- OpenStack-announce - lists.openstack.org

OpenStack Queens is officially released!
by Sean McGinnis 28 Feb '18

28 Feb '18

Hello OpenStack community, I'm excited to announce the final releases for the components of OpenStack Queens, which conclude the Queens development cycle. You will find a complete list of all components, their latest versions, and links to individual project release notes documents listed on the new release site. https://releases.openstack.org/queens/ Congratulations to all of the teams who have contributed to this release! The Rocky cycle work is off to a good start this week with the Project Team Gathering in Dublin. Let's keep the momentum going! Thanks, Sean

1 0

[OSSA 2017-005.1] Nova Filter Scheduler bypass through rebuild action (CVE-2017-16239) ERRATA
by Tristan Cacqueray 05 Dec '17

05 Dec '17

==================================================================== OSSA-2017-005.1: Nova Filter Scheduler bypass through rebuild action ==================================================================== :Date: November 14, 2017 :CVE: CVE-2017-16239 Affects ~~~~~~~ - Nova: <=14.0.10, >=15.0.0 <=15.0.8, >=16.0.0 <=16.0.3 Description ~~~~~~~~~~~ George Shuklin from servers.com reported a vulnerability in Nova. By rebuilding an instance, an authenticated user may be able to circumvent the Filter Scheduler bypassing imposed filters (for example, the ImagePropertiesFilter or the IsolatedHostsFilter). All setups using Nova Filter Scheduler are affected. Errata ~~~~~~ The former fix introduced regressions in the rebuild functionality. Rebuild may fail depending on configured scheduler filters and environment, for example, when the compute host is running at capacity or when the host is disabled. This update provides an additional set of fixes for these regressions. Patches ~~~~~~~ - https://review.openstack.org/519684 (Newton) - https://review.openstack.org/523434 (errata) (Newton) - https://review.openstack.org/519681 (Ocata) - https://review.openstack.org/523427 (errata) (Ocata) - https://review.openstack.org/519672 (Pike) - https://review.openstack.org/523212 (errata) (Pike) - https://review.openstack.org/519662 (Queens) - https://review.openstack.org/521186 (errata) (Queens) Credits ~~~~~~~ - George Shuklin from Servers.com (CVE-2017-16239) References ~~~~~~~~~~ - https://launchpad.net/bugs/1664931 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16239 OSSA History ~~~~~~~~~~~~ - 2017-12-05 - Errata 1 - 2017-11-14 - Original Version -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OSSA-2017-005] Nova Filter Scheduler bypass through rebuild action (CVE-2017-16239)
by Tristan Cacqueray 14 Nov '17

14 Nov '17

================================================================== OSSA-2017-005: Nova Filter Scheduler bypass through rebuild action ================================================================== :Date: November 14, 2017 :CVE: CVE-2017-16239 Affects ~~~~~~~ - Nova: <=14.0.9, >=15.0.0 <=15.0.7, >=16.0.0 <=16.0.2 Description ~~~~~~~~~~~ George Shuklin from servers.com reported a vulnerability in Nova. By rebuilding an instance, an authenticated user may be able to circumvent the Filter Scheduler bypassing imposed filters (for example, the ImagePropertiesFilter or the IsolatedHostsFilter). All setups using Nova Filter Scheduler are affected. Patches ~~~~~~~ - https://review.openstack.org/519684 (Newton) - https://review.openstack.org/519681 (Ocata) - https://review.openstack.org/519672 (Pike) - https://review.openstack.org/519662 (Queens) Credits ~~~~~~~ - George Shuklin from Servers.com (CVE-2017-16239) References ~~~~~~~~~~ - https://launchpad.net/bugs/1664931 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16239 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

OpenStack Pike is officially released!
by Thierry Carrez 30 Aug '17

30 Aug '17

Hello OpenStack community, I'm proud and excited to announce the final release for the components of OpenStack Pike, which concludes the 6-month Pike development cycle. You will find a complete list of all components, their latest versions, and links to individual project release notes documents listed on the OpenStack releases site: https://releases.openstack.org/pike/ Congratulations to everyone who has contributed to making this release a success. Pike saw contributions from more than 1800 individuals, bringing the total number of contributors to OpenStack since 2012 up to 6650. During the Pike cycle we merged an average of 220 changes per day, which makes OpenStack one of the most active software development project out there today. Our next development cycle, Queens, has already started. Project team members will meet in Denver starting on September 11 at the Project Teams Gathering to kickstart the work for the coming 6 months. I hope to see you there! Thanks, -- Thierry Carrez (ttx)

1 0

[OSSA-2017-004] federated user gets wrong role (CVE-2017-2673)
by Tristan Cacqueray 25 Apr '17

25 Apr '17

================================================================ OSSA-2017-004: Incorrect role assignment with federated Keystone ================================================================ :Date: April 25, 2017 :CVE: CVE-2017-2673 Affects ~~~~~~~ - Keystone: >=10.0.0 <=10.0.1, ==11.0.0 Description ~~~~~~~~~~~ Boris Bobrov from Mail.Ru reported a vulnerability in Keystone Federation. An authenticated user may receive all the roles assigned to the user's project regardless of the federation mapping when there are rules in which group-based assignments are not used. For example, by requesting an admin user to get a role in their project, the user may be granted the admin privileges for new scoped tokens. All setups using the Keystone federation without group based assignments rules are affected. Patches ~~~~~~~ - https://review.openstack.org/459713 (Newton) - https://review.openstack.org/459732 (Ocata) - https://review.openstack.org/459705 (Pike) Credits ~~~~~~~ - Boris Bobrov from Mail.Ru (CVE-2017-2673) References ~~~~~~~~~~ - https://launchpad.net/bugs/1677723 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2673 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[all][elections] Technical Committee Election Results
by Tristan Cacqueray 21 Apr '17

21 Apr '17

Please join me in congratulating the 7 newly elected members of the Technical Committe (TC). Chris Dent (cdent) Davanum Srinivas (dims) Dean Troyer (dtroyer) Flavio Percoco (flaper87) John Garbutt (johnthetubaguy) Sean McGinnis (smcginnis) Thierry Carrez (ttx) Full results: http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_072c4cd7ff0673b5 Election process details and results are also available here: https://governance.openstack.org/election/ Thank you to all of the candidates, having a good group of candidates helps engage the community in our democratic process. Thank you to all who voted and who encouraged others to vote. We need to ensure your voice is heard. Thank you for another great round. -Tristan

1 0

[OSSA-2017-003] XSS in Horizon federation mappings UI (CVE-2017-7400)
by Tristan Cacqueray 06 Apr '17

06 Apr '17

==================================================== OSSA-2017-003: XSS in Horizon federation mappings UI ==================================================== :Date: April 04, 2017 :CVE: CVE-2017-7400 Affects ~~~~~~~ - Horizon: >=9.0.0 <=9.1.1, >=10.0.0 <=10.0.2, ==11.0.0 Description ~~~~~~~~~~~ Eric Brown from VMware reported a vulnerability in Horizon. By creating a malicious federation mapping, an adminstrator may conduct a persistent XSS attack. All Horizon setups are affected. Patches ~~~~~~~ - https://review.openstack.org/442455 (Mitaka) - https://review.openstack.org/442454 (Newton) - https://review.openstack.org/442453 (Ocata) - https://review.openstack.org/442277 (Pike) Credits ~~~~~~~ - Eric Brown from VMware (CVE-2017-7400) References ~~~~~~~~~~ - https://launchpad.net/bugs/1667086 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7400 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[OSSA-2017-002] Nova logs sensitive context from notification exceptions (CVE-2017-7214)
by Jeremy Stanley 23 Mar '17

23 Mar '17

======================================================================= OSSA-2017-002: Nova logs sensitive context from notification exceptions ======================================================================= :Date: March 23, 2017 :CVE: CVE-2017-7214 Affects ~~~~~~~ - Nova: >=13.0.0 <=13.1.3, >=14.0.0 <=14.0.4, >=15.0.0 <=15.0.1 Description ~~~~~~~~~~~ Matt Riedemann with Huawei reported a vulnerability in Nova. Legacy notification exception contexts appearing in ERROR level logs may include sensitive information such as account passwords and authorization tokens. All Nova setups are affected. Patches ~~~~~~~ - https://review.openstack.org/447075 (Mitaka) - https://review.openstack.org/447072 (Newton) - https://review.openstack.org/447071 (Ocata) - https://review.openstack.org/446948 (Pike) Credits ~~~~~~~ - Matt Riedemann from Huawei (CVE-2017-7214) References ~~~~~~~~~~ - https://launchpad.net/bugs/1673569 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7214 -- Jeremy Stanley OpenStack Vulnerability Management Team

1 0

OpenStack Ocata is officially released!
by Doug Hellmann 22 Feb '17

22 Feb '17

Hello OpenStack community, I'm overjoyed to announce the final releases for the components of OpenStack Ocata, which conclude the 4-month Ocata development cycle. You will find a complete list of the deliverables for the 33 services and ~190 other components and libraries that make up the Ocata release, their latest versions, and links to individual project release notes documents listed on the release site: https://releases.openstack.org/ocata/ Congratulations to all of the teams who have contributed to this release! Many thanks to our PTLs and release liaisons for their help with release coordination this cycle. Our next production cycle, Pike, has already started. We are back to our regular 6-month development cycle, and you can find details about the release schedule at: https://releases.openstack.org/pike/schedule.html We are currently meeting in Atlanta through February 24 for the Pike Project Team Gathering to plan the work for the upcoming cycle. I hope to see you here! Doug

1 0

Project Team Lead Election Conclusion and Results
by knelson＠openstack.org 09 Feb '17

09 Feb '17

Hello All! Thank you to the electorate, to all those who voted and to all candidates who put their name forward for Project Team Lead (PTL) in this election. A healthy, open process breeds trust in our decision making capability thank you to all those who make this process possible.Now for the results of the PTL election process, please join me in extending congratulations to the following PTLs! * Barbican : Dave McCowan * Chef OpenStack : Jan Klare * Cinder : Sean McGinnis * Cloudkitty : Christophe Sauthier * Community App Catalog : Matthew Wagoner * Congress : Eric K * Designate : Tim Simmons * Documentation : Alexandra Settle * Dragonflow : Omer Anson * Ec2 Api : Alexandre Levine * Freezer : Saad Zaher * Fuel : Vladimir Kuklin * Glance : Brian Rosmaita * Heat : Rico Lin * Horizon : Rob Cresswell * I18n : Ian Y. Choi * Infrastructure : Jeremy Stanley * Ironic : Dmitry Tantsur * Karbor : Yuval Brik * Keystone : Lance Bragstad * Kolla : Michal Jastrzebski * Kuryr : Antoni Segura Puimedon * Magnum : Adrian Otto * Manila : Ben Swartzlander * Mistral : Renat Akhmerov * Monasca : Roland Hochmuth * Murano : Felipe Monteiro * Neutron : Kevin Benton * Nova : Matt Riedemann * Octavia : Michael Johnson * OpenStackAnsible : Andy McCrae * OpenStackClient : Dean Troyer * OpenStack Charms : James Page * Oslo : ChangBo Guo * Packaging Deb : Thomas Goirand * Packaging Rpm : Igor Yozhikov * Puppet OpenStack : Alex Schultz * Quality Assurance : Andrea Frittoli * Rally : Andrey Kurilin * RefStack : Catherine Diep * Release Management : Thierry Carrez * Requirements : Tony Breeds * Sahara : Telles Mota Vidal Nóbrega * Searchlight : Steve McLellan * Security : Robert Clark * Senlin : Qiming Teng * Solum : Devdatta-kulkarni Devdatta-kulkarni * Stable Branch Maintenance : Tony Breeds * Storlets : Eran Rom * Swift : John Dickinson * Tacker : Gongysh Gongysh * Telemetry : Julien Danjou * Tricircle : Chaoyi Huang * Tripleo : Emilien Macchi * Trove : Amrith Amrith * Vitrage : Ifat Afek * Watcher : Alexander Chadin * Winstackers : Claudiu Belu * Zaqar : Fei Long Wang * Zun : Hongbin Lu Elections:* Ironic: [ http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_08ff4080d37365ba ]( http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_08ff4080d37365ba )* Keystone: [ http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_1d2eef76fdfc1ec4 ]( http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_1d2eef76fdfc1ec4 )* Neutron: [ http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_6df9c8e056680402 ]( http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_6df9c8e056680402 )* Quality_Assurance: [ http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_99413ba03ba1c6b3 ]( http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_99413ba03ba1c6b3 )* Stable_Branch_Maintenance: [ http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_b719c6a5a681033b ]( http://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_b719c6a5a681033b )Election process details and results are also available here: [ https://governance.openstack.org/election/ ]( https://governance.openstack.org/election/ )Thank you to all involved in the PTL election process, -Kendall Nelson (diablo_rojo)

1 0