May 2021 - openstack-discuss - lists.openstack.org

[cinder] Multiattach volume mount/attach limit
by Adam Tomas 11 May '21

11 May '21

Hi, Is there any way to limit the number of possible mounts of multiattach volume? Best regards Adam Tomas

2 1

[tripleo][ci] all c8 master / wallaby blocked
by Wesley Hayutin 11 May '21

11 May '21

https://bugs.launchpad.net/tripleo/+bug/1927952 https://zuul.openstack.org/builds?job_name=tripleo-ci-centos-8-content-prov… Issues atm w/ quay.io, we are making sure our failover is working properly atm. RDO was missing the latest ceph containers. Thanks

1 1

[swift][security-sig] Please revisit your open vulnerability report
by Jeremy Stanley 11 May '21

11 May '21

Please help the OpenStack Vulnerability Management Team by taking a look at the following report: Swift tempurl middleware reveals signatures in the logfiles (CVE-2017-8761) https://launchpad.net/bugs/1685798 Can it be exploited by a nefarious actor, and if so, how? Is it likely to be fixable in all our supported stable branches, respecting stable backport policy? What deployment configurations and options might determine whether a particular installation is susceptible? This is the sort of feedback we depend on to make determinations regarding whether and how to keep the public notified, so they can make informed decisions. Thanks for doing your part to keep our users safe! -- Jeremy Stanley

1 0

[nova][security-sig] Please revisit your open vulnerability report
by Jeremy Stanley 11 May '21

11 May '21

Please help the OpenStack Vulnerability Management Team by taking a look at the following report: tenant isolation is bypassed if port admin-state-up=false https://launchpad.net/bugs/1798904 Can it be exploited by a nefarious actor, and if so, how? Is it likely to be fixable in all our supported stable branches, respecting stable backport policy? What deployment configurations and options might determine whether a particular installation is susceptible? This is the sort of feedback we depend on to make determinations regarding whether and how to keep the public notified, so they can make informed decisions. Thanks for doing your part to keep our users safe! -- Jeremy Stanley

1 0

[neutron][security-sig] Please revisit your open vulnerability reports
by Jeremy Stanley 11 May '21

11 May '21

Please help the OpenStack Vulnerability Management Team by taking a look at the following reports: Anti-spoofing bypass using Open vSwitch (CVE-2021-20267) https://launchpad.net/bugs/1902917 Neutron RBAC not working for multiple extensions https://launchpad.net/bugs/1784259 tenant isolation is bypassed if port admin-state-up=false https://launchpad.net/bugs/1798904 non-IP ethertypes are permitted with iptables_hybrid firewall driver https://launchpad.net/bugs/1838473 RA Leak on tenant network https://launchpad.net/bugs/1844712 Anti-spoofing bypass https://launchpad.net/bugs/1884341 Can these be exploited by a nefarious actor, and if so, how? Are they likely to be fixable in all our supported stable branches, respecting stable backport policy? What deployment configurations and options might determine whether a particular installation is susceptible? This is the sort of feedback we depend on to make determinations regarding whether and how to keep the public notified, so they can make informed decisions. Thanks for doing your part to keep our users safe! -- Jeremy Stanley

1 0

[keystone][security-sig] Please revisit your open vulnerability report
by Jeremy Stanley 11 May '21

11 May '21

Please help the OpenStack Vulnerability Management Team by taking a look at the following report: PCI-DSS account lock out DoS and account UUID lookup oracle https://launchpad.net/bugs/1688137 Can it be exploited by a nefarious actor, and if so, how? Is it likely to be fixable in all our supported stable branches, respecting stable backport policy? What deployment configurations and options might determine whether a particular installation is susceptible? This is the sort of feedback we depend on to make determinations regarding whether and how to keep the public notified, so they can make informed decisions. Thanks for doing your part to keep our users safe! -- Jeremy Stanley

1 0

[horizon][security-sig] Please revisit your open vulnerability reports
by Jeremy Stanley 11 May '21

11 May '21

Please help the OpenStack Vulnerability Management Team by taking a look at the following reports: using glance v2 api does not remove temporary files https://launchpad.net/bugs/1674846 DOS : API_RESULT_LIMIT does not work for swift objects https://launchpad.net/bugs/1724598 XSS in adding JavaScript into the ‘Subnet Name’ field https://launchpad.net/bugs/1892848 Can these be exploited by a nefarious actor, and if so, how? Are they likely to be fixable in all our supported stable branches, respecting stable backport policy? What deployment configurations and options might determine whether a particular installation is susceptible? This is the sort of feedback we depend on to make determinations regarding whether and how to keep the public notified, so they can make informed decisions. Thanks for doing your part to keep our users safe! -- Jeremy Stanley

1 0

[glance][security-sig] Please revisit your open vulnerability report
by Jeremy Stanley 11 May '21

11 May '21

Please help the OpenStack Vulnerability Management Team by taking a look at the following report: default paste_deploy.flavor is none, but config file text implies it is 'keystone' (was: non-admin users can see all tenants' images even when image is private) https://launchpad.net/bugs/1799588 Can it be exploited by a nefarious actor, and if so, how? Is it likely to be fixable in all our supported stable branches, respecting stable backport policy? What deployment configurations and options might determine whether a particular installation is susceptible? This is the sort of feedback we depend on to make determinations regarding whether and how to keep the public notified, so they can make informed decisions. Thanks for doing your part to keep our users safe! -- Jeremy Stanley

1 0

[TripleO] next irc meeting Tuesday 11 May @ 1400 UTC in #tripleo
by Marios Andreou 11 May '21

11 May '21

Reminder that the next TripleO irc meeting is: ** Tuesday 11 May 1400 UTC in freenode irc channel: #tripleo ** ** https://wiki.openstack.org/wiki/Meetings/TripleO ** ** https://etherpad.opendev.org/p/tripleo-meeting-items ** Please add anything you want to highlight at https://etherpad.opendev.org/p/tripleo-meeting-items This can be recently completed things, ongoing review requests, blocking issues, or anything else tripleo you want to share. Our last meeting was on Apr 27 - you can find the logs there http://eavesdrop.openstack.org/meetings/tripleo/2021/tripleo.2021-04-27-14.… Hope you can make it, regards, marios

1 0

[keystone] release notes for Victoria & wallaby?
by Ruby Loo 11 May '21

11 May '21

Hi, Where might I find out what changed in keystone in the wallaby release? I don't see any release notes for wallaby (or victoria) here: https://docs.openstack.org/releasenotes/keystone/. Thanks in advance, --ruby

2 2