February 2021 - openstack-discuss

[CentOS7][train][tripleo]undercloud self-signed certificate expired
by Ruslanas Gžibovskis 18 Feb '21

18 Feb '21

Hi all. I got undercloud certificate expired and cannot find the best procedure to update the certificate. Do you have any link to Read The Following Material/Manual? I cannot find anything useful. As "openstack undercloud install|upgrade --force-stack-update" fails at step below: "logical_resource_id": "undercloud", "resource_status_reason": "Resource CREATE failed: StackValidationFailed: resources.UndercloudServiceChain.resources.ServiceChain: Property error: ServiceChain.resources[18].properties: Property RootStackName not assigned", "resource_status": "CREATE_FAILED", "physical_resource_id": "50784129-526c-4f14-83d3-7a0c51a7cbd9", "id": "d3b641cb-8ec0-422b-a012-8b14c9724270"}]} -- Ruslanas Gžibovskis +370 6030 7030

2 5

[victoria][cinder] Local Volume Type
by Ammad Syed 18 Feb '21

18 Feb '21

Hi, Is there a way in cinder to create a volume type that creates persistent root and persistent volumes on compute host instance path or local on compute host local storage ? Ammad Ali -- Regards, Syed Ammad Ali

1 0

[neutron] Drivers meeting agenda - Friday 19.02.2021
by Slawek Kaplonski 18 Feb '21

18 Feb '21

Hi, Agenda for tomorrow's drivers meeting is at [1]. We have only one RFE to discuss there: https://bugs.launchpad.net/neutron/+bug/1915151 It is continuation of discussion from last week. I updated it with requested info. Please take a look and tell me if You need anything more there. Also if anyone wants to discuss anything else on tomorrow's meeting, please add Your topics to the "On Demand" section on the agenda page [1]. See You on the meeting tomorrow. [1] https://wiki.openstack.org/wiki/Meetings/NeutronDrivers -- Slawek Kaplonski Principal Software Engineer Red Hat

1 0

[victoria][cinder] Default Storage type
by Malik Obaid 18 Feb '21

18 Feb '21

Hi, I am creating nova instance with cinder backed iscsi storage. I have created multiple storage types. But my launched instance from image use storage type __DEFAULT__ for flavor's root volume. I have changed default_volume_type to mystoragetype in cinder.conf but instances root volume still goes in __DEFAULT__ storage type. However new volume creation in mystoragetype is successful. Need help, how can I set instance root volume storage type during its deployment ? Regards, Malik Obaid

3 4

[swift][security-sig] Please revisit your open vulnerability report
by Jeremy Stanley 18 Feb '21

18 Feb '21

Please help the OpenStack Vulnerability Management Team by taking a look at the following report: Swift tempurl middleware reveals signatures in the logfiles (CVE-2017-8761) https://launchpad.net/bugs/1685798 Can it be exploited by a nefarious actor, and if so, how? Is it likely to be fixable in all our supported stable branches, respecting stable backport policy? What deployment configurations and options might determine whether a particular installation is susceptible? This is the sort of feedback we depend on to make determinations regarding whether and how to keep the public notified, so they can make informed decisions. Thanks for doing your part to keep our users safe! -- Jeremy Stanley

1 0

[nova][security-sig] Please revisit your open vulnerability reports
by Jeremy Stanley 18 Feb '21

18 Feb '21

Please help the OpenStack Vulnerability Management Team by taking a look at the following reports: Host data corruption through nova inject_key feature https://launchpad.net/bugs/1552042 tenant isolation is bypassed if port admin-state-up=false https://launchpad.net/bugs/1798904 Can these be exploited by a nefarious actor, and if so, how? Are they likely to be fixable in all our supported stable branches, respecting stable backport policy? What deployment configurations and options might determine whether a particular installation is susceptible? This is the sort of feedback we depend on to make determinations regarding whether and how to keep the public notified, so they can make informed decisions. Thanks for doing your part to keep our users safe! -- Jeremy Stanley

1 0

[neutron][security-sig] Please revisit your open vulnerability reports
by Jeremy Stanley 18 Feb '21

18 Feb '21

Please help the OpenStack Vulnerability Management Team by taking a look at the following reports: Metadata iptables rules never inserted upon exception on router creation https://launchpad.net/bugs/1735724 Neutron RBAC not working for multiple extensions https://launchpad.net/bugs/1784259 tenant isolation is bypassed if port admin-state-up=false https://launchpad.net/bugs/1798904 non-IP ethertypes are permitted with iptables_hybrid firewall driver https://launchpad.net/bugs/1838473 RA Leak on tenant network https://launchpad.net/bugs/1844712 Anti-spoofing bypass https://launchpad.net/bugs/1884341 Anti-spoofing bypass using Open vSwitch https://launchpad.net/bugs/1902917 Can these be exploited by a nefarious actor, and if so, how? Are they likely to be fixable in all our supported stable branches, respecting stable backport policy? What deployment configurations and options might determine whether a particular installation is susceptible? This is the sort of feedback we depend on to make determinations regarding whether and how to keep the public notified, so they can make informed decisions. Thanks for doing your part to keep our users safe! -- Jeremy Stanley

1 0

[keystone][security-sig] Please revisit your open vulnerability reports
by Jeremy Stanley 18 Feb '21

18 Feb '21

Please help the OpenStack Vulnerability Management Team by taking a look at the following reports: PCI-DSS account lock out DoS and account UUID lookup oracle https://launchpad.net/bugs/1688137 keystonemiddleware connections to memcached from neutron-server grow beyond configured values https://launchpad.net/bugs/1883659 Can these be exploited by a nefarious actor, and if so, how? Are they likely to be fixable in all our supported stable branches, respecting stable backport policy? What deployment configurations and options might determine whether a particular installation is susceptible? This is the sort of feedback we depend on to make determinations regarding whether and how to keep the public notified, so they can make informed decisions. Thanks for doing your part to keep our users safe! -- Jeremy Stanley

1 0

[horizon][security-sig] Please revisit your open vulnerability reports
by Jeremy Stanley 18 Feb '21

18 Feb '21

Please help the OpenStack Vulnerability Management Team by taking a look at the following reports: using glance v2 api does not remove temporary files https://launchpad.net/bugs/1674846 DOS : API_RESULT_LIMIT does not work for swift objects https://launchpad.net/bugs/1724598 XSS in adding JavaScript into the ‘Subnet Name’ field https://launchpad.net/bugs/1892848 Can these be exploited by a nefarious actor, and if so, how? Are they likely to be fixable in all our supported stable branches, respecting stable backport policy? What deployment configurations and options might determine whether a particular installation is susceptible? This is the sort of feedback we depend on to make determinations regarding whether and how to keep the public notified, so they can make informed decisions. Thanks for doing your part to keep our users safe! -- Jeremy Stanley

1 0

[glance][security-sig] Please revisit your open vulnerability report
by Jeremy Stanley 18 Feb '21

18 Feb '21

Please help the OpenStack Vulnerability Management Team by taking a look at the following report: default paste_deploy.flavor is none, but config file text implies it is 'keystone' (was: non-admin users can see all tenants' images even when image is private) https://launchpad.net/bugs/1799588 Can it be exploited by a nefarious actor, and if so, how? Is it likely to be fixable in all our supported stable branches, respecting stable backport policy? What deployment configurations and options might determine whether a particular installation is susceptible? This is the sort of feedback we depend on to make determinations regarding whether and how to keep the public notified, so they can make informed decisions. Thanks for doing your part to keep our users safe! -- Jeremy Stanley

1 0