- OpenStack-announce - lists.openstack.org

[OSSA 2014-028] Glance store DoS through disk space exhaustion (CVE-2014-5356)
by Tristan Cacqueray 21 Aug '14

21 Aug '14

OpenStack Security Advisory: 2014-028 CVE: CVE-2014-5356 Date: August 21, 2014 Title: Glance store DoS through disk space exhaustion Reporter: Thomas Leaman (HP), Stuart McLaren (HP) Products: Glance Versions: up to 2013.2.3 and 2014.1 versions up to 2014.1.2 Description: Thomas Leaman and Stuart McLaren from Hewlett Packard reported a vulnerability in Glance. By uploading a large enough image to a Glance store, an authenticated user may fill the store space because the image_size_cap configuration option is not honored. This may prevent further image upload and/or cause service disruption. Note that the import method is not affected. All Glance setups using API v2 are affected (unless you use a policy to restrict/disable image upload). Juno (development branch) fix: https://review.openstack.org/91764 Icehouse fix: https://review.openstack.org/115280 Havana fix: https://review.openstack.org/115289 Notes: This fix will be included in the Juno-3 development milestone and in future 2013.2.4 and 2014.1.3 releases. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5356 https://launchpad.net/bugs/1315321 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OSSA 2014-027] Persistent XSS in Horizon Host Aggregates interface (CVE-2014-3594)
by Tristan Cacqueray 19 Aug '14

19 Aug '14

OpenStack Security Advisory: 2014-027 CVE: CVE-2014-3594 Date: August 19, 2014 Title: Persistent XSS in Horizon Host Aggregates interface Reporters: Dennis Felsch and Mario Heiderich (Ruhr-University Bochum) Products: Horizon Versions: up to 2013.2.3, and 2014.1 versions up to 2014.1.2 Description: Dennis Felsch and Mario Heiderich from the Horst Görtz Institute for IT-Security, Ruhr-University Bochum reported a persistent XSS in Horizon. A malicious administrator may conduct a persistent XSS attack by registering a malicious host aggregate in Horizon Host Aggregate interface. Once executed in a legitimate context this attack may reveal another admin token, potentially resulting in a lateral privilege escalation. All Horizon setups are affected. Juno (development branch) fix: https://review.openstack.org/115310 Icehouse fix: https://review.openstack.org/115311 Havana fix: https://review.openstack.org/115313 Notes: This fix will be included in the Juno-3 development milestone and in future 2013.2.4 and 2014.1.3 releases. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3594 https://launchpad.net/bugs/1349491 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Aug 8 - 15)
by Stefano Maffulli 15 Aug '14

15 Aug '14

1 0

[OSSA 2014-026] Multiple vulnerabilities in Keystone revocation events (CVE-2014-5251, CVE-2014-5252, CVE-2014-5253)
by Tristan Cacqueray 15 Aug '14

15 Aug '14

OpenStack Security Advisory: 2014-026 CVE: CVE-2014-5251, CVE-2014-5252, CVE-2014-5253 Date: August 15, 2014 Title: Multiple vulnerabilities in Keystone revocation events Reporter: Lance Bragstad (Rackspace) - CVE-2014-5252 Brant Knudson (IBM) - CVE-2014-5251, CVE-2014-5253 Products: Keystone Versions: 2014.1 versions up to 2014.1.1 Description: Lance Bragstad from Rackspace and Brant Knudson from IBM reported 3 vulnerabilities in Keystone revocation events. Lance Bragstad discovered that UUID v2 tokens processed by the V3 API are incorrectly updated and get their "issued_at" time regenerated (CVE-2014-5252). Brant Knudson discovered that the MySQL token driver stores expiration dates incorrectly which prevents manual revocation (CVE-2014-5251) and that domain-scoped tokens don't get revoked when the domain is disabled (CVE-2014-5253). Tokens impacted by one of these bugs may allow a user to evade token revocation. Only Keystone setups configured to use revocation events are affected. Juno (development branch) fix: https://review.openstack.org/111106 https://review.openstack.org/109747 https://review.openstack.org/109819 https://review.openstack.org/109820 Icehouse fix: https://review.openstack.org/112087 https://review.openstack.org/111772 https://review.openstack.org/112083 https://review.openstack.org/112084 Notes: These fixes will be included in the Juno-3 development milestone and are already included in the 2014.1.2.1 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5251 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5252 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5253 https://launchpad.net/bugs/1347961 https://launchpad.net/bugs/1348820 https://launchpad.net/bugs/1349597 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Aug 1 – 8)
by Stefano Maffulli 08 Aug '14

08 Aug '14

1 0

Keystone 2014.1.2
by Chuck Short 08 Aug '14

08 Aug '14

An issue was discovered with Keystone 2014.1.2 stable release tarball shortly after it was uploaded on the release page at: https://launchpad.net/keystone/icehouse/2014.1.2 A new tarball corresponding to 2014.1.2 code was generated and uploaded: md5sum: c8a85fc2ac76679eb1b674e0c2c65e36 keystone-2014.1.2.tar.gz sha1sum: c1d481d8b330e50da5ace19c23e5909c04fa1cba keystone-2014.1.2.tar.gz Please double-check that you got the right one. Regards chuck

2 1

OpenStack 2014.1.2 released
by Chuck Short 07 Aug '14

07 Aug '14

Hello everyone, The OpenStack Stable Maintenance team is happy to announce the release of the 2014.1.2 stable Icehouse release. We have been busy reviewing and accepting backported bugfixes to the stable/icehouse branches according to the criteria set at: https://wiki.openstack.org/wiki/StableBranch A total of 157 bugs have been fixed across all projects. These updates to Icehouse are intended to be low risk with no intentional regressions or API changes. The list of bugs, tarballs and other milestone information for each project may be found on Launchpad: https://launchpad.net/ceilometer/icehouse/2014.1.2https://launchpad.net/cin… Release notes may be found on the wiki: https://wiki.openstack.org/wiki/ReleaseNotes/2014.1.2 The freeze on the stable/icehouse branches will be lifted today as we begin working toward the 2014.1.3 release, planned for Oct 2 release and managed by Adam Gandelman. Thanks, chuck

1 0

OpenStack Community Weekly Newsletter (July 25 - Aug 1)
by Stefano Maffulli 01 Aug '14

01 Aug '14

1 0

OpenStack Community Weekly Newsletter (July 18 – 25)
by Stefano Maffulli 25 Jul '14

25 Jul '14

1 0

Juno-2 development milestone available
by Russell Bryant 24 Jul '14

24 Jul '14

Hello everyone, The second milestone of the Juno development cycle, "juno-2" is now available for Keystone, Glance, Nova, Horizon, Neutron, Cinder, Ceilometer, Heat, Trove, and Sahara. It contains features and bug fixes that have been implemented since the first milestone, "juno-1". You can find the full list of new features, fixed bugs, and tarball downloads at: https://launchpad.net/keystone/juno/juno-2 https://launchpad.net/glance/juno/juno-2 https://launchpad.net/nova/juno/juno-2 https://launchpad.net/horizon/juno/juno-2 https://launchpad.net/neutron/juno/juno-2 https://launchpad.net/cinder/juno/juno-2 https://launchpad.net/ceilometer/juno/juno-2 https://launchpad.net/heat/juno/juno-2 https://launchpad.net/trove/juno/juno-2 https://launchpad.net/sahara/juno/juno-2 Including the oslo libraries, 68 blueprints were implemented and more than 650 bugs were fixed during this milestone. The next development milestone, juno-3, is scheduled for September 4th. You can further track upcoming features and Juno release cycle status at: http://status.openstack.org/release/ Regards, -- Russell Bryant

1 0