNRQSWxceAMYHrlNLo/H4zN5DWo063xgxYlSuNI +jfJ6DtqePjjG+c9tDcpVG9/OMxpyN8CKoWDSVWwdkTega3a7e1AAf9xEj0jT1jd OC2iQxz1crzjL1CV9z3J =CE4b -----END PGP SIGNATURE-----

1 0

OpenStack Community Weekly Newsletter (Nov 16-30)
by Stefano Maffulli 30 Nov '12

30 Nov '12

Highlights of the weeks OpenStack Outreach Program for Women Still Accepting Candidates <http://www.openstack.org/blog/2012/11/openstack-outreach-program-for-women-…> We are constantly moving and growing and very excited to invite newcomers to our community. To this end, the OpenStack Foundation has joined the GNOME Outreach Program for Women. The Women in OpenStack group has already found some mentors for the program and ideas for projects are flowing in. If you know women that may be interested in joining OpenStack please tell them to read our blog post <http://www.openstack.org/blog/2012/11/openstack-outreach-program-for-women-…> with more details. The deadline is approaching (Dec 3) and we still have place for candidates. OpenStack Nova, Glance, Keystone, Cinder, Quantum and Horizon 2012.2.1 released <http://lists.openstack.org/pipermail/openstack-announce/2012-November/00005…> The OpenStack Stable Branch Maintainers Team has been busy selectively back-porting bugfixes to the stable/folsom branch according to our "safe source of high-impact fixes" criteria documented on the wiki page StableBranch <http://wiki.openstack.org/StableBranch>. We're happy to announce the 2012.2.1 release, the first in the series of releases to make available the bugfixes from stable/folsom. A total of 139 bugs have been fixed in this release, which is a higher than the usual volume of fixes in a stable release. What to expect from Grizzly-1 milestone <http://fnords.wordpress.com/2012/11/23/what-to-expect-from-grizzly-1-milest…> The first milestone of the OpenStack Grizzly development cycle is just out <http://lists.openstack.org/pipermail/openstack-announce/2012-November/00005…>. What should you expect from it? What significant new features were added? With more than 399 bugfixes landing in this milestone, Grizzly-1 contains already lots of new features. Thierry's blog post adds details for what changed in each component. Developing OpenStack Dashboard using Fedora <http://www.matthias-runge.de/2012/11/20/developing-openstack-dashboard-usin…> Many developers recommend using devstack <http://devstack.org/> to work on OpenStack. Matthias Runge <http://www.matthias-runge.de/> doesn't recommend that for Dashboard (Dan Berrange <http://berrange.com/> has an article providing more details <http://berrange.com/posts/2012/11/20/what-devstack-does-to-your-host-when-s…>). Good news is, at least for OpenStack's dashboard, devstack is not required in any case, it just runs on plain Fedora. Matthias swears that the instructions provided for Fedora's test day <https://fedoraproject.org/wiki/Test_Day:2012-09-18_OpenStack> worked great, no rocket science and no engineering master required. What DevStack does to your host when setting up OpenStack on Fedora 17 <http://berrange.com/posts/2012/11/20/what-devstack-does-to-your-host-when-s…> DevStack is one of those huge, massive scripts that requires super user access to your machine. Understanding what it does to your setup is pretty complex. Daniel P. Berrangé <http://berrange.com/> did most of the work for us investigating just what DevStack does to a Fedora 17 host when it is run. Fascinating read. The Future of Incubation and Core <http://blogs.gnome.org/markmc/2012/11/17/the-future-of-incubation-and-core/> Mark McLoughlin summarizes quite well the ongoing discussion to define the future of Incubation nd Core. The OpenStack Technical Committee <http://www.openstack.org/foundation/technical-committee/> and the OpenStack Foundation Board of Directors <http://www.openstack.org/foundation/board-of-directors/> have pretty separate sets of responsibilities and can get on with their work independently. One exception to that is the inclusion of new projects in OpenStack. In the coming weeks, members of the two bodies will decide how to clarify confusion around the term "core project" and what exactly happens projects who graduate through OpenStack's Incubation process. A thread on the openstack-dev mailing list <http://lists.openstack.org/pipermail/openstack-dev/2012-November/thread.htm…> is ongoing and is a great example of how a mailing list discussion can actually help to drive a rough consensus while still giving everyone an opportunity to express their views.// Driving a 100 Gigabit Network with OpenStack <http://buriedlede.blogspot.com/2012/11/driving-100-gigabit-network-with.html> Argonne National Laboratory is interested in building IaaS cloud systems that perform similarly to traditional HPC cluster-style systems for one of their projects. Narayan Desai <https://plus.google.com/111442327943164013992> reports on the work to validate the ability of an Openstack system to drive large quantities of network bandwidth, memory to memory. *Go to Australia in January for an OpenStack day at LCA2013 <http://bit.ly/Waue30>* Being held in January in Canberra, Australia, linux.conf.au is one of the foremost open source conferences in the world, and is considered the most prestigious in the southern hemisphere. Linux.conf.au's first ever OpenStack miniconf day is being held Jan 29, and we expect over 200 people will be attending the miniconf alone, with hundreds more attending the week long conference. More information is available at http://lca2013.linux.org.au/wiki/Miniconfs/OpenStack and the CFP is open <http://bit.ly/Waue30>. Security Advisories * EC2-style credentials invalidation issue (CVE-2012-5571) <http://lists.openstack.org/pipermail/openstack-announce/2012-November/00005…> * Extension of token validity through token chaining (CVE-2012-5563) <http://lists.openstack.org/pipermail/openstack-announce/2012-November/00005…> Tips and tricks * By Mirantis <http://www.mirantis.com/>: Working through DNS and DHCP service configuration issues in OpenStack Nova <http://www.mirantis.com/blog/dns-dhcp-service-configuration-openstack-nova/> * By SwiftStack Team <http://swiftstack.com/>ç Video: How the Ring Works in OpenStack Swift <http://swiftstack.com/blog/2012/11/21/how-the-ring-works-in-openstack-swift/> * By Emilien Macchi <http://my1.fr/blog>: First Guide to Deploy OpenStack Folsom on Ubuntu 12.04 <http://my1.fr/blog/first-guide-to-deploy-openstack-folsom-on-ubuntu-12-04/?…> * By Daniel P. Berrangé <http://berrange.com/>: Walk through of running OpenStack on Fedora 17 using DevStack <http://berrange.com/posts/2012/11/19/walk-through-of-running-openstack-on-f…> * By Alessandro Pilotti <http://www.cloudbase.it/>: DevStack on Hyper-V <http://www.cloudbase.it/devstack-on-hyper-v/> Upcoming Events * Pune OpenStack Meetup <http://www.meetup.com/Indian-OpenStack-User-Group/events/89610092/> Dec 02, 2012 -- Pune, India Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/89610092/> * EMEA OpenStack Day <http://emeaopenstackday2.eventbrite.com/> Dec 05, 2012 -- London Details <http://emeaopenstackday2.eventbrite.com/> * OpenStack Ireland December Meeting <http://www.meetup.com/OpenStack-Ireland/events/92413652/> Dec 06, 2012 -- Bishopstown, Cork, Ireland Details <http://www.meetup.com/OpenStack-Ireland/events/92413652/> * Palestra: Explorando o OpenStack <http://papers.consegi.gov.br/pub/programacao/823> Dec 07, 2012 -- Belem, BR Details <http://papers.consegi.gov.br/pub/programacao/823> * OpenStack China Tour: Wuhan <http://hui.csdn.net/MeetingInfo.aspx?mid=157> Dec 22, 2012 -- Wuhan, China Details <http://hui.csdn.net/MeetingInfo.aspx?mid=157> Other news * Report from past events: o Australian OpenStack UG -- Sydney, Melbourne, Brisbane Tri-City Meetup 20/11/12 <http://www.openstack.org/blog/2012/11/australian-openstack-ug-sydney-melbou…> o November month OpenStack meetup, India <http://www.openstack.org/blog/2012/11/report-november-month-openstack-meetu…> o 1st OpenStack Swiss User Group Meeting <https://wiki.systemsx.ch/display/chosug/2012.11.15+1st+OpenStack+User+Group…> * jclouds 1.5.3 Released With OpenStack Cinder and Rackspace Cloud Block Storage Support <http://blog.phymata.com/2012/11/20/jclouds-1-5-3-with-cinder-and-rackspace-…> * A new Nova service: nova-conductor <http://russellbryantnet.wordpress.com/2012/11/19/a-new-nova-service-nova-co…> * Bufunfa -- Chargeback [Billing] for OpenStack <http://lists.openstack.org/pipermail/openstack-dev/2012-November/003043.html> * OpenStack Project Meeting: Summary <http://eavesdrop.openstack.org/meetings/project/2012/project.2012-11-20-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2012/project.2012-11-20-21.…>, Summary <http://eavesdrop.openstack.org/meetings/project/2012/project.2012-11-27-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2012/project.2012-11-27-21.…> Welcome new contributors Celebrating the first patches submitted this week by: * Yolanda Robla, Canonical * dekehn * Ken'ichi Ohmichi, NEC * Belmiro Moreira * Anita Kuno * Shrutiranade38 * Morgan Fainber, Metacloud * Wangpan, Netease /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

[ANNOUNCE] OpenStack Nova, Glance, Keystone, Cinder, Quantum and Horizon 2012.2.1 released
by Mark McLoughlin 29 Nov '12

29 Nov '12

Hey, In the time since the Folsom release, we have been busy selectively back-porting bugfixes to the stable/folsom branch according to our "safe source of high-impact fixes" criteria documented here: http://wiki.openstack.org/StableBranch We're happy to announce the 2012.2.1 release, the first in the series of releases to make available the bugfixes from stable/folsom. These releases are bugfix updates to Folsom and are intended to be relatively risk free with no intentional regressions or API changes. A total of 139 bugs have been fixed in this release, which is a higher than the usual volume of fixes in a stable release. The list of bugs fixed can be seen here: https://launchpad.net/nova/folsom/2012.2.1 https://launchpad.net/glance/folsom/2012.2.1 https://launchpad.net/keystone/folsom/2012.2.1 https://launchpad.net/cinder/folsom/2012.2.1 https://launchpad.net/quantum/folsom/2012.2.1 https://launchpad.net/horizon/folsom/2012.2.1 Please read (and add to!) the release notes at: http://wiki.openstack.org/ReleaseNotes/2012.2.1 Enjoy! Mark.

1 0

[OSSA 2012-019] Extension of token validity through token chaining (CVE-2012-5563)
by Thierry Carrez 28 Nov '12

28 Nov '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 OpenStack Security Advisory: 2012-019 CVE: CVE-2012-5563 Date: November 28, 2012 Title: Extension of token validity through token chaining Reporter: Anndy Products: Keystone Affects: Folsom, Grizzly Description: Anndy reported a vulnerability in token chaining in Keystone. A token expiration date can be circumvented by creating a new token before the old one has expired. An authenticated and authorized user could potentially leverage this vulnerability to extend his access beyond the account owner expectations. Note: this vulnerability was fixed in the past (CVE-2012-3426) but was reintroduced in Folsom when code was refactored to support PKI tokens. Grizzly (development branch) fix: https://github.com/openstack/keystone/commit/38c7e46a640a94da4da89a39a5a1ea… Folsom fix (included in upcoming Keystone 2012.2.1 stable update): https://github.com/openstack/keystone/commit/f9d4766249a72d8f88d75dcf1575b2… References: https://bugs.launchpad.net/keystone/+bug/1079216 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2012-5563 - -- Thierry Carrez (ttx) OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iQIcBAEBCAAGBQJQtjwXAAoJEFB6+JAlsQQj3cwP/3FUjqWBxAHgRTMWz2Df5JML DZIelkcq3kxSn05GCJ25FU5JyA3lWvqqoEsU4+SxytBTNAGYhDe8toSo74xU4PlU g3+A2V5oUMEJnyCS6ps7YMiLmd1unN3Fz/yrqxAZE7GRv+voD1l64+2IHK15bN7G WG+FxN3CgRK+pk+3MpPkaNLI1L9wTeYTPUgBdem+I7xhmLRsf5TBO1gqu3gHja1+ gvpWjezroWrVdAuqWFFsgzWf7LUZqZR/AqaWwS4DrHJ4LoD+ruHXNGvGyg1BQg8d IhqgAhBSdndlaJWTr6fj2KoqhpJK8Wu4VKIr9yIekbQIzJx11IYA9vjiJ38eJ2v1 x2NLnNDKrq2Q51l+iAy5MMbqmFWqljwZhPNfDW+ysybFMG1CtEnCgQPLqmbF9m9m 8M9uV/vfGKuD73GpmMR7MlHldySv+uiqJnFzyCce+QMzP7enCBitBDp0t52dRal7 TrTR7HGXIkVJ4I/73o3MBAfQrzmTsSIYmuVybArnaNzvrcT6aZTKH8hSPWRKVqx/ pcBP7Z+wLzHkJELWD0X9vgZJZJUj5qbMx6jq0NYYWY1lCrLTIRxXppS76/ZUzzIm qGS7FqUQM8u+x8rynnKNattFjWOdwXcFhcy3Io3Noc3kBDTgZf4fshBHWbO0XOqf BI3upFpAwQ4g4ep16o1k =CZnJ -----END PGP SIGNATURE-----

1 0

[OSSA 2012-018] EC2-style credentials invalidation issue (CVE-2012-5571)
by Thierry Carrez 28 Nov '12

28 Nov '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 OpenStack Security Advisory: 2012-018 CVE: CVE-2012-5571 Date: November 28, 2012 Title: EC2-style credentials invalidation issue Reporter: Vijaya Erukala Products: Keystone Affects: All versions Description: Vijaya Erukala reported a vulnerability in Keystone EC2-style credentials invalidation: when a user is removed from a tenant, issued EC2-style credentials would continue to be valid for that tenant. An authenticated and authorized user could potentially leverage this vulnerability to extend his access beyond the account owner expectations. Only setups enabling EC2-style credentials (for example enabling EC2 API in Nova) are affected. Grizzly (development branch) fix: http://github.com/openstack/keystone/commit/9d68b40cb9ea818c48152e6c712ff41… Folsom fix (included in upcoming Keystone 2012.2.1 stable update): http://github.com/openstack/keystone/commit/37308dd4f3e33f7bd0f71d83fd51734… Essex fix: http://github.com/openstack/keystone/commit/8735009dc5b895db265a1cd573f39f4… References: https://bugs.launchpad.net/keystone/+bug/1064914 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2012-5571 - -- Thierry Carrez (ttx) OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iQIcBAEBCAAGBQJQtjAkAAoJEFB6+JAlsQQj+4sP/0uKJHxXeCY3HcAdMUtkYP+5 QyQGnscOhlggr9iE3ifPWkiLALPbfVrdwp/nJr0psXiUnf60QX4Pfj63VJz23DSf 1Hk/Z3yY5oWmCCgT8/DMgw+SPhkn09YfS6f5KwuMR5zdEX345myp2MFcc1/mgNzx CfVKagHoCq8rrIhTjhAvyy5iwY/ZvbDFIgWKzgr3KCSm+76QuIqIoXHkdiCGYm4q OMfKEcS1WQZlmUddc54fR2g6kFY/sIsVKGdCtqJBqc6COU+MyUuhNvs7niXGK1Ep cU3U7tV6JCK58K70vgtQ0O5EWcDKm/Yfh5Sf/wmJTDwE2UxI8OGNEAzNJl/qxdEw iMUp/qRObtnN2t7pF2Rf7/ixZsTWSxpFToq6BZl4O4pghqQZQgZ9dGVgtSFkX8Tn crMjs8oWwtJuu1/paHje0O+9Y23NHMIdAg3ccjJUkC8MxfcnrxZkYd5XHZytecff iWPUWmm3ISFkOQQPuemah0vcu2Y+YvhjEY9b5nL2Ew6I/E4DeYxL1HwpeBA0lzrt w7nQgWCyf+ERz2g1liesuaSJ0CPBmKe93ji20kVvHTV9IRXmC3zK/SDhXtgultVo DmY/ovoUjTw9sg60CceTNXAUz4/4QbbUV79vFQ/06sThZ8t7ZW1kTfOrTSG6M4uw a557x0IhXfUedbbLCsE6 =+0zu -----END PGP SIGNATURE-----

1 0

Grizzly-1 development milestone available (Keystone, Glance, Nova, Horizon, Quantum, Cinder)
by Thierry Carrez 23 Nov '12

23 Nov '12

Hi everyone, The first milestone of the Grizzly development cycle, "grizzly-1" is now available. It contains all the new features that have been added since the Folsom pre-release Feature Freeze in September. You can see the full list of new features and fixed bugs, as well as tarball downloads, at: https://launchpad.net/keystone/grizzly/grizzly-1 https://launchpad.net/glance/grizzly/grizzly-1 https://launchpad.net/nova/grizzly/grizzly-1 https://launchpad.net/horizon/grizzly/grizzly-1 https://launchpad.net/quantum/grizzly/grizzly-1 https://launchpad.net/cinder/grizzly/grizzly-1 The Grizzly development cycle is now in full swing. The next milestone, grizzly-2, is scheduled for delivery on January 10th. Regards, -- Thierry Carrez (ttx) Release Manager, OpenStack

1 0

[Swift] Swift 1.7.5 released
by John Dickinson 20 Nov '12

20 Nov '12

I'm pleased to announce that Swift 1.7.5 has been released. This release is the work of twenty-seven contributors and includes several important new features and bug fixes. You can get a tarball of this release at http://launchpad.net/swift/+milestone/1.7.5. Like all Swift releases, you can upgrade your currently running clusters to this version with no client downtime. The (https://github.com/openstack/swift/blob/master/CHANGELOG) is also available with the source. This release would not have been possible without the hard work of the many contributors and core developers who spent time submitting and reviewing patches. With the addition of the nine new contributors in this release, Swift has eighty-four total contributors. You can see the full list of contributors at https://github.com/openstack/swift/blob/master/AUTHORS. I'd like to highlight a few of the bigger changes to Swift that have gone into this release. CORS Swift now supports setting CORS (http://en.wikipedia.org/wiki/Cross-origin_resource_sharing) headers on your data. This allows HTML5 forms, browser uploads, and JavaScript to work between your website and your Swift storage. Users can set `X-Container-Meta-Access-Control-Allow- Origin`, `X-Container-Meta-Access-Control-Max-Age`, and `X-Container- Meta-Access-Control-Allow-Headers` on their containers to allow CORS support. Custom log handlers Custom log handlers allow depoyers to more easily integrate with external log processors. This mechanism provides the ability to add your own handler to the log messages that Swift generates. The full docs are at http://docs.openstack.org/developer/swift/admin_guide.html#custom-log-handl…. Multi-Range GETs Swift has always supported single range requests, but the HTTP spec allows for requesting multiple ranges of a resource at once. Swift now supports this feature on standard objects, and support against large object manifests should be available in a later release. Configurable constraints Deployers can set the client limits in a config file. These limits include the maximum object size, the maximum number of items returned in listings, and the limits on metadata. You can read the fully- commented sample config file at https://github.com/openstack/swift/blob/master/etc/swift.conf-sample. Replicators can run against a specific partition or device Replicators can now replicate a specific partition or device. This feature allows deployers to prioritize data replication for data that may not be fully replicated. For example, although Swift detects missing replicas automatically, a deployer can choose to replicate a specific set of data before the automatic systems detect the error. --John

1 0

OpenStack Community Weekly Newsletter (Nov 9-16)
by Stefano Maffulli 16 Nov '12

16 Nov '12

Highlights of the week OpenStack Outreach Program for Women Accepting Candidates <http://www.openstack.org/blog/2012/11/openstack-outreach-program-for-women-…> OpenStack provides open source software for building public and private clouds. We are constantly moving and growing and very excited to invite newcomers to our community. To this end, the OpenStack Foundation has joined the GNOME Outreach Program for Women <https://live.gnome.org/OutreachProgramForWomen>. Join the list of mentors, contribute ideas <http://wiki.openstack.org/OutreachProgramForWomen/Ideas>, apply as intern. What's new in libvirt for the OpenStack Nova Folsom release <http://berrange.com/posts/2012/11/16/what-was-new-in-libvirt-for-the-openst…> Even if Folsom has been out for a while now, Daniel P. Berrangé <http://berrange.com/> provided a little more detail on some of the changes he was involved with making to the libvirt driver and what motivated them. Why to refactor the virt disk API in Nova <http://berrange.com/posts/2012/11/15/692/> When launching a virtual machine, Nova <http://openstack.org/> has the ability to inject various files into the disk image immediately prior to boot up. Nova runs as an unprivileged user, and the guest files to be changed are typically owned as root. This means all the file injection commands need to run via Nova's rootwrap utility to gain root privileges. It should come as little surprise that this has already resulted in a security vulnerability / CVE <https://lists.launchpad.net/openstack/msg14089.html> against Nova. The solution to this class of security problems is to decouple the file injection code from the host filesystem. Read more on Daniel's blog post <http://berrange.com/posts/2012/11/15/692/>. Swift 1.7.5 Released <http://swiftstack.com/blog/2012/11/14/swift-1.7.5-release/> Swift 1.7.5 has been released. This release is the work of twenty-seven contributors and includes several important new features and bug fixes. Making keystoneclient python library a little easier to work with <http://www.rhonabwy.com/wp/2012/11/11/making-keystoneclient-python-library-…> A quick guide to using the python keystoneclient library and some of its new features, with v2 API examples throughout. Installing OpenStack Nova Compute on Hyper-V <http://www.cloudbase.it/installing-openstack-nova-compute-on-hyper-v/> A lot of work went on OpenStack and Hyper-V integration, with the result of bringing back Hyper-V in the Nova sources <https://github.com/openstack/nova> in time for the Folsom release. Get started with OpenStack and Hyper-V using the installer developed by Cloudbase Solutions. Security Advisories * CVE-2012-4573, CVE-2012-5482 -- Authentication bypass for image deletion <http://secstack.org/2012/11/cve-2012-4573-cve-2012-5482-authentication-bypa…> Tips and tricks * By Hui Cheng <http://freedomhui.com/>: How to Deploy Hadoop Cluster In Openstack Intances Using Apache Ambari <http://freedomhui.com/2012/11/how-to-deploy-hadoop-cluster-using-apache-amb…> * By Sébastien Han <http://sebastien-han.fr/>: OpenStack Retrieve usage statictics <http://sebastien-han.fr/blog/2012/11/09/tip-openstack-retrieve-usage-static…> Upcoming Events * OpenStack Delhi NCR Meetup <http://www.meetup.com/Indian-OpenStack-User-Group/events/90700582/> Nov 17, 2012 -- Delhi, India Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/90700582/> * Australian OpenStack User Group -- Brisbane Technical Meetup <http://aosug.openstack.org.au/> Nov 20, 2012 -- Brisbane and other cities Details <http://aosug.openstack.org.au/> * OpenStack China Tour: Nanjing <http://hui.csdn.net/MeetingInfo.aspx?mid=155> Nov 24, 2012 -- Nanjing, China Details <http://hui.csdn.net/MeetingInfo.aspx?mid=155> * OpenStack Users November meetup <http://www.meetup.com/Indian-OpenStack-User-Group/events/90021782/> Nov 25, 2012 -- Bangalore, India Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/90021782/> * OpenStack Israel <http://www.meetup.com/IGTCloud/events/87103152/> Nov 27, 2012 -- Tel Aviv, Israel Register <http://www.meetup.com/IGTCloud/events/87103152/> * OpenStack in action! <http://openstackinaction3theopenrevolution.eventbrite.com/> Nov 29, 2012 -- Paris, France Register <http://openstackinaction3theopenrevolution.eventbrite.com/> * Pune OpenStack Meetup <http://www.meetup.com/Indian-OpenStack-User-Group/events/89610092/> Dec 02, 2012 -- Pune, India Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/89610092/> * EMEA OpenStack Day <http://emeaopenstackday2.eventbrite.com/> Dec 05, 2012 -- London Details <http://emeaopenstackday2.eventbrite.com/> Other news * MediaGoblin adding support to OpenStack Swift <http://maffulli.net/2012/11/14/mediagoblin-adding-support-to-openstack-swif…> * Report from China OpenStack Tour @ Xi'an <http://freedomhui.com/2012/11/china-openstack-tour-xian/> * Question about Oslo library versioning <http://markmail.org/message/yklxhylbsmyjjpx7> * OpenStack Project Meeting: Summary <http://eavesdrop.openstack.org/meetings/project/2012/project.2012-11-13-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2012/project.2012-11-13-21.…> Foundation News * OpenStack Foundation Board Meeting Unofficial Minutes Nov 16 <http://lists.openstack.org/pipermail/foundation/2012-November/001249.html> * OpenStack Foundation Board Meeting Official Minutes Nov 2 <http://wiki.openstack.org/Governance/Foundation/02Nov2012BoardMinutes> Welcome new contributors Celebrating the first patches submitted this month by: * Hendrik Volkmer, Cloudbau * Andrew Bogott, Wikimedia Foundation * Tim Daly, Jr, Yahoo! Inc * Darren Worrall /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

OpenStack Community Weekly Newsletter (Nov 2-9)
by Stefano Maffulli 09 Nov '12

09 Nov '12

Highlights of the week The future of Incubation and Core <http://markmail.org/message/hmc2cmf3wycrqhpe> Incubation is currently an OpenStack project status that grants a promising project more access to OpenStack shared resources, especially in the CI, release management and QA space. The level of maturity reached by OpenStack requires revising the concept of 'Core project' and the incubation process. Join the discussion and help the Technical Committee form an opinion for the Foundation's Board. OpenStack Keystone plans for the Grizzly release <http://www.rhonabwy.com/wp/2012/11/08/openstack-keystone-plans-for-the-griz…> Joe Heck published the plans for Keystone over the Grizzly release cycle. To read after going through the state of the project slides <http://www.slideshare.net/ccjoe/oct-2012-state-of-project-keystone>. OpenStack Image Service -- Grizzly Planning <http://bcwaldon.cc/2012/11/06/openstack-image-service-grizzly.html> The primary objective of Glance is to publish a catalog of virtual machine images. Rather than own users' image data, Glance simply tracks where that data resides. Glance owns the metadata provided by users. Brian Waldon summarizes the plans for Glance over the Grizzly release cycle. FOSDEM 2013: Cloud Devroom -- Call for Participation <http://markmail.org/message/di5u4o5bskmzrti3> The organizers of the Cloud devroom at FOSDEM 2012 invite you to submit a session proposal. The purpose of this devroom is to serve as a meeting point for cloud infrastructure projects, including a unique opportunity for discussion and collaboration between developers from different projects. This devroom will be focused on open source cloud infrastructure projects. Security Advisors * Authentication bypass for image deletion (CVE-2012-4573, CVE-2012-5482) ERRATA 1 <http://markmail.org/message/hn4cxgtyoxvk2mt2> Tips and tricks * By Everett Toews <http://blog.phymata.com/>: OpenStack devstack on the Rackspace open cloud <http://blog.phymata.com/2012/11/08/openstack-devstack-on-the-rackspace-open…> * By Jim Jiang intern of Sina SWS: How WsgiServer Deal With Requests ? <http://freedomhui.com/2012/11/openstack-nova-basics-to-see-how-wsgiserver-d…> * By Sébastien Han <http://sebastien-han.fr/>: Tip: lock an instance against admin permissions <http://sebastien-han.fr/blog/2012/11/07/tip-lock-an-instance-against-admin-…> * By Sébastien Han <http://sebastien-han.fr/>: Tip: Add a specific keypair to a flavor <http://sebastien-han.fr/blog/2012/11/05/tip-add-a-specific-keypair-to-a-fla…> * OpenStack Folsom Install Guide <https://github.com/mseknibilel/OpenStack-Folsom-Install-guide/blob/master/O…> Upcoming Events * OpenStack China Tour: Shanghai <http://hui.csdn.net/MeetingInfo.aspx?mid=153> Nov 10, 2012 -- Shanghai, China * Hungary User Group Meeting <http://www.meetup.com/OpenStack-Hungary-Meetup-Group/events/88548072/> Nov 13, 2012 -- Budapest, Hungary Details <http://www.meetup.com/OpenStack-Hungary-Meetup-Group/events/88548072/> * Swiss OpenStack user group meeting <http://www.meetup.com/zhgeeks/events/82917082/> Nov 15, 2012 -- Zürich, CH Details <http://www.meetup.com/zhgeeks/events/82917082/> * Australian OpenStack User Group -- Brisbane Technical Meetup <http://aosug.openstack.org.au/> Nov 20, 2012 -- Brisbane and other cities Details <http://aosug.openstack.org.au/> * OpenStack China Tour: Nanjing <http://hui.csdn.net/MeetingInfo.aspx?mid=155> Nov 24, 2012 -- Nanjing, China Details <http://hui.csdn.net/MeetingInfo.aspx?mid=155> * OpenStack Israel <http://www.meetup.com/IGTCloud/events/87103152/> Nov 27, 2012 -- Tel Aviv, Israel Register <http://www.meetup.com/IGTCloud/events/87103152/> * OpenStack in action! <http://openstackinaction3theopenrevolution.eventbrite.com/> Nov 29, 2012 -- Paris, France Register <http://openstackinaction3theopenrevolution.eventbrite.com/> * EMEA OpenStack Day <http://www.openstack.org/> Dec 05, 2012 -- London Details <http://www.openstack.org/> Other news * Planet OpenStack <http://planet.openstack.org/> has a new skin. Add you OpenStack blog to the Planet * Hui Cheng <http://freedomhui.com/> reports from China OpenStack Tour @ Chengdu <http://freedomhui.com/2012/11/chian-openstack-tour-chengdu/> * Julien Danjou <http://julien.danjou.info/blog/> reports from OpenStack France meetup #2 <http://julien.danjou.info/blog/2012/openstack-france-meetup-2> * Hendrik Volkmer <http://blog.hendrikvolkmer.de/>: Status of the SmartOS OpenStack Port <http://blog.hendrikvolkmer.de/2012/11/06/status-of-the-smartos-openstack-po…> * Matt Ray <http://leastresistance.wordpress.com/>: Chef for OpenStack Status 11/2 <http://leastresistance.wordpress.com/2012/11/02/chef-for-openstack-status-1…> * OpenStack Project Meeting: Summary <http://eavesdrop.openstack.org/meetings/project/2012/project.2012-11-06-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2012/project.2012-11-06-21.…> The list of projects to coordinate during the meeting is growing fast. Welcome new contributors Celebrating the first patches submitted this month by: * Yuan Zhou, Intel * Nicolas Simonds, Metacloud * Rushi Agrawal * Malini Bhandaru, Intel /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 1

[OSSA 2012-017.1] Authentication bypass for image deletion (CVE-2012-4573, CVE-2012-5482) ERRATA 1
by Russell Bryant 09 Nov '12

09 Nov '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 OpenStack Security Advisory: 2012-017 (ERRATA 1) CVE: CVE-2012-4573, CVE-2012-5482 Date: November 9, 2012 Title: Authentication bypass for image deletion Impact: High Reporter: Gabe Westmaas (Rackspace) Products: Glance Affects: Essex, Folsom, Grizzly Description: Gabe Westmaas from Rackspace reported a vulnerability in Glance authentication of image deletion requests. Authenticated users may be able to delete arbitrary, non-protected images from Glance servers. All Folsom and Grizzly deployments are affected. Additionally, Essex deployments that use the delayed_delete option are also affected. Fixes: Grizzly: https://github.com/openstack/glance/commit/6ab0992e5472ae3f9bef0d2ced410306… https://github.com/openstack/glance/commit/b591304b8980d8aca8fa6cda9ea1621a… 2012.2 (Folsom): https://github.com/openstack/glance/commit/90bcdc5a89e350a358cf320a03f5afe9… https://github.com/openstack/glance/commit/fc0ee7623ec59c87ac6fc671e95a9798… 2012.1 (Essex): https://github.com/openstack/glance/commit/efd7e75b1f419a52c7103c7840e24af8… References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-4573 http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-5482 https://bugs.launchpad.net/glance/+bug/1065187 https://bugs.launchpad.net/glance/+bug/1076506 Notes: This fix will be included in the grizzly-1 development milestone and in a future 2012.2 (Folsom) release. OSSA History: 2012-11-09 - Errata 1 - Updated to reflect that the v2 API in Folsom and Grizzly was also affected - Include links to fixes for the v2 API - Added CVE-2012-5482 for the vulnerability against the v2 API 2012-11-07 - Original Version - -- Russell Bryant OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://www.enigmail.net/ iEYEARECAAYFAlCdDn0ACgkQFg9ft4s9SAaDMQCfec7E8Dc8kL0ILEgUT39nqWty npgAnRtJtgD7Zrtll9yBYA33egUnPdcj =P/7D -----END PGP SIGNATURE-----

1 0