- OpenStack-announce - lists.openstack.org

[OSSA-2019-003] Nova Server Resource Faults Leak External Exception Details (CVE-2019-14433)
by Jeremy Stanley 06 Aug '19

06 Aug '19

========================================================================== OSSA-2019-003: Nova Server Resource Faults Leak External Exception Details ========================================================================== :Date: August 06, 2019 :CVE: CVE-2019-14433 Affects ~~~~~~~ - Nova: <17.0.12,>=18.0.0<18.2.2,>=19.0.0<19.0.2 Description ~~~~~~~~~~~ Donny Davis with Intel reported a vulnerability in Nova Compute resource fault handling. If an API request from an authenticated user ends in a fault condition due to an external exception, details of the underlying environment may be leaked in the response and could include sensitive configuration or other data. Patches ~~~~~~~ - https://review.openstack.org/674908 (Ocata) - https://review.openstack.org/674877 (Pike) - https://review.openstack.org/674859 (Queens) - https://review.openstack.org/674848 (Rocky) - https://review.openstack.org/674828 (Stein) - https://review.openstack.org/674821 (Train) Credits ~~~~~~~ - Donny Davis from Intel (CVE-2019-14433) References ~~~~~~~~~~ - https://launchpad.net/bugs/1837877 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14433 Notes ~~~~~ - The stable/ocata and stable/pike branches are under extended maintenance and will receive no new point releases, but patches for them are provided as a courtesy. -- Jeremy Stanley OpenStack Vulnerability Management Team

1 0

OpenStack Stein is officially released!
by Sean McGinnis 10 Apr '19

10 Apr '19

Hello OpenStack community, I'm excited to announce the final releases for the components of OpenStack Stein, which conclude the Stein development cycle. You will find a complete list of all components, their latest versions, and links to individual project release notes documents listed on the release site. https://releases.openstack.org/stein/ Congratulations to all of the teams who have contributed to this release! Our next production cycle, Train, has already started. We will meet in Denver, CO May 2-4 at the Project Team Gathering to plan the work for the upcoming cycle. I hope to see you there! Thanks, Sean McGinnis and the whole Release Management team

1 0

[OSSA-2019-002] Unable to install new flows on compute nodes when having broken security group rules (CVE-2019-10876)
by Gage Hugo 09 Apr '19

09 Apr '19

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 =========================================================================================== OSSA-2019-002: Overlapping security group rules prevents compute node network configuration =========================================================================================== :Date: April 08, 2019 :CVE: CVE-2019-10876 Affects ~~~~~~~ - - Neutron: >=11.0.0 <11.0.7, >=12.0.0 <12.0.6, >=13.0.0 <13.0.3 Description ~~~~~~~~~~~ Diko Parvanov (Canonical) reported a vulnerability in neutron- openvswitch-agent security group rules. By creating two security groups with separate/overlapping port ranges, an authenticated user may prevent neutron from being able to configure networks on any compute nodes where those security groups are present. All neutron deployments utilizing neutron-openvswitch-agent are affected. Patches ~~~~~~~ - - https://review.openstack.org/648102 (Pike) - - https://review.openstack.org/648004 (Queens) - - https://review.openstack.org/648003 (Rocky) - - https://review.openstack.org/648002 (Stein) - - https://review.openstack.org/640252 (Train) Credits ~~~~~~~ - - Diko Parvanov from Canonical (CVE-2019-10876) References ~~~~~~~~~~ - - https://launchpad.net/bugs/1813007 - - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10876 -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEWa125cLHIuv6ekof56j9K3b+vREFAlysvccACgkQ56j9K3b+ vREj3BAAvVBLfJT/cOyk2VjXjvlNKBWs1uokNE5PwzT0M2kvEW42zG78JpJj9EyJ ONQMCiuclWJ6XcBLBhDG2MHzl31Rqnfhi1UxQoUPwZYtgTcokLa4NaGCQUMrRwpq vigC8zWA9SiIQBHp4b/HE1ZA0GCKgK5CS2OuqmQH25/AzIDqwZZ7ljstRMh28VDd PnorJwifeKq1uUL1AGRWmDUvfYaqzTbMxNlUcrXt2Iy50VLxdokmD+PtZMLvb7lq UcpJ7R/er6HipNDE42hNzQAgEoPBNJ3hwEiLU64ZPCxSCMeKos5d2yAPNwLUYwdm lVYJQtW1GkNDLvY37pHOFzFCK2XhjKQB29iZjz5ipC9EKs1HLnxCfJfvIS+bK3Bt c3R0frUOOiDPeP+so1edl1f0eZJlhzV3SlFsLfLfFa1BYTxj6uuQdSaPaOTCGaLN 4TLAtysGl+USvXirOH+F/vuz9P0LOlL4f86/gwNY9Asb27MmKZFtUhQLux/k34Xg gwSFtWTKqLJWrZjlGL/9irh6PiS6myrPCxsYh8XXOpVHSw5D353NrZ3hapvUthA6 BoArm9XxRlwzgu8JwXpEAc9FXRg3jUcwMrSYc5yZF4mw95+sfdHKVhoI6LuxBkYd dA0aqbB/QkuFSanDZ+Z634LCkfbk/2Eo3HgjsrPUdvg2z2zLwfk= =53iD -----END PGP SIGNATURE-----

1 0

[OSSA-2019-001] Unsupported dport option prevents applying security groups in OpenStack Neutron (CVE-2019-9735)
by Jeremy Stanley 18 Mar '19

18 Mar '19

========================================================================= OSSA-2019-001: Unsupported dport option prevents applying security groups ========================================================================= :Date: March 13, 2019 :CVE: CVE-2019-9735 Affects ~~~~~~~ - Neutron: <10.0.8, >=11.0.0 <11.0.7, >=12.0.0 <12.0.6, >=13.0.0 <13.0.3 Description ~~~~~~~~~~~ Erik Olof Gunnar Andersson with Blizzard Entertainment reported a vulnerability in Neutron's iptables firewall module. By setting a destination port in a security group rule along with a protocol which doesn't support that option (for example, VRRP), an authenticated user may block further application of security group rules for instances from any project/tenant on the compute hosts to which it's applied. Only deployments using the iptables security group driver are affected. Patches ~~~~~~~ - https://review.openstack.org/640791 (Ocata) - https://review.openstack.org/640790 (Pike) - https://review.openstack.org/640702 (Queens) - https://review.openstack.org/640685 (Rocky) - https://review.openstack.org/640619 (Stein) Credits ~~~~~~~ - Erik Olof Gunnar Andersson from Blizzard Entertainment (CVE-2019-9735) References ~~~~~~~~~~ - https://launchpad.net/bugs/1818385 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9735 -- Jeremy Stanley

1 0

OpenStack Rocky is officially released!
by Sean McGinnis 30 Aug '18

30 Aug '18

Hello OpenStack community, I'm excited to announce the final releases for the components of OpenStack Rocky, which conclude the Rocky development cycle. You will find a complete list of all components, their latest versions, and links to individual project release notes documents listed on the new release site. https://releases.openstack.org/rocky/ Congratulations to all of the teams who have contributed to this release! Our next production cycle, Stein, has already started. We will meet in Denver, Colorado, USA September 10-14 at the Project Team Gathering to plan the work for the upcoming cycle. I hope to see you there! Thanks, Sean McGinnis and the whole Release Management team

1 0

[all][elections] Project Team Lead Election Conclusion and Results
by Tony Breeds 07 Aug '18

07 Aug '18

Thank you to the electorate, to all those who voted and to all candidates who put their name forward for Project Team Lead (PTL) in this election. A healthy, open process breeds trust in our decision making capability thank you to all those who make this process possible. Now for the results of the PTL election process, please join me in extending congratulations to the following PTLs: * Adjutant : Adrian Turjak * Barbican : Ade Lee * Blazar : Pierre Riteau * Chef OpenStack : Samuel Cassiba * Cinder : Jay Bryant * Cloudkitty : Luka Peschke * Congress : Eric Kao * Cyborg : Li Liu * Designate : Graham Hayes * Documentation : Petr Kovar * Dragonflow : [1] * Ec2 Api : Andrey Pavlov * Freezer : [1] * Glance : Erno Kuvaja * Heat : Rico Lin * Horizon : Ivan Kolodyazhny * I18n : Frank Kloeker * Infrastructure : Clark Boylan * Ironic : Julia Kreger * Karbor : Pengju Jiao * Keystone : Lance Bragstad * Kolla : Eduardo Gonzalez Gutierrez * Kuryr : Daniel Mellado * Loci : [1] * Magnum : Spyros Trigazis * Manila : Thomas Barron * Masakari : Sampath Priyankara * Mistral : Dougal Matthews * Monasca : Witek Bedyk * Murano : Rong Zhu * Neutron : Miguel Lavalle * Nova : Melanie Witt * Octavia : Michael Johnson * OpenStackAnsible : Mohammed Naser * OpenStackClient : Dean Troyer * OpenStackSDK : Monty Taylor * OpenStack Charms : Frode Nordahl * OpenStack Helm : Pete Birley * Oslo : Ben Nemec * Packaging Rpm : [1] * PowerVMStackers : Matthew Edmonds * Puppet OpenStack : Tobias Urdin * Qinling : Lingxian Kong * Quality Assurance : Ghanshyam Mann * Rally : Andrey Kurilin * RefStack : [1] * Release Management : Sean McGinnis * Requirements : Matthew Thode * Sahara : Telles Nobrega * Searchlight : [1] * Security : [1] * Senlin : Duc Truong * Solum : Rong Zhu * Storlets : Kota Tsuyuzaki * Swift : John Dickinson * Tacker : dharmendra kushwaha * Telemetry : Julien Danjou * Tricircle : baisen song * Tripleo : Juan Osorio Robles * Trove : [1] * Vitrage : Ifat Afek * Watcher : Alexander Chadin * Winstackers : [1] * Zaqar : wang hao * Zun : Wei Ji Elections: * Senlin: http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_5655e3b3821ece95 * Tacker: http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_fe41cc8acc6ead91 Election process details and results are also available here: https://governance.openstack.org/election/ Thank you to all involved in the PTL election process, Yours Tony. [1] The TC is currently evaluating options for these projects.

1 0

[OSSA-2018-002] GET /v3/OS-FEDERATION/projects leaks project information (CVE-2018-14432)
by Matthew Thode 25 Jul '18

25 Jul '18

======================================================================= OSSA-2018-002: GET /v3/OS-FEDERATION/projects leaks project information ======================================================================= :Date: July 25, 2018 :CVE: CVE-2018-14432 Affects ~~~~~~~ - Keystone: <11.0.4, ==12.0.0, ==13.0.0 Description ~~~~~~~~~~~ Kristi Nikolla with Boston University reported a vulnerability in Keystone federation. By doing GET /v3/OS-FEDERATION/projects an authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected. Patches ~~~~~~~ - https://review.openstack.org/585802 (Ocata) - https://review.openstack.org/585792 (Pike) - https://review.openstack.org/585788 (Queens) - https://review.openstack.org/585782 (Rocky) Credits ~~~~~~~ - Kristi Nikolla from Boston University (CVE-2018-14432) References ~~~~~~~~~~ - https://launchpad.net/bugs/1779205 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14432

1 0

[OSSA-2018-001] Raw underlying encrypted volume access (CVE-2017-18191)
by Tristan Cacqueray 20 Apr '18

20 Apr '18

===================================================== OSSA-2018-001: Raw underlying encrypted volume access ===================================================== :Date: April 20, 2018 :CVE: CVE-2017-18191 Affects ~~~~~~~ - Nova: >=15.0.0 <=15.1.0, >=16.0.0 <=16.1.1 Description ~~~~~~~~~~~ Lee Yarwood (Red Hat) reported a vulnerability in Nova encrypted volumes handling. By detaching and reattaching an encrypted volume an attacker may access the underlying raw volume and corrupt the LUKS header resuling in a denial of service attack on the compute host. All Nova setups supporting encrypted volumes are affected. Patches ~~~~~~~ - https://review.openstack.org/561604 (Ocata) - https://review.openstack.org/543569 (Pike) - https://review.openstack.org/460243 (Queens) Credits ~~~~~~~ - Lee Yarwood from Red Hat (CVE-2017-18191) References ~~~~~~~~~~ - https://launchpad.net/bugs/1739593 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18191 Notes ~~~~~ - Pike and Ocata patches disable encrypted volume swapping, this feature is now only supported in Nova version >= 17.0.0. -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Queens is officially released!
by Sean McGinnis 28 Feb '18

28 Feb '18

Hello OpenStack community, I'm excited to announce the final releases for the components of OpenStack Queens, which conclude the Queens development cycle. You will find a complete list of all components, their latest versions, and links to individual project release notes documents listed on the new release site. https://releases.openstack.org/queens/ Congratulations to all of the teams who have contributed to this release! The Rocky cycle work is off to a good start this week with the Project Team Gathering in Dublin. Let's keep the momentum going! Thanks, Sean

1 0

[OSSA 2017-005.1] Nova Filter Scheduler bypass through rebuild action (CVE-2017-16239) ERRATA
by Tristan Cacqueray 05 Dec '17

05 Dec '17

==================================================================== OSSA-2017-005.1: Nova Filter Scheduler bypass through rebuild action ==================================================================== :Date: November 14, 2017 :CVE: CVE-2017-16239 Affects ~~~~~~~ - Nova: <=14.0.10, >=15.0.0 <=15.0.8, >=16.0.0 <=16.0.3 Description ~~~~~~~~~~~ George Shuklin from servers.com reported a vulnerability in Nova. By rebuilding an instance, an authenticated user may be able to circumvent the Filter Scheduler bypassing imposed filters (for example, the ImagePropertiesFilter or the IsolatedHostsFilter). All setups using Nova Filter Scheduler are affected. Errata ~~~~~~ The former fix introduced regressions in the rebuild functionality. Rebuild may fail depending on configured scheduler filters and environment, for example, when the compute host is running at capacity or when the host is disabled. This update provides an additional set of fixes for these regressions. Patches ~~~~~~~ - https://review.openstack.org/519684 (Newton) - https://review.openstack.org/523434 (errata) (Newton) - https://review.openstack.org/519681 (Ocata) - https://review.openstack.org/523427 (errata) (Ocata) - https://review.openstack.org/519672 (Pike) - https://review.openstack.org/523212 (errata) (Pike) - https://review.openstack.org/519662 (Queens) - https://review.openstack.org/521186 (errata) (Queens) Credits ~~~~~~~ - George Shuklin from Servers.com (CVE-2017-16239) References ~~~~~~~~~~ - https://launchpad.net/bugs/1664931 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16239 OSSA History ~~~~~~~~~~~~ - 2017-12-05 - Errata 1 - 2017-11-14 - Original Version -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0