- OpenStack-announce - lists.openstack.org

[OSSA-2018-002] GET /v3/OS-FEDERATION/projects leaks project information (CVE-2018-14432)
by Matthew Thode 25 Jul '18

25 Jul '18

======================================================================= OSSA-2018-002: GET /v3/OS-FEDERATION/projects leaks project information ======================================================================= :Date: July 25, 2018 :CVE: CVE-2018-14432 Affects ~~~~~~~ - Keystone: <11.0.4, ==12.0.0, ==13.0.0 Description ~~~~~~~~~~~ Kristi Nikolla with Boston University reported a vulnerability in Keystone federation. By doing GET /v3/OS-FEDERATION/projects an authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected. Patches ~~~~~~~ - https://review.openstack.org/585802 (Ocata) - https://review.openstack.org/585792 (Pike) - https://review.openstack.org/585788 (Queens) - https://review.openstack.org/585782 (Rocky) Credits ~~~~~~~ - Kristi Nikolla from Boston University (CVE-2018-14432) References ~~~~~~~~~~ - https://launchpad.net/bugs/1779205 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14432

1 0

[OSSA-2018-001] Raw underlying encrypted volume access (CVE-2017-18191)
by Tristan Cacqueray 20 Apr '18

20 Apr '18

===================================================== OSSA-2018-001: Raw underlying encrypted volume access ===================================================== :Date: April 20, 2018 :CVE: CVE-2017-18191 Affects ~~~~~~~ - Nova: >=15.0.0 <=15.1.0, >=16.0.0 <=16.1.1 Description ~~~~~~~~~~~ Lee Yarwood (Red Hat) reported a vulnerability in Nova encrypted volumes handling. By detaching and reattaching an encrypted volume an attacker may access the underlying raw volume and corrupt the LUKS header resuling in a denial of service attack on the compute host. All Nova setups supporting encrypted volumes are affected. Patches ~~~~~~~ - https://review.openstack.org/561604 (Ocata) - https://review.openstack.org/543569 (Pike) - https://review.openstack.org/460243 (Queens) Credits ~~~~~~~ - Lee Yarwood from Red Hat (CVE-2017-18191) References ~~~~~~~~~~ - https://launchpad.net/bugs/1739593 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18191 Notes ~~~~~ - Pike and Ocata patches disable encrypted volume swapping, this feature is now only supported in Nova version >= 17.0.0. -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Queens is officially released!
by Sean McGinnis 28 Feb '18

28 Feb '18

Hello OpenStack community, I'm excited to announce the final releases for the components of OpenStack Queens, which conclude the Queens development cycle. You will find a complete list of all components, their latest versions, and links to individual project release notes documents listed on the new release site. https://releases.openstack.org/queens/ Congratulations to all of the teams who have contributed to this release! The Rocky cycle work is off to a good start this week with the Project Team Gathering in Dublin. Let's keep the momentum going! Thanks, Sean

1 0

[OSSA 2017-005.1] Nova Filter Scheduler bypass through rebuild action (CVE-2017-16239) ERRATA
by Tristan Cacqueray 05 Dec '17

05 Dec '17

==================================================================== OSSA-2017-005.1: Nova Filter Scheduler bypass through rebuild action ==================================================================== :Date: November 14, 2017 :CVE: CVE-2017-16239 Affects ~~~~~~~ - Nova: <=14.0.10, >=15.0.0 <=15.0.8, >=16.0.0 <=16.0.3 Description ~~~~~~~~~~~ George Shuklin from servers.com reported a vulnerability in Nova. By rebuilding an instance, an authenticated user may be able to circumvent the Filter Scheduler bypassing imposed filters (for example, the ImagePropertiesFilter or the IsolatedHostsFilter). All setups using Nova Filter Scheduler are affected. Errata ~~~~~~ The former fix introduced regressions in the rebuild functionality. Rebuild may fail depending on configured scheduler filters and environment, for example, when the compute host is running at capacity or when the host is disabled. This update provides an additional set of fixes for these regressions. Patches ~~~~~~~ - https://review.openstack.org/519684 (Newton) - https://review.openstack.org/523434 (errata) (Newton) - https://review.openstack.org/519681 (Ocata) - https://review.openstack.org/523427 (errata) (Ocata) - https://review.openstack.org/519672 (Pike) - https://review.openstack.org/523212 (errata) (Pike) - https://review.openstack.org/519662 (Queens) - https://review.openstack.org/521186 (errata) (Queens) Credits ~~~~~~~ - George Shuklin from Servers.com (CVE-2017-16239) References ~~~~~~~~~~ - https://launchpad.net/bugs/1664931 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16239 OSSA History ~~~~~~~~~~~~ - 2017-12-05 - Errata 1 - 2017-11-14 - Original Version -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OSSA-2017-005] Nova Filter Scheduler bypass through rebuild action (CVE-2017-16239)
by Tristan Cacqueray 14 Nov '17

14 Nov '17

================================================================== OSSA-2017-005: Nova Filter Scheduler bypass through rebuild action ================================================================== :Date: November 14, 2017 :CVE: CVE-2017-16239 Affects ~~~~~~~ - Nova: <=14.0.9, >=15.0.0 <=15.0.7, >=16.0.0 <=16.0.2 Description ~~~~~~~~~~~ George Shuklin from servers.com reported a vulnerability in Nova. By rebuilding an instance, an authenticated user may be able to circumvent the Filter Scheduler bypassing imposed filters (for example, the ImagePropertiesFilter or the IsolatedHostsFilter). All setups using Nova Filter Scheduler are affected. Patches ~~~~~~~ - https://review.openstack.org/519684 (Newton) - https://review.openstack.org/519681 (Ocata) - https://review.openstack.org/519672 (Pike) - https://review.openstack.org/519662 (Queens) Credits ~~~~~~~ - George Shuklin from Servers.com (CVE-2017-16239) References ~~~~~~~~~~ - https://launchpad.net/bugs/1664931 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16239 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Pike is officially released!
by Thierry Carrez 30 Aug '17

30 Aug '17

Hello OpenStack community, I'm proud and excited to announce the final release for the components of OpenStack Pike, which concludes the 6-month Pike development cycle. You will find a complete list of all components, their latest versions, and links to individual project release notes documents listed on the OpenStack releases site: https://releases.openstack.org/pike/ Congratulations to everyone who has contributed to making this release a success. Pike saw contributions from more than 1800 individuals, bringing the total number of contributors to OpenStack since 2012 up to 6650. During the Pike cycle we merged an average of 220 changes per day, which makes OpenStack one of the most active software development project out there today. Our next development cycle, Queens, has already started. Project team members will meet in Denver starting on September 11 at the Project Teams Gathering to kickstart the work for the coming 6 months. I hope to see you there! Thanks, -- Thierry Carrez (ttx)

1 0

[OSSA-2017-004] federated user gets wrong role (CVE-2017-2673)
by Tristan Cacqueray 25 Apr '17

25 Apr '17

================================================================ OSSA-2017-004: Incorrect role assignment with federated Keystone ================================================================ :Date: April 25, 2017 :CVE: CVE-2017-2673 Affects ~~~~~~~ - Keystone: >=10.0.0 <=10.0.1, ==11.0.0 Description ~~~~~~~~~~~ Boris Bobrov from Mail.Ru reported a vulnerability in Keystone Federation. An authenticated user may receive all the roles assigned to the user's project regardless of the federation mapping when there are rules in which group-based assignments are not used. For example, by requesting an admin user to get a role in their project, the user may be granted the admin privileges for new scoped tokens. All setups using the Keystone federation without group based assignments rules are affected. Patches ~~~~~~~ - https://review.openstack.org/459713 (Newton) - https://review.openstack.org/459732 (Ocata) - https://review.openstack.org/459705 (Pike) Credits ~~~~~~~ - Boris Bobrov from Mail.Ru (CVE-2017-2673) References ~~~~~~~~~~ - https://launchpad.net/bugs/1677723 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2673 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[all][elections] Technical Committee Election Results
by Tristan Cacqueray 20 Apr '17

20 Apr '17

Please join me in congratulating the 7 newly elected members of the Technical Committe (TC). Chris Dent (cdent) Davanum Srinivas (dims) Dean Troyer (dtroyer) Flavio Percoco (flaper87) John Garbutt (johnthetubaguy) Sean McGinnis (smcginnis) Thierry Carrez (ttx) Full results: http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_072c4cd7ff0673b5 Election process details and results are also available here: https://governance.openstack.org/election/ Thank you to all of the candidates, having a good group of candidates helps engage the community in our democratic process. Thank you to all who voted and who encouraged others to vote. We need to ensure your voice is heard. Thank you for another great round. -Tristan

1 0

[OSSA-2017-003] XSS in Horizon federation mappings UI (CVE-2017-7400)
by Tristan Cacqueray 05 Apr '17

05 Apr '17

==================================================== OSSA-2017-003: XSS in Horizon federation mappings UI ==================================================== :Date: April 04, 2017 :CVE: CVE-2017-7400 Affects ~~~~~~~ - Horizon: >=9.0.0 <=9.1.1, >=10.0.0 <=10.0.2, ==11.0.0 Description ~~~~~~~~~~~ Eric Brown from VMware reported a vulnerability in Horizon. By creating a malicious federation mapping, an adminstrator may conduct a persistent XSS attack. All Horizon setups are affected. Patches ~~~~~~~ - https://review.openstack.org/442455 (Mitaka) - https://review.openstack.org/442454 (Newton) - https://review.openstack.org/442453 (Ocata) - https://review.openstack.org/442277 (Pike) Credits ~~~~~~~ - Eric Brown from VMware (CVE-2017-7400) References ~~~~~~~~~~ - https://launchpad.net/bugs/1667086 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7400 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OSSA-2017-002] Nova logs sensitive context from notification exceptions (CVE-2017-7214)
by Jeremy Stanley 23 Mar '17

23 Mar '17

======================================================================= OSSA-2017-002: Nova logs sensitive context from notification exceptions ======================================================================= :Date: March 23, 2017 :CVE: CVE-2017-7214 Affects ~~~~~~~ - Nova: >=13.0.0 <=13.1.3, >=14.0.0 <=14.0.4, >=15.0.0 <=15.0.1 Description ~~~~~~~~~~~ Matt Riedemann with Huawei reported a vulnerability in Nova. Legacy notification exception contexts appearing in ERROR level logs may include sensitive information such as account passwords and authorization tokens. All Nova setups are affected. Patches ~~~~~~~ - https://review.openstack.org/447075 (Mitaka) - https://review.openstack.org/447072 (Newton) - https://review.openstack.org/447071 (Ocata) - https://review.openstack.org/446948 (Pike) Credits ~~~~~~~ - Matt Riedemann from Huawei (CVE-2017-7214) References ~~~~~~~~~~ - https://launchpad.net/bugs/1673569 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7214 -- Jeremy Stanley OpenStack Vulnerability Management Team

1 0