- OpenStack-announce - lists.openstack.org

[OSSA-2017-004] federated user gets wrong role (CVE-2017-2673)
by Tristan Cacqueray 25 Apr '17

25 Apr '17

================================================================ OSSA-2017-004: Incorrect role assignment with federated Keystone ================================================================ :Date: April 25, 2017 :CVE: CVE-2017-2673 Affects ~~~~~~~ - Keystone: >=10.0.0 <=10.0.1, ==11.0.0 Description ~~~~~~~~~~~ Boris Bobrov from Mail.Ru reported a vulnerability in Keystone Federation. An authenticated user may receive all the roles assigned to the user's project regardless of the federation mapping when there are rules in which group-based assignments are not used. For example, by requesting an admin user to get a role in their project, the user may be granted the admin privileges for new scoped tokens. All setups using the Keystone federation without group based assignments rules are affected. Patches ~~~~~~~ - https://review.openstack.org/459713 (Newton) - https://review.openstack.org/459732 (Ocata) - https://review.openstack.org/459705 (Pike) Credits ~~~~~~~ - Boris Bobrov from Mail.Ru (CVE-2017-2673) References ~~~~~~~~~~ - https://launchpad.net/bugs/1677723 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2673 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[all][elections] Technical Committee Election Results
by Tristan Cacqueray 21 Apr '17

21 Apr '17

Please join me in congratulating the 7 newly elected members of the Technical Committe (TC). Chris Dent (cdent) Davanum Srinivas (dims) Dean Troyer (dtroyer) Flavio Percoco (flaper87) John Garbutt (johnthetubaguy) Sean McGinnis (smcginnis) Thierry Carrez (ttx) Full results: http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_072c4cd7ff0673b5 Election process details and results are also available here: https://governance.openstack.org/election/ Thank you to all of the candidates, having a good group of candidates helps engage the community in our democratic process. Thank you to all who voted and who encouraged others to vote. We need to ensure your voice is heard. Thank you for another great round. -Tristan

1 0

[OSSA-2017-003] XSS in Horizon federation mappings UI (CVE-2017-7400)
by Tristan Cacqueray 06 Apr '17

06 Apr '17

==================================================== OSSA-2017-003: XSS in Horizon federation mappings UI ==================================================== :Date: April 04, 2017 :CVE: CVE-2017-7400 Affects ~~~~~~~ - Horizon: >=9.0.0 <=9.1.1, >=10.0.0 <=10.0.2, ==11.0.0 Description ~~~~~~~~~~~ Eric Brown from VMware reported a vulnerability in Horizon. By creating a malicious federation mapping, an adminstrator may conduct a persistent XSS attack. All Horizon setups are affected. Patches ~~~~~~~ - https://review.openstack.org/442455 (Mitaka) - https://review.openstack.org/442454 (Newton) - https://review.openstack.org/442453 (Ocata) - https://review.openstack.org/442277 (Pike) Credits ~~~~~~~ - Eric Brown from VMware (CVE-2017-7400) References ~~~~~~~~~~ - https://launchpad.net/bugs/1667086 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7400 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OSSA-2017-002] Nova logs sensitive context from notification exceptions (CVE-2017-7214)
by Jeremy Stanley 23 Mar '17

23 Mar '17

======================================================================= OSSA-2017-002: Nova logs sensitive context from notification exceptions ======================================================================= :Date: March 23, 2017 :CVE: CVE-2017-7214 Affects ~~~~~~~ - Nova: >=13.0.0 <=13.1.3, >=14.0.0 <=14.0.4, >=15.0.0 <=15.0.1 Description ~~~~~~~~~~~ Matt Riedemann with Huawei reported a vulnerability in Nova. Legacy notification exception contexts appearing in ERROR level logs may include sensitive information such as account passwords and authorization tokens. All Nova setups are affected. Patches ~~~~~~~ - https://review.openstack.org/447075 (Mitaka) - https://review.openstack.org/447072 (Newton) - https://review.openstack.org/447071 (Ocata) - https://review.openstack.org/446948 (Pike) Credits ~~~~~~~ - Matt Riedemann from Huawei (CVE-2017-7214) References ~~~~~~~~~~ - https://launchpad.net/bugs/1673569 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7214 -- Jeremy Stanley OpenStack Vulnerability Management Team

1 0

OpenStack Ocata is officially released!
by Doug Hellmann 22 Feb '17

22 Feb '17

Hello OpenStack community, I'm overjoyed to announce the final releases for the components of OpenStack Ocata, which conclude the 4-month Ocata development cycle. You will find a complete list of the deliverables for the 33 services and ~190 other components and libraries that make up the Ocata release, their latest versions, and links to individual project release notes documents listed on the release site: https://releases.openstack.org/ocata/ Congratulations to all of the teams who have contributed to this release! Many thanks to our PTLs and release liaisons for their help with release coordination this cycle. Our next production cycle, Pike, has already started. We are back to our regular 6-month development cycle, and you can find details about the release schedule at: https://releases.openstack.org/pike/schedule.html We are currently meeting in Atlanta through February 24 for the Pike Project Team Gathering to plan the work for the upcoming cycle. I hope to see you here! Doug

1 0

Project Team Lead Election Conclusion and Results
by knelson＠openstack.org 08 Feb '17

08 Feb '17

Hello All! Thank you to the electorate, to all those who voted and to all candidates who put their name forward for Project Team Lead (PTL) in this election. A healthy, open process breeds trust in our decision making capability thank you to all those who make this process possible.Now for the results of the PTL election process, please join me in extending congratulations to the following PTLs! * Barbican : Dave McCowan * Chef OpenStack : Jan Klare * Cinder : Sean McGinnis * Cloudkitty : Christophe Sauthier * Community App Catalog : Matthew Wagoner * Congress : Eric K * Designate : Tim Simmons * Documentation : Alexandra Settle * Dragonflow : Omer Anson * Ec2 Api : Alexandre Levine * Freezer : Saad Zaher * Fuel : Vladimir Kuklin * Glance : Brian Rosmaita * Heat : Rico Lin * Horizon : Rob Cresswell * I18n : Ian Y. Choi * Infrastructure : Jeremy Stanley * Ironic : Dmitry Tantsur * Karbor : Yuval Brik * Keystone : Lance Bragstad * Kolla : Michal Jastrzebski * Kuryr : Antoni Segura Puimedon * Magnum : Adrian Otto * Manila : Ben Swartzlander * Mistral : Renat Akhmerov * Monasca : Roland Hochmuth * Murano : Felipe Monteiro * Neutron : Kevin Benton * Nova : Matt Riedemann * Octavia : Michael Johnson * OpenStackAnsible : Andy McCrae * OpenStackClient : Dean Troyer * OpenStack Charms : James Page * Oslo : ChangBo Guo * Packaging Deb : Thomas Goirand * Packaging Rpm : Igor Yozhikov * Puppet OpenStack : Alex Schultz * Quality Assurance : Andrea Frittoli * Rally : Andrey Kurilin * RefStack : Catherine Diep * Release Management : Thierry Carrez * Requirements : Tony Breeds * Sahara : Telles Mota Vidal Nóbrega * Searchlight : Steve McLellan * Security : Robert Clark * Senlin : Qiming Teng * Solum : Devdatta-kulkarni Devdatta-kulkarni * Stable Branch Maintenance : Tony Breeds * Storlets : Eran Rom * Swift : John Dickinson * Tacker : Gongysh Gongysh * Telemetry : Julien Danjou * Tricircle : Chaoyi Huang * Tripleo : Emilien Macchi * Trove : Amrith Amrith * Vitrage : Ifat Afek * Watcher : Alexander Chadin * Winstackers : Claudiu Belu * Zaqar : Fei Long Wang * Zun : Hongbin Lu Elections:* Ironic: [ http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_08ff4080d37365ba ]( http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_08ff4080d37365ba )* Keystone: [ http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_1d2eef76fdfc1ec4 ]( http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_1d2eef76fdfc1ec4 )* Neutron: [ http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_6df9c8e056680402 ]( http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_6df9c8e056680402 )* Quality_Assurance: [ http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_99413ba03ba1c6b3 ]( http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_99413ba03ba1c6b3 )* Stable_Branch_Maintenance: [ http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_b719c6a5a681033b ]( http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_b719c6a5a681033b )Election process details and results are also available here: [ https://governance.openstack.org/election/ ]( https://governance.openstack.org/election/ )Thank you to all involved in the PTL election process, -Kendall Nelson (diablo_rojo)

1 0

[OSSA-2017-001] CatchErrors leaks sensitive values in oslo.middleware (CVE-2017-2592)
by Jeremy Stanley 26 Jan '17

26 Jan '17

==================================================================== OSSA-2017-001: CatchErrors leaks sensitive values in oslo.middleware ==================================================================== :Date: January 26, 2017 :CVE: CVE-2017-2592 Affects ~~~~~~~ - Oslo.middleware: <=3.8.0, >=3.9.0 <=3.19.0, >=3.20.0 <=3.23.0 Description ~~~~~~~~~~~ Divya K Konoor with IBM reported a vulnerability in oslo.middleware. Software using the CatchError class may include sensitive values in the error message accompanying a Traceback, resulting in their disclosure. For example, complete API requests (including keystone tokens in their headers) may leak into neutron error logs. Patches ~~~~~~~ - https://review.openstack.org/425734 (Mitaka) - https://review.openstack.org/425732 (Newton) - https://review.openstack.org/425730 (Ocata) Credits ~~~~~~~ - Divya K Konoor from IBM (CVE-2017-2592) References ~~~~~~~~~~ - https://launchpad.net/bugs/1628031 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2592 -- Jeremy Stanley

1 0

[new][openstackclient] python-openstackclient 3.4.1 release (ocata)
by no-reply＠openstack.org 21 Nov '16

21 Nov '16

We are satisfied to announce the release of: python-openstackclient 3.4.1: OpenStack Command-line Client This release is part of the ocata release series. The source is available from: https://git.openstack.org/cgit/openstack/python-openstackclient Download the package from: https://pypi.python.org/pypi/python-openstackclient Please report issues through launchpad: https://bugs.launchpad.net/python-openstackclient For more details, please see below. 3.4.1 ^^^^^ Bug Fixes * Fix "TypeError: __init__() got an unexpected keyword argument 'project_domain_id'" error with non-password authentication types. [Bug 1642301 (https://bugs.launchpad.net/bugs/1642301)] Changes in python-openstackclient 3.4.0..3.4.1 ---------------------------------------------- 61cc546 Add relnote for release 3.4.1 e51a8d6 Use project_domain_id only in password auth Diffstat (except docs and test files) ------------------------------------- openstackclient/common/client_config.py | 1 + releasenotes/notes/bug-1642301-18b08e0cd4b11687.yaml | 6 ++++++ 2 files changed, 7 insertions(+)

1 0

[new][puppet] puppet-openstack_extras 10.0.0 release (ocata)
by no-reply＠openstack.org 19 Nov '16

19 Nov '16

We are enthusiastic to announce the release of: puppet-openstack_extras 10.0.0: Puppet module for OpenStack Openstack_extras This release is part of the ocata release series. Download the package from: https://tarballs.openstack.org/puppet-openstack_extras/ For more details, please see below. 10.0.0 ^^^^^^ New Features ************ * With a new boolean called manage_virt, allow to whether or not activate RDO CentOS QEMU EV repository that is required when deploying OpenStack Newton with RDO packaging. It's enabled by default to make deployments working out of the box, but can be disabled. Other Notes *********** * Disable EPEL repository setup by default. Keep the boolean if users want it, but add a note that EPEL is not required when deploying OpenStack with RDO repositories. Changes in puppet-openstack_extras 9.4.0..10.0.0 ------------------------------------------------ f4614e7 Prepare 10.0.0 release 011896f Enable release notes translation 920f324 Changed the home-page to point Openstack Puppet Homepage 10401d6 Move rspec-puppet-facts to spec helper bec2257 repos: configure RDO Virtualization repository e361c88 repos: disable EPEL by default deef5b2 Update reno for stable/newton Diffstat (except docs and test files) ------------------------------------- files/RPM-GPG-KEY-CentOS-SIG-Virtualization | 20 +++++++++++++++ manifests/repo/redhat/redhat.pp | 30 ++++++++++++++++++++-- metadata.json | 2 +- .../notes/disable_epel-a07b06048465e7a1.yaml | 5 ++++ releasenotes/notes/rdo-virt-a9fb3681cbc8419e.yaml | 6 +++++ releasenotes/source/conf.py | 7 +++-- releasenotes/source/index.rst | 3 ++- releasenotes/source/newton.rst | 6 +++++ setup.cfg | 2 +- .../openstack_extras_repo_redhat_redhat_spec.rb | 28 ++++++++++++++++++++ spec/spec_helper.rb | 10 +------- 11 files changed, 103 insertions(+), 16 deletions(-)

1 0

[new][tripleo] python-tripleoclient 5.5.0 release (ocata)
by no-reply＠openstack.org 19 Nov '16

19 Nov '16

We are excited to announce the release of: python-tripleoclient 5.5.0: TripleO client This release is part of the ocata release series. Download the package from: https://tarballs.openstack.org/python-tripleoclient/ For more details, please see below. Changes in python-tripleoclient 5.0.0..5.5.0 -------------------------------------------- 2cc4eef Format the nodes list in openstack overcloud delete node f41895e Enable creating images with Glance v2 6581755 Updated from global requirements 0af6646 Default the stack name to 'overcloud' in overcloud node delete fb6f500 Reset the parameter_defaults between deployments via the CLI 000e255 Change wording of help for --update-plan-only 06f7b3a Mock yaml.safe_load safely aac64ef Switch overcloud build images to use ImageBuildManager 0c97318 Change the qemu-img bindep to be qemu-img-ev 4f5be2b Don't assume CountDefault set in roles_data.yaml 5af714c Use correct region value 6e552f6 Fix handling of missing environment files dc138a6 Pass clients to get the get_password function d638745 Updated from global requirements 11e1c3c Do not try to "provide" updated nodes not in "manageable" state d1bd56a Fix nodes count check on stack-update with custom roles 127ceb6 Enable releasenotes translation 5c53f23 Add a flag to allow the plan to be updated without deploying f32600b Updated from global requirements a5c9dd4 Remove osc boilerplate from the readme a85ad62 Use workflow for overcloud node delete 1969ccf Use Password Generation provided by the Mistral workflows 71ebf2a Allow overriding CLI parameter defaults with env files bb72623 Save the result of direct action calls in Mistral c7a1b84 Downloads templates from swift before processing update 435a500 Remove heat_stack_user from the deployer input 73f30b7 Fix get_file in out-of-tree templates 02156cc Add the workflow name to the starting workflow message e64ca0b Add ReNo support 4abd0cd Allow referencing rendered yaml files in resource_registry c683483 Download templates from swift before processing with heatclient a004f68 Updated from global requirements a3f7a78 Remove auth_required=False from upload image command ee42734 Open python-tripleoclient for Ocata a622160 Add optional overcloud deploy roles_data.yaml override 12f3284 Remove another openstackclient import 39dad31 Fix typo: remove redundant 'the' 19e4b1e Add an overcloud rc.v3 file 04f9600 Clear the old environment in rc file 5c7c32a Deprecate a number of CLI args that map directly to Heat params 40c3b92 Using assertIsNone() instead of assertEqual(None) e04dcd2 Add ssl development headers to bindep 13620fc Keystone credentials needs to be set with the overcloud password fe28e43 Stop plan creation when container exists 8b0501c Remove the get_hiera_key function f029263 Change the level of mocking for the wait_for_stack_ready test 4f9e959 Stop logging swiftclient errors 5a90d6b Do not use selinux-permissive for the CentOS image d021bd5 Updated from global requirements 54d814d Use the passed in workflow when creating or updating a plan fc94802 Remove the reference to overcloud-without-mergepy file 841082f Update the Mistral action names 0ab4114 Always use absolute path for tht_root c86f4ca Use a released version of tripleo-common ae8c7a8 Revert "Upgrades: Add 'stack upgrade' command" d280c19 Revert "Upgrades: Add finish stage to 'overcloud upgrade'" a4efa9c Revert "Upgrades: Add initialization stage to 'overcloud upgrade'" 0573b60 Provide more information when 'node provide' fails 86e184e Remove openstackclient imports in the new parameters command a7b2e5e Remove the environments from Mistral when removing from Swift 14191e3 Print the execution ID when starting Mistral workflows c689fc0 Pass the timeout to the deploy workflow 92587b9 Updated from global requirements 6be0142 Remove one last reference to openstackclient.tests d1866ed Add `openstack overcloud plan deploy` 5ecf56c Use the hexdigest of the path to make the filename unique in swift 133e8cf Migrate to using osc-lib ffeb2b1 Add missing unit tests for the 'configure' workflows ee320c5 Remove the rest of a removed path c933998 Do not include epel element when building overcloud images 12932b0 Display error message when socket is closed cfaab14 Tripleoclient leaks temporary files 7923128 Re-enable keystone init deprecation message 2898e75 Get template contents from plan, not local path 943f550 Update plan files when re-deploying d490fd2 Ignore the .eggs directory 5f0694a Generate Keystone credentials for overcloud f1efe9d Add libffi-dev to bindep.txt b0f8708 Replace agent elements with package python-heat-agent-puppet 824620c Remove excessive output when configuring nodes 252f43e Use heatclient poll_for_events in wait_for_stack_ready cbd9f74 Add `overcloud parameters set` to set Heat params in a plan c03ed23 Update the 'overcloud deploy --templates' command to use Mistral 2c0fecf Add 'openstack overcloud plan create' command 3ef0a4b NTP arg should be optional when specified in an environment 7f832fb Throw an error/exception when interactive overcloud update fails Diffstat (except docs and test files) ------------------------------------- .gitignore | 6 +- README.rst | 58 +- bindep.txt | 9 + other-requirements.txt | 5 - releasenotes/source/_static/.placeholder | 0 releasenotes/source/conf.py | 265 +++++++ releasenotes/source/index.rst | 18 + releasenotes/source/unreleased.rst | 5 + requirements.txt | 12 +- setup.cfg | 4 +- test-requirements.txt | 10 +- tools/releasenotes_tox.sh | 28 + tox.ini | 5 +- tripleoclient/__init__.py | 3 +- tripleoclient/constants.py | 29 +- tripleoclient/exceptions.py | 4 + tripleoclient/plugin.py | 41 +- .../v1/overcloud_deploy/test_overcloud_deploy.py | 864 ++++++++++++++++----- .../test_overcloud_deploy_validators.py | 2 +- .../v1/overcloud_image/test_overcloud_image.py | 146 +++- .../v1/overcloud_update/test_overcloud_update.py | 63 +- .../v1/overcloud_upgrade/test_overcloud_upgrade.py | 156 ---- tripleoclient/utils.py | 386 ++++----- tripleoclient/v1/baremetal.py | 17 +- tripleoclient/v1/overcloud_deploy.py | 582 +++++++++----- tripleoclient/v1/overcloud_execute.py | 2 +- tripleoclient/v1/overcloud_image.py | 254 ++++-- tripleoclient/v1/overcloud_netenv_validate.py | 4 +- tripleoclient/v1/overcloud_node.py | 39 +- tripleoclient/v1/overcloud_parameters.py | 64 ++ tripleoclient/v1/overcloud_plan.py | 77 +- tripleoclient/v1/overcloud_profiles.py | 7 +- tripleoclient/v1/overcloud_update.py | 56 +- tripleoclient/v1/overcloud_upgrade.py | 102 --- tripleoclient/v1/undercloud.py | 2 +- tripleoclient/workflows/baremetal.py | 58 +- tripleoclient/workflows/base.py | 36 + tripleoclient/workflows/deployment.py | 82 ++ tripleoclient/workflows/parameters.py | 47 ++ tripleoclient/workflows/plan_management.py | 150 ++++ tripleoclient/workflows/scale.py | 58 ++ tripleoclient/workflows/templates.py | 17 + 60 files changed, 3468 insertions(+), 1396 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 8923978..3ac8274 100644 --- a/requirements.txt +++ b/requirements.txt @@ -4 +4 @@ -pbr>=1.6 # Apache-2.0 +pbr>=1.8 # Apache-2.0 @@ -7 +6,0 @@ Babel>=2.3.4 # BSD -cliff!=1.16.0,!=1.17.0,>=1.15.0 # Apache-2.0 @@ -11 +10 @@ python-ironic-inspector-client>=1.5.0 # Apache-2.0 -python-heatclient>=1.1.0 # Apache-2.0 +python-heatclient>=1.5.0 # Apache-2.0 @@ -14 +13 @@ python-mistralclient>=2.0.0 # Apache-2.0 -python-openstackclient>=2.1.0 # Apache-2.0 +python-openstackclient>=3.3.0 # Apache-2.0 @@ -16,0 +16 @@ os-cloud-config # Apache-2.0 +osc-lib>=1.2.0 # Apache-2.0 @@ -18,3 +18 @@ websocket-client>=0.32.0 # LGPLv2+ - -# tripleo-common lib is not yet on PyPi --e git://github.com/openstack/tripleo-common.git#egg=tripleo_common +tripleo-common>=5.0.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index 984b41e..c03ae21 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -6 +6 @@ hacking<0.11,>=0.10.2 -coverage>=3.6 # Apache-2.0 +coverage>=4.0 # Apache-2.0 @@ -9,2 +9,2 @@ mock>=2.0 # BSD -oslosphinx!=3.4.0,>=2.5.0 # Apache-2.0 -sphinx!=1.3b1,<1.3,>=1.2.1 # BSD +oslosphinx>=4.7.0 # Apache-2.0 +sphinx!=1.3b1,<1.4,>=1.2.1 # BSD @@ -12,0 +13,4 @@ testtools>=1.4.0 # MIT +requests-mock>=1.1 # Apache-2.0 + +# releasenotes +reno>=1.8.0 # Apache-2.0

1 0