- OpenStack-announce - lists.openstack.org

[ANNOUNCE] OpenStack Nova, Glance, Keystone, Cinder, Quantum and Horizon 2012.2.1 released
by Mark McLoughlin 30 Nov '12

30 Nov '12

Hey, In the time since the Folsom release, we have been busy selectively back-porting bugfixes to the stable/folsom branch according to our "safe source of high-impact fixes" criteria documented here: http://wiki.openstack.org/StableBranch We're happy to announce the 2012.2.1 release, the first in the series of releases to make available the bugfixes from stable/folsom. These releases are bugfix updates to Folsom and are intended to be relatively risk free with no intentional regressions or API changes. A total of 139 bugs have been fixed in this release, which is a higher than the usual volume of fixes in a stable release. The list of bugs fixed can be seen here: https://launchpad.net/nova/folsom/2012.2.1 https://launchpad.net/glance/folsom/2012.2.1 https://launchpad.net/keystone/folsom/2012.2.1 https://launchpad.net/cinder/folsom/2012.2.1 https://launchpad.net/quantum/folsom/2012.2.1 https://launchpad.net/horizon/folsom/2012.2.1 Please read (and add to!) the release notes at: http://wiki.openstack.org/ReleaseNotes/2012.2.1 Enjoy! Mark.

1 0

[OSSA 2012-019] Extension of token validity through token chaining (CVE-2012-5563)
by Thierry Carrez 28 Nov '12

28 Nov '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 OpenStack Security Advisory: 2012-019 CVE: CVE-2012-5563 Date: November 28, 2012 Title: Extension of token validity through token chaining Reporter: Anndy Products: Keystone Affects: Folsom, Grizzly Description: Anndy reported a vulnerability in token chaining in Keystone. A token expiration date can be circumvented by creating a new token before the old one has expired. An authenticated and authorized user could potentially leverage this vulnerability to extend his access beyond the account owner expectations. Note: this vulnerability was fixed in the past (CVE-2012-3426) but was reintroduced in Folsom when code was refactored to support PKI tokens. Grizzly (development branch) fix: https://github.com/openstack/keystone/commit/38c7e46a640a94da4da89a39a5a1ea… Folsom fix (included in upcoming Keystone 2012.2.1 stable update): https://github.com/openstack/keystone/commit/f9d4766249a72d8f88d75dcf1575b2… References: https://bugs.launchpad.net/keystone/+bug/1079216 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2012-5563 - -- Thierry Carrez (ttx) OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iQIcBAEBCAAGBQJQtjwXAAoJEFB6+JAlsQQj3cwP/3FUjqWBxAHgRTMWz2Df5JML DZIelkcq3kxSn05GCJ25FU5JyA3lWvqqoEsU4+SxytBTNAGYhDe8toSo74xU4PlU g3+A2V5oUMEJnyCS6ps7YMiLmd1unN3Fz/yrqxAZE7GRv+voD1l64+2IHK15bN7G WG+FxN3CgRK+pk+3MpPkaNLI1L9wTeYTPUgBdem+I7xhmLRsf5TBO1gqu3gHja1+ gvpWjezroWrVdAuqWFFsgzWf7LUZqZR/AqaWwS4DrHJ4LoD+ruHXNGvGyg1BQg8d IhqgAhBSdndlaJWTr6fj2KoqhpJK8Wu4VKIr9yIekbQIzJx11IYA9vjiJ38eJ2v1 x2NLnNDKrq2Q51l+iAy5MMbqmFWqljwZhPNfDW+ysybFMG1CtEnCgQPLqmbF9m9m 8M9uV/vfGKuD73GpmMR7MlHldySv+uiqJnFzyCce+QMzP7enCBitBDp0t52dRal7 TrTR7HGXIkVJ4I/73o3MBAfQrzmTsSIYmuVybArnaNzvrcT6aZTKH8hSPWRKVqx/ pcBP7Z+wLzHkJELWD0X9vgZJZJUj5qbMx6jq0NYYWY1lCrLTIRxXppS76/ZUzzIm qGS7FqUQM8u+x8rynnKNattFjWOdwXcFhcy3Io3Noc3kBDTgZf4fshBHWbO0XOqf BI3upFpAwQ4g4ep16o1k =CZnJ -----END PGP SIGNATURE-----

1 0

[OSSA 2012-018] EC2-style credentials invalidation issue (CVE-2012-5571)
by Thierry Carrez 28 Nov '12

28 Nov '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 OpenStack Security Advisory: 2012-018 CVE: CVE-2012-5571 Date: November 28, 2012 Title: EC2-style credentials invalidation issue Reporter: Vijaya Erukala Products: Keystone Affects: All versions Description: Vijaya Erukala reported a vulnerability in Keystone EC2-style credentials invalidation: when a user is removed from a tenant, issued EC2-style credentials would continue to be valid for that tenant. An authenticated and authorized user could potentially leverage this vulnerability to extend his access beyond the account owner expectations. Only setups enabling EC2-style credentials (for example enabling EC2 API in Nova) are affected. Grizzly (development branch) fix: http://github.com/openstack/keystone/commit/9d68b40cb9ea818c48152e6c712ff41… Folsom fix (included in upcoming Keystone 2012.2.1 stable update): http://github.com/openstack/keystone/commit/37308dd4f3e33f7bd0f71d83fd51734… Essex fix: http://github.com/openstack/keystone/commit/8735009dc5b895db265a1cd573f39f4… References: https://bugs.launchpad.net/keystone/+bug/1064914 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2012-5571 - -- Thierry Carrez (ttx) OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iQIcBAEBCAAGBQJQtjAkAAoJEFB6+JAlsQQj+4sP/0uKJHxXeCY3HcAdMUtkYP+5 QyQGnscOhlggr9iE3ifPWkiLALPbfVrdwp/nJr0psXiUnf60QX4Pfj63VJz23DSf 1Hk/Z3yY5oWmCCgT8/DMgw+SPhkn09YfS6f5KwuMR5zdEX345myp2MFcc1/mgNzx CfVKagHoCq8rrIhTjhAvyy5iwY/ZvbDFIgWKzgr3KCSm+76QuIqIoXHkdiCGYm4q OMfKEcS1WQZlmUddc54fR2g6kFY/sIsVKGdCtqJBqc6COU+MyUuhNvs7niXGK1Ep cU3U7tV6JCK58K70vgtQ0O5EWcDKm/Yfh5Sf/wmJTDwE2UxI8OGNEAzNJl/qxdEw iMUp/qRObtnN2t7pF2Rf7/ixZsTWSxpFToq6BZl4O4pghqQZQgZ9dGVgtSFkX8Tn crMjs8oWwtJuu1/paHje0O+9Y23NHMIdAg3ccjJUkC8MxfcnrxZkYd5XHZytecff iWPUWmm3ISFkOQQPuemah0vcu2Y+YvhjEY9b5nL2Ew6I/E4DeYxL1HwpeBA0lzrt w7nQgWCyf+ERz2g1liesuaSJ0CPBmKe93ji20kVvHTV9IRXmC3zK/SDhXtgultVo DmY/ovoUjTw9sg60CceTNXAUz4/4QbbUV79vFQ/06sThZ8t7ZW1kTfOrTSG6M4uw a557x0IhXfUedbbLCsE6 =+0zu -----END PGP SIGNATURE-----

1 0

Grizzly-1 development milestone available (Keystone, Glance, Nova, Horizon, Quantum, Cinder)
by Thierry Carrez 23 Nov '12

23 Nov '12

Hi everyone, The first milestone of the Grizzly development cycle, "grizzly-1" is now available. It contains all the new features that have been added since the Folsom pre-release Feature Freeze in September. You can see the full list of new features and fixed bugs, as well as tarball downloads, at: https://launchpad.net/keystone/grizzly/grizzly-1 https://launchpad.net/glance/grizzly/grizzly-1 https://launchpad.net/nova/grizzly/grizzly-1 https://launchpad.net/horizon/grizzly/grizzly-1 https://launchpad.net/quantum/grizzly/grizzly-1 https://launchpad.net/cinder/grizzly/grizzly-1 The Grizzly development cycle is now in full swing. The next milestone, grizzly-2, is scheduled for delivery on January 10th. Regards, -- Thierry Carrez (ttx) Release Manager, OpenStack

1 0

[Swift] Swift 1.7.5 released
by John Dickinson 21 Nov '12

21 Nov '12

I'm pleased to announce that Swift 1.7.5 has been released. This release is the work of twenty-seven contributors and includes several important new features and bug fixes. You can get a tarball of this release at http://launchpad.net/swift/+milestone/1.7.5. Like all Swift releases, you can upgrade your currently running clusters to this version with no client downtime. The (https://github.com/openstack/swift/blob/master/CHANGELOG) is also available with the source. This release would not have been possible without the hard work of the many contributors and core developers who spent time submitting and reviewing patches. With the addition of the nine new contributors in this release, Swift has eighty-four total contributors. You can see the full list of contributors at https://github.com/openstack/swift/blob/master/AUTHORS. I'd like to highlight a few of the bigger changes to Swift that have gone into this release. CORS Swift now supports setting CORS (http://en.wikipedia.org/wiki/Cross-origin_resource_sharing) headers on your data. This allows HTML5 forms, browser uploads, and JavaScript to work between your website and your Swift storage. Users can set `X-Container-Meta-Access-Control-Allow- Origin`, `X-Container-Meta-Access-Control-Max-Age`, and `X-Container- Meta-Access-Control-Allow-Headers` on their containers to allow CORS support. Custom log handlers Custom log handlers allow depoyers to more easily integrate with external log processors. This mechanism provides the ability to add your own handler to the log messages that Swift generates. The full docs are at http://docs.openstack.org/developer/swift/admin_guide.html#custom-log-handl…. Multi-Range GETs Swift has always supported single range requests, but the HTTP spec allows for requesting multiple ranges of a resource at once. Swift now supports this feature on standard objects, and support against large object manifests should be available in a later release. Configurable constraints Deployers can set the client limits in a config file. These limits include the maximum object size, the maximum number of items returned in listings, and the limits on metadata. You can read the fully- commented sample config file at https://github.com/openstack/swift/blob/master/etc/swift.conf-sample. Replicators can run against a specific partition or device Replicators can now replicate a specific partition or device. This feature allows deployers to prioritize data replication for data that may not be fully replicated. For example, although Swift detects missing replicas automatically, a deployer can choose to replicate a specific set of data before the automatic systems detect the error. --John

1 0

OpenStack Community Weekly Newsletter (Nov 9-16)
by Stefano Maffulli 17 Nov '12

17 Nov '12

Highlights of the week OpenStack Outreach Program for Women Accepting Candidates <http://www.openstack.org/blog/2012/11/openstack-outreach-program-for-women-…> OpenStack provides open source software for building public and private clouds. We are constantly moving and growing and very excited to invite newcomers to our community. To this end, the OpenStack Foundation has joined the GNOME Outreach Program for Women <https://live.gnome.org/OutreachProgramForWomen>. Join the list of mentors, contribute ideas <http://wiki.openstack.org/OutreachProgramForWomen/Ideas>, apply as intern. What's new in libvirt for the OpenStack Nova Folsom release <http://berrange.com/posts/2012/11/16/what-was-new-in-libvirt-for-the-openst…> Even if Folsom has been out for a while now, Daniel P. Berrangé <http://berrange.com/> provided a little more detail on some of the changes he was involved with making to the libvirt driver and what motivated them. Why to refactor the virt disk API in Nova <http://berrange.com/posts/2012/11/15/692/> When launching a virtual machine, Nova <http://openstack.org/> has the ability to inject various files into the disk image immediately prior to boot up. Nova runs as an unprivileged user, and the guest files to be changed are typically owned as root. This means all the file injection commands need to run via Nova's rootwrap utility to gain root privileges. It should come as little surprise that this has already resulted in a security vulnerability / CVE <https://lists.launchpad.net/openstack/msg14089.html> against Nova. The solution to this class of security problems is to decouple the file injection code from the host filesystem. Read more on Daniel's blog post <http://berrange.com/posts/2012/11/15/692/>. Swift 1.7.5 Released <http://swiftstack.com/blog/2012/11/14/swift-1.7.5-release/> Swift 1.7.5 has been released. This release is the work of twenty-seven contributors and includes several important new features and bug fixes. Making keystoneclient python library a little easier to work with <http://www.rhonabwy.com/wp/2012/11/11/making-keystoneclient-python-library-…> A quick guide to using the python keystoneclient library and some of its new features, with v2 API examples throughout. Installing OpenStack Nova Compute on Hyper-V <http://www.cloudbase.it/installing-openstack-nova-compute-on-hyper-v/> A lot of work went on OpenStack and Hyper-V integration, with the result of bringing back Hyper-V in the Nova sources <https://github.com/openstack/nova> in time for the Folsom release. Get started with OpenStack and Hyper-V using the installer developed by Cloudbase Solutions. Security Advisories * CVE-2012-4573, CVE-2012-5482 -- Authentication bypass for image deletion <http://secstack.org/2012/11/cve-2012-4573-cve-2012-5482-authentication-bypa…> Tips and tricks * By Hui Cheng <http://freedomhui.com/>: How to Deploy Hadoop Cluster In Openstack Intances Using Apache Ambari <http://freedomhui.com/2012/11/how-to-deploy-hadoop-cluster-using-apache-amb…> * By Sébastien Han <http://sebastien-han.fr/>: OpenStack Retrieve usage statictics <http://sebastien-han.fr/blog/2012/11/09/tip-openstack-retrieve-usage-static…> Upcoming Events * OpenStack Delhi NCR Meetup <http://www.meetup.com/Indian-OpenStack-User-Group/events/90700582/> Nov 17, 2012 -- Delhi, India Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/90700582/> * Australian OpenStack User Group -- Brisbane Technical Meetup <http://aosug.openstack.org.au/> Nov 20, 2012 -- Brisbane and other cities Details <http://aosug.openstack.org.au/> * OpenStack China Tour: Nanjing <http://hui.csdn.net/MeetingInfo.aspx?mid=155> Nov 24, 2012 -- Nanjing, China Details <http://hui.csdn.net/MeetingInfo.aspx?mid=155> * OpenStack Users November meetup <http://www.meetup.com/Indian-OpenStack-User-Group/events/90021782/> Nov 25, 2012 -- Bangalore, India Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/90021782/> * OpenStack Israel <http://www.meetup.com/IGTCloud/events/87103152/> Nov 27, 2012 -- Tel Aviv, Israel Register <http://www.meetup.com/IGTCloud/events/87103152/> * OpenStack in action! <http://openstackinaction3theopenrevolution.eventbrite.com/> Nov 29, 2012 -- Paris, France Register <http://openstackinaction3theopenrevolution.eventbrite.com/> * Pune OpenStack Meetup <http://www.meetup.com/Indian-OpenStack-User-Group/events/89610092/> Dec 02, 2012 -- Pune, India Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/89610092/> * EMEA OpenStack Day <http://emeaopenstackday2.eventbrite.com/> Dec 05, 2012 -- London Details <http://emeaopenstackday2.eventbrite.com/> Other news * MediaGoblin adding support to OpenStack Swift <http://maffulli.net/2012/11/14/mediagoblin-adding-support-to-openstack-swif…> * Report from China OpenStack Tour @ Xi'an <http://freedomhui.com/2012/11/china-openstack-tour-xian/> * Question about Oslo library versioning <http://markmail.org/message/yklxhylbsmyjjpx7> * OpenStack Project Meeting: Summary <http://eavesdrop.openstack.org/meetings/project/2012/project.2012-11-13-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2012/project.2012-11-13-21.…> Foundation News * OpenStack Foundation Board Meeting Unofficial Minutes Nov 16 <http://lists.openstack.org/pipermail/foundation/2012-November/001249.html> * OpenStack Foundation Board Meeting Official Minutes Nov 2 <http://wiki.openstack.org/Governance/Foundation/02Nov2012BoardMinutes> Welcome new contributors Celebrating the first patches submitted this month by: * Hendrik Volkmer, Cloudbau * Andrew Bogott, Wikimedia Foundation * Tim Daly, Jr, Yahoo! Inc * Darren Worrall /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

OpenStack Community Weekly Newsletter (Nov 2-9)
by Stefano Maffulli 09 Nov '12

09 Nov '12

Highlights of the week The future of Incubation and Core <http://markmail.org/message/hmc2cmf3wycrqhpe> Incubation is currently an OpenStack project status that grants a promising project more access to OpenStack shared resources, especially in the CI, release management and QA space. The level of maturity reached by OpenStack requires revising the concept of 'Core project' and the incubation process. Join the discussion and help the Technical Committee form an opinion for the Foundation's Board. OpenStack Keystone plans for the Grizzly release <http://www.rhonabwy.com/wp/2012/11/08/openstack-keystone-plans-for-the-griz…> Joe Heck published the plans for Keystone over the Grizzly release cycle. To read after going through the state of the project slides <http://www.slideshare.net/ccjoe/oct-2012-state-of-project-keystone>. OpenStack Image Service -- Grizzly Planning <http://bcwaldon.cc/2012/11/06/openstack-image-service-grizzly.html> The primary objective of Glance is to publish a catalog of virtual machine images. Rather than own users' image data, Glance simply tracks where that data resides. Glance owns the metadata provided by users. Brian Waldon summarizes the plans for Glance over the Grizzly release cycle. FOSDEM 2013: Cloud Devroom -- Call for Participation <http://markmail.org/message/di5u4o5bskmzrti3> The organizers of the Cloud devroom at FOSDEM 2012 invite you to submit a session proposal. The purpose of this devroom is to serve as a meeting point for cloud infrastructure projects, including a unique opportunity for discussion and collaboration between developers from different projects. This devroom will be focused on open source cloud infrastructure projects. Security Advisors * Authentication bypass for image deletion (CVE-2012-4573, CVE-2012-5482) ERRATA 1 <http://markmail.org/message/hn4cxgtyoxvk2mt2> Tips and tricks * By Everett Toews <http://blog.phymata.com/>: OpenStack devstack on the Rackspace open cloud <http://blog.phymata.com/2012/11/08/openstack-devstack-on-the-rackspace-open…> * By Jim Jiang intern of Sina SWS: How WsgiServer Deal With Requests ? <http://freedomhui.com/2012/11/openstack-nova-basics-to-see-how-wsgiserver-d…> * By Sébastien Han <http://sebastien-han.fr/>: Tip: lock an instance against admin permissions <http://sebastien-han.fr/blog/2012/11/07/tip-lock-an-instance-against-admin-…> * By Sébastien Han <http://sebastien-han.fr/>: Tip: Add a specific keypair to a flavor <http://sebastien-han.fr/blog/2012/11/05/tip-add-a-specific-keypair-to-a-fla…> * OpenStack Folsom Install Guide <https://github.com/mseknibilel/OpenStack-Folsom-Install-guide/blob/master/O…> Upcoming Events * OpenStack China Tour: Shanghai <http://hui.csdn.net/MeetingInfo.aspx?mid=153> Nov 10, 2012 -- Shanghai, China * Hungary User Group Meeting <http://www.meetup.com/OpenStack-Hungary-Meetup-Group/events/88548072/> Nov 13, 2012 -- Budapest, Hungary Details <http://www.meetup.com/OpenStack-Hungary-Meetup-Group/events/88548072/> * Swiss OpenStack user group meeting <http://www.meetup.com/zhgeeks/events/82917082/> Nov 15, 2012 -- Zürich, CH Details <http://www.meetup.com/zhgeeks/events/82917082/> * Australian OpenStack User Group -- Brisbane Technical Meetup <http://aosug.openstack.org.au/> Nov 20, 2012 -- Brisbane and other cities Details <http://aosug.openstack.org.au/> * OpenStack China Tour: Nanjing <http://hui.csdn.net/MeetingInfo.aspx?mid=155> Nov 24, 2012 -- Nanjing, China Details <http://hui.csdn.net/MeetingInfo.aspx?mid=155> * OpenStack Israel <http://www.meetup.com/IGTCloud/events/87103152/> Nov 27, 2012 -- Tel Aviv, Israel Register <http://www.meetup.com/IGTCloud/events/87103152/> * OpenStack in action! <http://openstackinaction3theopenrevolution.eventbrite.com/> Nov 29, 2012 -- Paris, France Register <http://openstackinaction3theopenrevolution.eventbrite.com/> * EMEA OpenStack Day <http://www.openstack.org/> Dec 05, 2012 -- London Details <http://www.openstack.org/> Other news * Planet OpenStack <http://planet.openstack.org/> has a new skin. Add you OpenStack blog to the Planet * Hui Cheng <http://freedomhui.com/> reports from China OpenStack Tour @ Chengdu <http://freedomhui.com/2012/11/chian-openstack-tour-chengdu/> * Julien Danjou <http://julien.danjou.info/blog/> reports from OpenStack France meetup #2 <http://julien.danjou.info/blog/2012/openstack-france-meetup-2> * Hendrik Volkmer <http://blog.hendrikvolkmer.de/>: Status of the SmartOS OpenStack Port <http://blog.hendrikvolkmer.de/2012/11/06/status-of-the-smartos-openstack-po…> * Matt Ray <http://leastresistance.wordpress.com/>: Chef for OpenStack Status 11/2 <http://leastresistance.wordpress.com/2012/11/02/chef-for-openstack-status-1…> * OpenStack Project Meeting: Summary <http://eavesdrop.openstack.org/meetings/project/2012/project.2012-11-06-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2012/project.2012-11-06-21.…> The list of projects to coordinate during the meeting is growing fast. Welcome new contributors Celebrating the first patches submitted this month by: * Yuan Zhou, Intel * Nicolas Simonds, Metacloud * Rushi Agrawal * Malini Bhandaru, Intel /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 1

[OSSA 2012-017.1] Authentication bypass for image deletion (CVE-2012-4573, CVE-2012-5482) ERRATA 1
by Russell Bryant 09 Nov '12

09 Nov '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 OpenStack Security Advisory: 2012-017 (ERRATA 1) CVE: CVE-2012-4573, CVE-2012-5482 Date: November 9, 2012 Title: Authentication bypass for image deletion Impact: High Reporter: Gabe Westmaas (Rackspace) Products: Glance Affects: Essex, Folsom, Grizzly Description: Gabe Westmaas from Rackspace reported a vulnerability in Glance authentication of image deletion requests. Authenticated users may be able to delete arbitrary, non-protected images from Glance servers. All Folsom and Grizzly deployments are affected. Additionally, Essex deployments that use the delayed_delete option are also affected. Fixes: Grizzly: https://github.com/openstack/glance/commit/6ab0992e5472ae3f9bef0d2ced410306… https://github.com/openstack/glance/commit/b591304b8980d8aca8fa6cda9ea1621a… 2012.2 (Folsom): https://github.com/openstack/glance/commit/90bcdc5a89e350a358cf320a03f5afe9… https://github.com/openstack/glance/commit/fc0ee7623ec59c87ac6fc671e95a9798… 2012.1 (Essex): https://github.com/openstack/glance/commit/efd7e75b1f419a52c7103c7840e24af8… References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-4573 http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-5482 https://bugs.launchpad.net/glance/+bug/1065187 https://bugs.launchpad.net/glance/+bug/1076506 Notes: This fix will be included in the grizzly-1 development milestone and in a future 2012.2 (Folsom) release. OSSA History: 2012-11-09 - Errata 1 - Updated to reflect that the v2 API in Folsom and Grizzly was also affected - Include links to fixes for the v2 API - Added CVE-2012-5482 for the vulnerability against the v2 API 2012-11-07 - Original Version - -- Russell Bryant OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://www.enigmail.net/ iEYEARECAAYFAlCdDn0ACgkQFg9ft4s9SAaDMQCfec7E8Dc8kL0ILEgUT39nqWty npgAnRtJtgD7Zrtll9yBYA33egUnPdcj =P/7D -----END PGP SIGNATURE-----

1 0

[OSSA 2012-017] Authentication bypass for image deletion (CVE-2012-4573)
by Russell Bryant 09 Nov '12

09 Nov '12

OpenStack Security Advisory: 2012-017 CVE: CVE-2012-4573 Date: November 7, 2012 Title: Authentication bypass for image deletion Impact: High Reporter: Gabe Westmaas (Rackspace) Products: Glance Affects: Essex, Folsom, Grizzly Description: Gabe Westmaas from Rackspace reported a vulnerability in Glance authentication of image deletion requests. Authenticated users may be able to delete arbitrary, non-protected images from Glance servers. Only Folsom/Grizzly deployments that expose the v1 API are affected by this vulnerability. Additionally, Essex deployments that use the delayed_delete option are also affected. Fixes: Grizzly: https://github.com/openstack/glance/commit/6ab0992e5472ae3f9bef0d2ced410306… 2012.2 (Folsom): https://github.com/openstack/glance/commit/90bcdc5a89e350a358cf320a03f5afe9… 2012.1 (Essex): https://review.openstack.org/#/c/15562/ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-4573 https://bugs.launchpad.net/glance/+bug/1065187 Notes: This fix will be included in the grizzly-1 development milestone and in a future 2012.2 (Folsom) release. -- Russell Bryant OpenStack Vulnerability Management Team

1 1

OpenStack Community Weekly Newsletter (Oct 26-Nov 2)
by Stefano Maffulli 02 Nov '12

02 Nov '12

Highlights of the week Videos of OpenStack Summit Fall 2012 published <http://www.openstack.org/summit/san-diego-2012/openstack-summit-sessions/> The Summit was packed with amazing content, including user stories from Cisco WebEx, Living Social and CERN, 100+ developer working sessions and two full days of workshops. We now have more than 80 videos ready to view <http://www.openstack.org/summit/san-diego-2012/openstack-summit-sessions/> from the keynotes and breakout presentations: What did you like and how would you improve the OpenStack Summit? <https://www.surveymonkey.com/s/OpenStackFall2012> We're working hard to make each Summit better than the last. Please help us by taking this quick survey about your experience in San Diego <https://www.surveymonkey.com/s/OpenStackFall2012> by Friday, November 9. Welcome StackMeat.org <http://stackmeat.org/blog/welcome-stackmeatorg> Born from a personal itch by Márton Kiss, he contributed a central place where to find informations about existing projects of wider OpenStack ecosystem. CloudEnvy -- vagrant for OpenStack <http://www.rhonabwy.com/wp/2012/10/28/cloudenvy-vagrant-for-openstack/> What's CloudEnvy? Joe Heck <http://www.rhonabwy.com/wp> says it is "the most interesting illustration of CloudEnvy is using it to spin up an instance in a cloud, and then run devstack <https://github.com/openstack-dev/devstack> in that instance." EMEA OpenStack Day: Call For Speakers & Prospectus For Sponsors <http://www.openstack.org/blog/2012/10/emea-openstack-day-call-for-speakers-…> EMEA OpenStack Day is happening Wednesday, December 5, 2012 in London. You can find out more details about the event on the OpenStack Day EventBrite <http://emeaopenstackday2.eventbrite.com/> page. Nominations are open for speaker presentations. The deadline for speaker submissions is November 9, 2012. The sponsor prospectus <http://www.openstack.org/assets/EMEA-sponsorship-prospectus-london-12-5-201…> is now available online. There are five available event sponsor packages. Multifactor Auth and Keystone <http://adam.younglogic.com/2012/10/multifactor-auth-and-keystone/> The topic of how to enforce multifactor authentication with Keystone tokens came up often during the Design Summit in San Diego. Adam Young <http://adam.younglogic.com/> wrote a summary of the discussions. Link to the blueprint. <https://blueprints.launchpad.net/keystone/+spec/multi-factor-authn> PKI tokens and Horizon <http://adam.younglogic.com/2012/10/pki-tokens-horizon/> With PKI, tokens have gone from 40 byte to 3000. This plus additional payload in Horizon means that they no longer fit inside an HTTP cookie. How do we deal with this? Tips and tricks * By Everett Toews <http://blog.phymata.com/>: Contributing OpenStack Support to jclouds <http://blog.phymata.com/2012/10/03/contributing-openstack-support-to-jcloud…> (Updated to Folsom) Upcoming Events * OpenStack China Tour: Xi'an <http://hui.csdn.net/MeetingInfo.aspx?mid=151> Nov 03, 2012 -- Xi'an, China Details <http://www.cyberport.hk/campaign/edm/speaker/edm.html> * The Cloud is Open <http://www.cyberport.hk/campaign/edm/speaker/edm.html> Nov 06, 2012 -- Hong Kong Details <http://www.cyberport.hk/campaign/edm/speaker/edm.html> * Hungary User Group Meeting <http://www.meetup.com/OpenStack-Hungary-Meetup-Group/events/88548072/> Nov 13, 2012 -- Budapest, Hungary Details <http://www.meetup.com/OpenStack-Hungary-Meetup-Group/events/88548072/> * Swiss OpenStack user group meeting <http://www.meetup.com/zhgeeks/events/82917082/> Nov 15, 2012 -- Zürich, CH Details <http://www.meetup.com/zhgeeks/events/82917082/> * Australian OpenStack User Group -- Brisbane Technical Meetup <http://aosug.openstack.org.au/> Nov 20, 2012 -- Brisbane and other cities Details <http://aosug.openstack.org.au/> * OpenStack in action! <http://openstackinaction3theopenrevolution.eventbrite.com/> Nov 29, 2012 -- Paris, France Register <http://openstackinaction3theopenrevolution.eventbrite.com/> * EMEA OpenStack Day <http://www.openstack.org/> Dec 05, 2012 -- London Details <http://www.openstack.org/> Other news * Submit your presentation for the first Australian linux.conf.au OpenStack miniconf <http://firedaemon.wufoo.com/forms/z7x2p1/> * libvirt 1.0.0 release and 7th birthday <http://berrange.com/posts/2012/11/02/announce-libvirt-1-0-0-release-and-7th…> * Video: How Cisco Webex deploys OpenStack Private Cloud into Production <http://www.mirantis.com/blog/cisco-webex-mirantis-openstack-private-cloud-p…> * Mirantis brings OpenStack Cloud to Open Storage Summit 2012 <http://www.mirantis.com/blog/mirantis-brings-openstack-cloud-to-open-storag…> * OpenStack Project Meeting: skipped this week Welcome new contributors Celebrating the first patches submitted this month by: Melanie Witt, Yahoo! * Matthias Runge, RedHat * long-wang, CS2C * Rainya Mosher, Rackspace * James Page, Ubuntu * Pedro Navarro Perez, * Gerardo Porras, Yahoo! * Guang-yee, HP * Davanum Srinivas * Sathish Nagappan, Nebula * galstrom21, Rackspace * David Kang, ISI * Andrea Rosa, HP * jking-6, Internap * sathish-nagappan, Nebula * Alex Handle * Dan Radez, RedHat * Michael H Wilson * Jolyon Brown * Derrick J. Wippler * boden, IBM /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0