- OpenStack-announce - lists.openstack.org

[OSSA 2014-009] Nova host data leak to vm instance in rescue mode (CVE-2014-0134)
by Tristan Cacqueray 27 Mar '14

27 Mar '14

OpenStack Security Advisory: 2014-009 CVE: CVE-2014-0134 Date: March 27, 2014 Title: Nova host data leak to vm instance in rescue mode. Reporter: Stanislaw Pitucha (HP) Products: Nova Versions: 2013.2 versions up to 2013.2.2 Description: Stanislaw Pitucha from Hewlett Packard reported a vulnerability in the Nova instance rescue mode. By overwriting the disk inside an instance with a malicious image and switching the instance to rescue mode, an authenticated user would be able to leak an arbitrary file from the compute host to the virtual instance. Note that the host file must be readable by the libvirt/kvm context to be exposed. Only setups using libvirt to spawn instance, and having "use_cow_images = False" in Nova configuration are affected. Icehouse (development branch) fix: https://review.openstack.org/82840 Havana fix: https://review.openstack.org/82841 Notes: This fix will be included in the icehouse-rc1 development milestone and in a future 2013.2.3 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0134 https://launchpad.net/bugs/1221190 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OSSA 2014-008] Routers can be cross plugged by other tenants (CVE-2014-0056)
by Grant Murphy 27 Mar '14

27 Mar '14

OpenStack Security Advisory: 2014-008 CVE: CVE-2014-0056 Date: March 27, 2014 Title: Routers can be cross plugged by other tenants Reporter: Aaron Rosen (VMWare) Products: Neutron Affects: 2012.2 versions up to 2013.2.2 Description: Aaron Rosen from VMWare reported a vulnerability where Neutron fails to perform proper authorization checks when creating ports. By choosing a device id of a router from a different tenant when creating a port, an authenticated user can access the network of other tenants. This affects deployments of Neutron using plugins relying on the l3-agent. Icehouse (development branch) fix: https://review.openstack.org/83391 Havana fix: https://review.openstack.org/83393 Notes: One should perform and audit of the ports that are already attached to routers after applying this patch and remove ports that a tenant may have cross plugged. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0056 https://bugs.launchpad.net/bugs/1243327 -- Grant Murphy OpenStack Vulnerability Management Team

1 0

[OSSA 2014-007] Potential context confusion in Keystone middleware (CVE-2014-0105)
by Tristan Cacqueray 27 Mar '14

27 Mar '14

OpenStack Security Advisory: 2014-007 CVE: CVE-2014-0105 Date: March 27, 2014 Title: Potential context confusion in Keystone middleware Reporter: Kieran Spear (University of Melbourne) Products: python-keystoneclient Versions: All versions up to 0.6.0 Description: Kieran Spear from the University of Melbourne reported a vulnerability in Keystone auth_token middleware (shipped in python-keystoneclient). By doing repeated requests, with sufficient load on the target system, an authenticated user may in certain situations assume another authenticated user's complete identity and multi-tenant authorizations, potentially resulting in a privilege escalation. Note that it is related to a bad interaction between eventlet and python-memcached that should be avoided if the calling process already monkey-patches "thread" to use eventlet. Only keystone middleware setups using auth_token with memcache are vulnerable. python-keystoneclient fix (included in 0.7.0 release): https://review.openstack.org/81078 References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0105 https://bugs.launchpad.net/bugs/1282865 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Mar 14 – 21)
by Stefano Maffulli 21 Mar '14

21 Mar '14

1 0

OpenStack 2013.1.5 released
by Alan Pevec 21 Mar '14

21 Mar '14

Hello everyone, The OpenStack Stable Maintenance team is happy to announce the release of the 2013.1.5 stable Grizzly release. We have been busy reviewing and accepting backported bugfixes to the stable/grizzly branches according to the criteria set at: https://wiki.openstack.org/wiki/StableBranch A total of 44 bugs have been fixed across all projects. These updates to Grizzly are intended to be low risk with no intentional regressions or API changes. The list of bugs, tarballs and other milestone information for each project may be found on Launchpad: https://launchpad.net/cinder/grizzly/2013.1.5 https://launchpad.net/glance/grizzly/2013.1.5 https://launchpad.net/horizon/grizzly/2013.1.5 https://launchpad.net/keystone/grizzly/2013.1.5 https://launchpad.net/nova/grizzly/2013.1.5 https://launchpad.net/neutron/grizzly/2013.1.5 Release notes may be found on the wiki: https://wiki.openstack.org/wiki/ReleaseNotes/2013.1.5 No further official Grizzly releases are planned. Thanks, Alan

1 0

OpenStack Community Weekly Newsletter (Mar 7 – 14)
by Stefano Maffulli 15 Mar '14

15 Mar '14

1 0

OpenStack Community Weekly Newsletter (Feb 28 – Mar 7)
by Stefano Maffulli 08 Mar '14

08 Mar '14

1 0

python-novaclient 2.17.0 released
by Russell Bryant 08 Mar '14

08 Mar '14

I just pushed a new release of python-novaclient: 2.17.0. The primary feature in this release is support for a new API, os-server-external-events, which is needed for some important coordination fixes between Nova and Neutron. There are a few bug fixes included in this release, as well. Please report any problems here: https://bugs.launchpad.net/python-novaclient Thanks, -- Russell Bryant

1 0

Icehouse-3 development milestone available
by Thierry Carrez 07 Mar '14

07 Mar '14

Hi everyone, The third (and last) milestone of the Icehouse development cycle, "icehouse-3", is now available for Keystone, Glance, Nova, Horizon, Neutron, Cinder, Ceilometer, Heat, and Trove. You can see the full list of new features and fixed bugs, as well as tarball downloads, at: https://launchpad.net/keystone/icehouse/icehouse-3 https://launchpad.net/glance/icehouse/icehouse-3 https://launchpad.net/nova/icehouse/icehouse-3 https://launchpad.net/horizon/icehouse/icehouse-3 https://launchpad.net/neutron/icehouse/icehouse-3 https://launchpad.net/cinder/icehouse/icehouse-3 https://launchpad.net/ceilometer/icehouse/icehouse-3 https://launchpad.net/heat/icehouse/icehouse-3 https://launchpad.net/trove/icehouse/icehouse-3 Including the Oslo libraries, that makes an impressive 203 blueprints completed over the last 6 weeks alone, and 780 bugs fixed. Note that this milestone is nearly feature-complete. A few exceptions should land next week, but those projects are otherwise feature-frozen in preparation for the first Icehouse release candidates. We should now all switch to testing and bugfixing mode for the next weeks, and make Icehouse as bug-free as we can. The release-critical bugs will be tracked on the icehouse-rc1 milestone pages. Once all those bugs are fixed and the first release candidates are out, the next development cycle (Juno) will start. Final coordinated release is expected on April 17th ! More information on the OpenStack development cycle can be found at: https://wiki.openstack.org/wiki/Release_Cycle Regards, -- Thierry Carrez (ttx)

1 0

[OSSA 2014-006] Trustee token revocation does not work with memcache backend (CVE-2014-2237)
by Tristan Cacqueray 04 Mar '14

04 Mar '14

OpenStack Security Advisory: 2014-006 CVE: CVE-2014-2237 Date: March 04, 2014 Title: Trustee token revocation does not work with memcache backend Reporter: Morgan Fainberg (Metacloud) Products: Keystone Versions: 2013.1 up to 2013.1.4 and 2013.2 versions up to 2013.2.2 Description: Morgan Fainberg from Metacloud reported a vulnerability in the Keystone memcache token backend. When a trustor issues a trust token with impersonation enabled, the token is only added to the trustor's token list and not to the trustee's token list. This results in the trust token not being invalidated by the trustee's token revocation (bulk revocation). This is most noticeable when the trustee user is disabled or the trustee changes a password. Only setups using the memcache backend for tokens in Keystone are affected. Icehouse (development branch) fix: https://review.openstack.org/60743 Havana fix: https://review.openstack.org/75521 Grizzly fix: https://review.openstack.org/75526 Notes: This fix will be included in the icehouse-3 development milestone and in future 2013.1.5 and 2013.2.3 releases. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2237 https://launchpad.net/bugs/1260080 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0