- OpenStack-announce - lists.openstack.org

[OSSA 2014-014] Neutron security groups bypass through invalid CIDR (CVE-2014-0187)
by Tristan Cacqueray 22 Apr '14

22 Apr '14

OpenStack Security Advisory: 2014-014 CVE: CVE-2014-0187 Date: April 22, 2014 Title: Neutron security groups bypass through invalid CIDR Reporters: Stephen Ma (HP) and Christoph Thiel (Deutsche Telekom) Products: Neutron Versions: 2013.1 to 2013.2.3, and 2014.1 Description: Stephen Ma from Hewlett Packard and Christoph Thiel from Deutsche Telekom reported a vulnerability in Neutron security groups. By creating a security group rule with an invalid CIDR, an authenticated user may break openvswitch-agent process, preventing further rules from being applied on the host. Note: removal of the faulty rule is not enough, the openvswitch-agent must be restarted. All Neutron setups using Open vSwitch are affected. Juno (development branch) fix: https://review.openstack.org/59212 Icehouse fix: https://review.openstack.org/88674 Havana fix: https://review.openstack.org/88057 Notes: This fix will be included in the juno-1 development milestone and in future 2013.2.4 and 2014.1.1 releases. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0187 https://launchpad.net/bugs/1300785 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Apr 11 – 18)
by Stefano Maffulli 18 Apr '14

18 Apr '14

1 0

OpenStack 2014.1 ("Icehouse") is released !
by Thierry Carrez 17 Apr '14

17 Apr '14

Hi everyone, I'm proud to announce the final release of OpenStack 2014.1, code-named "Icehouse". This marks the completion of a 6-month journey which started at the Icehouse Design Summit in Hong-Kong. During this cycle we added a new integrated component (Trove), completed more than 350 feature blueprints and fixed almost 3000 reported bugs in integrated projects alone ! You can find source tarballs for each integrated project, together with complete lists of features and bugfixes, at the following links: Compute (Nova): https://launchpad.net/nova/icehouse/2014.1 Object Storage (Swift): https://launchpad.net/swift/icehouse/1.13.1 Image Service (Glance): https://launchpad.net/glance/icehouse/2014.1 Networking (Neutron): https://launchpad.net/neutron/icehouse/2014.1 Block Storage (Cinder): https://launchpad.net/cinder/icehouse/2014.1 Identity (Keystone): https://launchpad.net/keystone/icehouse/2014.1 Dashboard (Horizon): https://launchpad.net/horizon/icehouse/2014.1 Telemetry (Ceilometer): https://launchpad.net/ceilometer/icehouse/2014.1 Orchestration (Heat): https://launchpad.net/heat/icehouse/2014.1 Database Service (Trove): https://launchpad.net/trove/icehouse/2014.1 The Icehouse Release Notes contain an overview of the key features, as well as upgrade notes and current lists of known issues. You can access them at: https://wiki.openstack.org/wiki/ReleaseNotes/Icehouse Thanks to the hundreds of people who contributed to this development cycle and helped in making this release great ! -- Thierry Carrez (ttx)

1 0

PTL Election Conclusion and Results
by Anita Kuno 11 Apr '14

11 Apr '14

Thank you to the electorate, to all those who voted and to all candidates who put their name forward for PTL for this election. A healthy, open process breeds trust in our decision making capability - thank you to all those who make this process possible. Now for the results of the PTL election process, please join me in extending congratulations to the following PTLs: * Compute (Nova) ** Michael Still * Object Storage (Swift) ** John Dickinson * Image Service (Glance) ** Mark Washenberger * Identity (Keystone) ** Dolph Mathews * Dashboard (Horizon) ** David Lyle * Networking (Neutron) ** Kyle Mestery * Block Storage (Cinder) ** John Griffith * Metering/Monitoring (Ceilometer) ** Eoghan Glynn * Orchestration (Heat) ** Zane Bitter * Database Service (Trove) ** Nikhil Manchanda * Bare metal (Ironic) ** Devananda van der Veen * Common Libraries (Oslo) ** Doug Hellmann * Infrastructure ** Jim Blair * Documentation ** Anne Gentle * Quality Assurance (QA) ** Matt Treinish * Deployment (TripleO) ** Robert Collins * Devstack (DevStack) ** Dean Troyer * Release cycle management ** Thierry Carrez * Queue Service (Marconi) ** Kurt Griffiths * Data Processing Service (Sahara) ** Sergey Lukjanov * Key Management Service (Barbican) ** Jarret Raim Election Results: * Nova: http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_e295a4530c19f691 * Neutron: http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_230fb7953010b219 * Cinder: http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_cdc16bb61aacc74a * Ceilometer: http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_18b9e8d39c82df0b * Heat: http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_e0f670cec964fef8 * TripleO: http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_eeaa27c0de8c9a51 Shortly I will post the announcement opening TC nominations and then we are into the TC election process. Thank you to all involved in the PTL election process, Anita.

1 0

OpenStack Community Weekly Newsletter (Apr 4 – 11)
by Stefano Maffulli 11 Apr '14

11 Apr '14

Take the OpenStack User Survey and Change the (OpenStack) World <http://openstack.org/user-survey> Still a few more hours to fill in the OpenStack User Survey. Heartbleed <http://blogs.gnome.org/markmc/2014/04/10/heartbleed/> The bug discovered affecting OpenSSL and “breaking” internet doesn’t directly touch OpenStack but can lead to OpenStack compromise <http://lists.openstack.org/pipermail/openstack/2014-April/006539.html>. The width of the problem discovered this week is extremely wide though and I think it’s worth spending some more time learning about it. Mark McLoughlin <http://blogs.gnome.org/markmc> has collected an impressive amount of links where you can learn more. Security auditing of OpenStack releases <https://blog-nkinder.rhcloud.com/?p=51> Nathan Kinder <https://blog-nkinder.rhcloud.com/> started a conversation about how to deal with high-level security related questions about OpenStack. How to govern a project on the scale of OpenStack <http://opensource.com/business/14/4/governance-openstack> How an open source project is governed can matter just as much as the features it supports, the speed at which it runs, or the code that underlies it. Some open source projects have what I call a “benevolent dictator for life <http://www.theatlantic.com/technology/archive/2014/01/on-the-reign-of-benev…>.” Others are outgrowths of corporate projects that, while open, still have their goals and code led by the company that manages it. And of course, there are thousands of projects out there that are written and managed by a single person or a small group of people for whom governance is less of an issue than insuring project sustainability <http://opensource.com/life/14/1/evaluate-sustainability-open-source-project>. Introducing the OpenStack SDK for PHP <http://engineeredweb.com/blog/2014/openstack-sdk-php-intro/> Marrying OpenStack with one of the most popular programming languages on the planet. Write applications to interact with OpenStack public and private clouds, using the APIs. The OpenStack SDK for PHP <https://wiki.openstack.org/wiki/OpenStack-SDK-PHP> is meant to be by the community and for the community. It will be able to work with clouds from a variety of vendors or vanilla OpenStack setups. Tearing down obstacles to OpenStack documentation contributions <http://justwriteclick.com/2014/04/10/tearing-down-obstacles-to-openstack-do…> Rip. Shred. Tear. Let’s gather up the obstacles to documentation contribution and tear them down one by one. I’ve designed a survey <https://docs.google.com/forms/d/136-BssH-OxjVo8vNoOD-gW4x8fDFpvixbgCfeV1w_d…> with the help of the OpenStack docs team to determine blockers for docs contributions. If you’ve contributed to OpenStack, pleasefill it out <https://docs.google.com/forms/d/136-BssH-OxjVo8vNoOD-gW4x8fDFpvixbgCfeV1w_d…>. The road to Juno Summit – Atlanta 2014 * Applying for Visa? Looking for accommodation in Atlanta? Visit http://openstack.org/summit * Check the official agenda <http://openstacksummitmay2014atlanta.sched.org/> * Call for Proposals Open Source @ OpenStack Summit <http://www.openstack.org/blog/2014/03/call-for-proposals-open-source-openst…> Security Advisories and Notices * XSS in Horizon orchestration dashboard (CVE-2014-0157) <http://lists.openstack.org/pipermail/openstack-announce/2014-April/000218.h…> * RBAC policy not properly enforced in Nova EC2 API (CVE-2014-0167) <http://lists.openstack.org/pipermail/openstack-announce/2014-April/000219.h…> * Remote code execution in Glance Sheepdog backend (CVE-2014-0162) <http://lists.openstack.org/pipermail/openstack-announce/2014-April/000220.h…> * Keystone DoS through V3 API authentication chaining (CVE-2014-2828) <http://lists.openstack.org/pipermail/openstack-announce/2014-April/000221.h…> * Heat templates with invalid references allows unintended network access <http://lists.openstack.org/pipermail/openstack/2014-April/006428.html> * OpenSSL Heartbleed vulnerability can lead to OpenStack compromise <http://lists.openstack.org/pipermail/openstack/2014-April/006539.html> Tips ‘n Tricks * By Steve Hardy <http://hardysteven.blogspot.com/search/label/openstack>: Heat auth model updates – part 1 Trusts <http://hardysteven.blogspot.com/2014/04/heat-auth-model-updates-part-1-trus…> * By Adam Young <http://adam.younglogic.com/>: Teaching Horizon to Share <http://adam.younglogic.com/2014/04/teaching-horizon-to-share/> * By Christian Berendt <http://www.cberendt.de/>: An other Vagrant box with Devstack and Ubuntu 14.04 <http://www.cberendt.de/2014/04/an-other-vagrant-box-with-devstack-and-ubunt…> * By How To Store Incremental Backups On The Cloudwatt Object Store Using Duplicity <http://dev.cloudwatt.com/en/blog/how-to-store-incremental-backups-on-the-cl…> * By Cameron Seader <http://blog.seader.us/search/label/OpenStack>: Quickly Setting-up an OpenStack Cloud with the SUSE Cloud 3 Admin Appliance <http://blog.seader.us/2014/04/quickly-setting-up-openstack-cloud-with.html> * By Sean Dague <https://dague.net/>: Devstack Vagrant <https://dague.net/2014/04/06/devstack-vagrant/> * By Cody Bunch <http://openstack.prov12n.com/>: How to Make A LOT of Devstack with Vagrant <http://openstack.prov12n.com/how-to-make-a-lot-of-devstack-with-vagrant/> Reports from Previous Events * OpenStack Meetup, Coimbatore – 31 March 2014 <http://aptira.com/blog/98-openstack-meetup-coimbatore-31-march-2014> * Nordic OpenStack meetup 3 April – hosted by Elastx and Solidfire <http://elastx.com/our-blog/openstack-meetup-hosted-by-elastx-and-solidfire> Upcoming Events * PyCon <https://us.pycon.org/2014/> Apr 09 – 17, 2014 – Montreal, Canada Details <https://us.pycon.org/2014/> * OpenStack India Meeting <http://www.meetup.com/Indian-OpenStack-User-Group/events/173478572/> Apr 12, 2014 – Mumbai, India Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/173478572/> * San Antonio OpenStack Meeting <http://www.meetup.com/SA-Open-Stackers/events/175211322/> Apr 16, 2014 – San Antonio, TC Details <http://www.meetup.com/SA-Open-Stackers/events/175211322/> * SFBay OpenStack Hackathon #OSSFO <http://www.meetup.com/openstack/> Apr 17, 2014 – Details <http://www.meetup.com/openstack/> * Icehouse Release Party! <http://www.meetup.com/Openstack-Amsterdam/events/174447942/> Apr 17, 2014 – Amsterdam, Netherlands Details <http://www.meetup.com/Openstack-Amsterdam/events/174447942/> * Running OpenStack User Groups <http://www.meetup.com/OpenStack-Online-Meetup/events/174880782/> Apr 17, 2014 – Online Details <http://www.meetup.com/OpenStack-Online-Meetup/events/174880782/> * SAFNOG <http://www.safnog.org/meetings-future/agenda-2014-safnog-1.html>Apr 22 – 23, 2014 – Johannesburg, South Africa Details <http://www.safnog.org/meetings-future/agenda-2014-safnog-1.html> * Philly OpenStack Meeting <http://www.meetup.com/Philly-OpenStack-Meetup-Group/events/157769942/> Apr 24, 2014 – Philadelphia, PA Details <http://www.meetup.com/Philly-OpenStack-Meetup-Group/events/157769942/> * OpenStack India Meeting <http://www.meetup.com/Indian-OpenStack-User-Group/events/173701902/> Apr 26, 2014 – Bangalore, India Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/173701902/> * OpenStack Day Mexico <https://openstackdaylatam.com/?lang=en> Apr 29, 2014 – Mexico City, Mexico Details <https://openstackdaylatam.com/?lang=en> * OpenStack Paris Meeting <http://www.meetup.com/OpenStack-France/events/172754772/> Apr 29, 2014 – Paris, France Details <http://www.meetup.com/OpenStack-France/events/172754772/> * SFBay Meetup – Beginner track <http://www.meetup.com/openstack/events/123227622/> May 01, 2014 – Sunnyvale, CA Details <http://www.meetup.com/openstack/events/123227622/> * SFBay OpenStack Hackathon #OSSFO <http://www.meetup.com/openstack/> May 01, 2014 – Details <http://www.meetup.com/openstack/> * OpenStack Brasil User Group Meeting @ FISL15 <http://softwarelivre.org/fisl15> May 07 – 10, 2014 – Porto Alegre, Brasil Details <http://softwarelivre.org/fisl15> * OpenStack DACH Day at LinuxTag 2014 <http://www.linuxtag.org/2014/en/#openstack> May 09, 2014 – Berlin, Germany Details <http://www.linuxtag.org/2014/en/#openstack> * OpenStack Summit May 2014 <http://www.openstack.org/summit/openstack-summit-atlanta-2014/> May 12 – 16, 2014 – Atlanta, GA Details <http://www.openstack.org/summit/openstack-summit-atlanta-2014/> Other News * Why We Craft OpenStack (Featuring Rackspace Principal Architect Kurt Griffiths) <http://www.rackspace.com/blog/why-we-craft-openstack-featuring-rackspace-pr…> * OpenStack Israel Podcast, Episode 7 <http://cloudifysource.tumblr.com/post/82113910247> * MongoDB 2.6 is out, Marconi will benefit from it <http://blog.flaper87.com/post/53440a53d987d2dc534d4530/> * Why I Support Mark McClain for OpenStack Neutron PTL <http://sarob.com/2014/04/why-i-support-mark-mcclain-for-openstack-neutron-p…> * OpenStack Day Events April – May – June 2014 <http://www.openstack.org/blog/2014/04/openstack-day-events-april-may-june-2…> * Take the OpenStack User Survey and Change the (OpenStack) World <https://www.suse.com/communities/conversations/take-openstack-user-survey-c…> * OpenStack Project Meeting: Summary <http://eavesdrop.openstack.org/meetings/project/2014/project.2014-04-08-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2014/project.2014-04-08-21.…> Welcome New Reviewers and Developers Jason Kincl <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Manish Godara <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Choe, Cheng-Dae <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Jason Ni <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Juan Antonio Osorio Robles <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> vishal yadav <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Peter Jönsson <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Amrith <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> vaibhav <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Doug Shelley <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Victor Boivie <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Aimon Bustardo <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Marc Abramowitz <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Igor Duarte Cardoso <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Latest Activity In Projects Do you want to see at a glance the bugs filed and solved this week? Latest patches submitted for review? Check out the individual project pages on OpenStack Activity Board – Insights <http://activity.openstack.org/data/display/OPNSTK2/>. * Telemetry (Ceilometer) <http://activity.openstack.org/data/display/OPNSTK2/ceilometer> * Block Storage (Cinder) <http://activity.openstack.org/data/display/OPNSTK2/cinder> * Image Service (Glance) <http://activity.openstack.org/data/display/OPNSTK2/glance> * Orchestration API <http://activity.openstack.org/data/display/OPNSTK2/heat> (Heat) <http://activity.openstack.org/data/display/OPNSTK2/heat> * Dashboard (Horizon) <http://activity.openstack.org/data/display/OPNSTK2/horizon> * Bare Metal Provisioning (Ironic) <http://activity.openstack.org/data/display/OPNSTK2/ironic> * Identity (Keystone) <http://activity.openstack.org/data/display/OPNSTK2/keystone> * Manuals <http://activity.openstack.org/data/display/OPNSTK2/openstack-manuals> * Networking (Neutron) <http://activity.openstack.org/data/display/OPNSTK2/neutron> * Compute (Nova) <http://activity.openstack.org/data/display/OPNSTK2/nova> * Data Processing (Sahara) <http://stackalytics.com/?release=icehouse&metric=commits&project_type=opens…> * Object Storage (Swift) <http://activity.openstack.org/data/display/OPNSTK2/swift> * Database As A Service (Trove) <http://activity.openstack.org/data/display/OPNSTK2/trove> /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

[OSSA 2014-013] Keystone DoS through V3 API authentication chaining (CVE-2014-2828)
by Tristan Cacqueray 11 Apr '14

11 Apr '14

OpenStack Security Advisory: 2014-013 CVE: CVE-2014-2828 Date: April 10, 2014 Title: Keystone DoS through V3 API authentication chaining Reporter: Abu Shohel Ahmed (Ericsson) Products: Keystone Versions: from 2013.1 to 2013.2.3 Description: Abu Shohel Ahmed from Ericsson reported a vulnerability in Keystone V3 API authentication. By sending a single request with the same authentication method multiple times, a remote attacker may generate unwanted load on the Keystone host, potentially resulting in a Denial of Service against a Keystone service. Only Keystone setups enabling V3 API are affected. Juno (development branch) fix: https://review.openstack.org/84425 Icehouse (milestone-proposed branch) fix: https://review.openstack.org/84735 Havana fix: https://review.openstack.org/86024 Notes: This fix is included in the icehouse-rc2 development milestone and will be included in a future 2013.2.4 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2828 https://launchpad.net/bugs/1300274 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OSSA 2014-012] Remote code execution in Glance Sheepdog backend (CVE-2014-0162)
by Tristan Cacqueray 11 Apr '14

11 Apr '14

OpenStack Security Advisory: 2014-012 CVE: CVE-2014-0162 Date: April 10, 2014 Title: Remote code execution in Glance Sheepdog backend Reporter: Paul McMillan (Nebula) Products: Glance Versions: from 2013.2 to 2013.2.3 Description: Paul McMillan from Nebula reported a vulnerability in Glance Sheepdog backend. By using a specially crafted location, a user allowed to insert or modify Glance image metadata may trigger code execution on the Glance host as the user the Glance service runs under. This may result in Glance host unauthorized access and further compromise of the Glance service. All setups using Glance server with the (enabled by default) sheepdog backend are affected. Juno (development branch) fix: https://review.openstack.org/86622 Icehouse (milestone-proposed branch) fix: https://review.openstack.org/86625 Havana fix: https://review.openstack.org/86626 Notes: This fix will be included in the icehouse-rc2 development milestone and in a future 2013.2.4 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0162 https://launchpad.net/bugs/1298698 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OSSA 2014-011] RBAC policy not properly enforced in Nova EC2 API (CVE-2014-0167)
by Tristan Cacqueray 10 Apr '14

10 Apr '14

OpenStack Security Advisory: 2014-011 CVE: CVE-2014-0167 Date: April 09, 2014 Title: RBAC policy not properly enforced in Nova EC2 API Reporter: Marc Heckmann (Ubisoft) Products: Nova Versions: from 2013.1 to 2013.2.3 Description: Marc Heckmann from Ubisoft reported a vulnerability in the Nova EC2 API security group implementation. RBAC policies are not enforced when using the EC2 API, in particular the add_rules, remove_rules and destroy methods. A restricted user may overcome his limitation by using EC2 API resulting in unauthorized action on security groups. Only setups using non-default RBAC rules for Nova may be affected. Juno (development branch) fix: https://review.openstack.org/86358 Icehouse (milestone-proposed branch) fix: https://review.openstack.org/86360 Havana fix: https://review.openstack.org/86361 Notes: This fix will be included in the icehouse-rc2 development milestone and in a future 2013.2.4 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0167 https://launchpad.net/bugs/1290537 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OSSA 2014-010] XSS in Horizon orchestration dashboard (CVE-2014-0157)
by Tristan Cacqueray 08 Apr '14

08 Apr '14

OpenStack Security Advisory: 2014-010 CVE: CVE-2014-0157 Date: April 08, 2014 Title: XSS in Horizon orchestration dashboard Reporter: Cristian Fiorentino (Intel) Products: Horizon Versions: 2013.2 version up to 2013.2.3 Description: Cristian Fiorentino from Intel reported a vulnerability in Horizon Orchestration dashboard. By tricking a Horizon user into using a malicious template in the Orchestration/Stack section of Horizon, a remote attacker may trigger a cross-site-scripting vulnerability. It may result in potential assets theft (Horizon user/admin access credentials, tenants confidential information, etc.). Only setups exposing the orchestration dashboard in Horizon are affected. Juno (development branch) fix: https://review.openstack.org/86059 Icehouse (milestone-proposed branch) fix: https://review.openstack.org/86054 Havana fix: https://review.openstack.org/86056 Notes: This fix will be included in the icehouse-rc2 development milestone and in a future 2013.2.4 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0157 https://launchpad.net/bugs/1289033 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Mar 28 – Apr 4)
by Stefano Maffulli 06 Apr '14

06 Apr '14

1 0