- OpenStack-announce - lists.openstack.org

[OSSA 2013-034] Heat CFN policy rules not all enforced (CVE-2013-6426)
by Jeremy Stanley 11 Dec '13

11 Dec '13

OpenStack Security Advisory: 2013-034 CVE: CVE-2013-6426 Date: December 11, 2013 Title: Heat CFN policy rules not all enforced Reporter: Steven Hardy (Red Hat) Products: Heat Affects: All supported releases Description: Steven Hardy from Red Hat reported a vulnerability in Heat's default API policy enforcement. By calling the CreateStack or UpdateStack methods, an in-instance user may be able to create or update a stack in violation of the default policy. Only setups using Heat's cloudformation-compatible API are affected. Icehouse (development branch) fix: https://review.openstack.org/61452 Havana fix: https://review.openstack.org/61454 Notes: This fix will be included in the icehouse-2 development milestone and in a future 2013.2.1 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6426 https://launchpad.net/bugs/1256049 -- Jeremy Stanley OpenStack Vulnerability Management Team

1 0

[OSSA 2013-033] Metadata queries from Neutron to Nova are not restricted by tenant (CVE-2013-6419)
by Jeremy Stanley 11 Dec '13

11 Dec '13

OpenStack Security Advisory: 2013-033 CVE: CVE-2013-6419 Date: December 11, 2013 Title: Metadata queries from Neutron to Nova are not restricted by tenant Reporter: Aaron Rosen (VMware) Products: Neutron, Nova Affects: All supported releases Description: Aaron Rosen from VMware reported a vulnerability in the metadata access from OpenStack Neutron to Nova. Because of a missing authorization check on port binding, by guessing an instance_id a tenant may retrieve another tenant's metadata resulting in information disclosure. Only OpenStack setups running neutron-metadata-agent are affected. Icehouse (development branch) fix: https://review.openstack.org/61439 (neutron) https://review.openstack.org/61428 (nova) Havana fix: https://review.openstack.org/61442 (neutron) https://review.openstack.org/61435 (nova) Grizzly fix: https://review.openstack.org/61443 (neutron) https://review.openstack.org/61437 (nova) Notes: This fix will be included in the icehouse-2 development milestone and in a future 2013.2.1 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6419 https://launchpad.net/bugs/1235450 -- Jeremy Stanley OpenStack Vulnerability Management Team

1 0

[OSSA 2013-032] Keystone trust circumvention through EC2-style tokens (CVE-2013-6391)
by Jeremy Stanley 11 Dec '13

11 Dec '13

OpenStack Security Advisory: 2013-032 CVE: CVE-2013-6391 Date: December 11, 2013 Title: Keystone trust circumvention through EC2-style tokens Reporter: Steven Hardy (Red Hat) Products: Keystone Affects: Havana and later Description: Steven Hardy from Red Hat reported a vulnerability in Keystone trusts when used in conjunction with the ec2tokens API. By generating EC2 credentials using a trust-scoped token, a trustee may retrieve a token not scoped to the trust, therefore elevating privileges to all of the trustor's roles. Only Keystone setups enabling EC2-style authentication are affected. Icehouse (development branch) fix: https://review.openstack.org/61419 Havana fix: https://review.openstack.org/61425 Notes: This fix will be included in the icehouse-2 development milestone and in a future 2013.2.1 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6391 https://launchpad.net/bugs/1242597 -- Jeremy Stanley OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Nov 29 – Dec 6)
by Stefano Maffulli 07 Dec '13

07 Dec '13

1 0

Icehouse-1 development milestone available
by Thierry Carrez 06 Dec '13

06 Dec '13

Hi everyone, The first milestone of the Icehouse development cycle, "icehouse-1" is now available for Keystone, Glance, Nova, Horizon, Neutron, Cinder, Ceilometer, Heat, and Trove. It contains all the new features that have been added since the Havana Feature Freeze in September. You can see the full list of new features and fixed bugs, as well as tarball downloads, at: https://launchpad.net/keystone/icehouse/icehouse-1 https://launchpad.net/glance/icehouse/icehouse-1 https://launchpad.net/nova/icehouse/icehouse-1 https://launchpad.net/horizon/icehouse/icehouse-1 https://launchpad.net/neutron/icehouse/icehouse-1 https://launchpad.net/cinder/icehouse/icehouse-1 https://launchpad.net/ceilometer/icehouse/icehouse-1 https://launchpad.net/heat/icehouse/icehouse-1 https://launchpad.net/trove/icehouse/icehouse-1 Including the oslo libraries, 69 blueprints were implemented and 738 bugs were fixed during this milestone. The next development milestone, icehouse-2, is scheduled for January 23rd. You can further track upcoming features and Icehouse release cycle status at: http://status.openstack.org/release/ Regards, -- Thierry Carrez (ttx)

1 0

OpenStack Community Weekly Newsletter (Nov 22 – 29)
by Stefano Maffulli 30 Nov '13

30 Nov '13

1 0

[OSSA 2013-031] Ceilometer DB2/MongoDB backend password leak (CVE-2013-6384)
by Thierry Carrez 25 Nov '13

25 Nov '13

OpenStack Security Advisory: 2013-031 CVE: CVE-2013-6384 Date: November 25, 2013 Title: Ceilometer DB2/MongoDB backend password leak Reporter: Eric Brown (IBM) Products: Ceilometer Affects: All supported versions Description: Eric Brown from IBM reported an information leak in Ceilometer logs. The password for the DB2 or MongoDB backends was logged at INFO level in the ceilometer-api logs. An attacker with access to the logs (local shell, log aggregation system access, or accidental leak) may leverage this vulnerability to elevate privileges and gain direct full access to the Ceilometer backend. Only Ceilometer setups using the DB2 or MongoDB backends are affected. Icehouse (development branch) fix: https://review.openstack.org/#/c/54553/ Havana fix: https://review.openstack.org/#/c/56396/ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6384 https://bugs.launchpad.net/ceilometer/+bug/1244476 Regards, -- Thierry Carrez OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Nov 15 – 22)
by Stefano Maffulli 23 Nov '13

23 Nov '13

1 0

OpenStack Community Weekly Newsletter (Nov 1 – Nov 15)
by Stefano Maffulli 16 Nov '13

16 Nov '13

1 0

[OSSA 2013-030] XenAPI security groups not kept through migrate or resize (CVE-2013-4497)
by Jeremy Stanley 15 Nov '13

15 Nov '13

OpenStack Security Advisory: 2013-030 CVE: CVE-2013-4497 Date: November 14, 2013 Title: XenAPI security groups not kept through migrate or resize Reporter: Chris Behrens (Rackspace) and Vangelis Tasoulas Products: Nova Affects: All supported versions prior to Havana Description: Chris Behrens with Rackspace and Vangelis Tasoulas reported a set of vulnerabilities in OpenStack Nova's XenAPI hypervisor backend. When migrating or resizing an instance, including live migration, existing security groups may not be reapplied after the operation completes. This can lead to unintentional network exposure for virtual machines. Only setups using the XenAPI backend are affected. The Havana release (2013.2) is not affected. Grizzly fixes (will be included in a future stable point release): https://review.openstack.org/52987 https://review.openstack.org/52991 References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4497 https://launchpad.net/bugs/1073306 https://launchpad.net/bugs/1202266 -- Jeremy Stanley OpenStack Vulnerability Management Team

1 0