We jubilantly announce the release of: oslo.messaging 16.1.2 This release is part of the epoxy release series. The source is available from: https://opendev.org/openstack/oslo.messaging Download the package from: https://pypi.org/project/oslo.messaging Please report issues through: https://bugs.launchpad.net/oslo.messaging/+bugs For more details, please see below. 16.1.2 ^^^^^^ Security Issues * Under TLS with "ssl_ca_file", oslo.messaging validated the broker certificate chain but did not verify the RabbitMQ broker hostname. A man-in-the-middle attacker with a certificate trusted by that CA could impersonate the broker. The RabbitMQ driver now verifies the broker hostname when "ssl_ca_file" is set and "[oslo_messaging_rabbit] ssl_enforce_hostname_verification" is enabled. Using "ssl=true" without "ssl_ca_file" still does not verify the broker hostname. The "ssl_enforce_hostname_verification" option defaults to "false" to preserve existing behavior until operators opt in. When enabled together with "ssl_ca_file", hostname verification is enforced for RabbitMQ TLS connections. For transport URLs with multiple brokers and hostname verification enabled, Kombu 5.2.0 or newer substitutes the active broker hostname for TLS. Older Kombu versions log a warning and use the first configured broker hostname as a best effort; operators should upgrade Kombu or use a certificate (SAN or wildcard) that covers all configured broker hostnames. Changes in oslo.messaging 16.1.1..16.1.2 ---------------------------------------- 5ae4ef69 Fix RabbitMQ TLS hostname verification Diffstat (except docs and test files) ------------------------------------- oslo_messaging/_drivers/impl_rabbit.py | 45 +++++ .../rabbit-ssl-hostname-verification-option.yaml | 24 +++ 3 files changed, 248 insertions(+), 2 deletions(-)